{ "Event": { "published": true, "date": "2022-06-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-21", "timestamp": 1655856181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a0d14f91-1917-4ec6-a353-c553343285fa", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dad628-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789595, "uuid": "6f77ce62-0f09-4074-a6ed-f04e4df92489", "comment": "Malware payload (AgentTesla)", "value": "a9bdeb2175725def64e40c2dfc5ac66b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789595, "uuid": "0acf5850-a3b4-4b2f-a8cb-4f5835a3a134", "comment": "Malware payload (AgentTesla)", "value": "006b674eb40ca99b1cffb927d3a85964fd41d31922d3af14c2b0e4b10056af0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789595, "uuid": "9a8fa627-868c-45e8-b284-ad546b892dfd", "comment": "Malware payload (AgentTesla)", "value": "4bfb4197f333c6a863235671a5c3132c1e560c09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789595, "uuid": "b7967255-2f89-4e3c-84e2-ee600efe30c4", "comment": "Malware payload (AgentTesla)", "value": "492b9db7f66cb8981a2469f2709070a68a9aef983a1b9098680362a90b1f7634bbb8f77fa698de26eea464d516fd2b57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789595, "uuid": "b37d154c-85a3-4274-a348-b168363d32da", "value": "T1A9F4F1F58FF8B8AAD15824777094A03C33E24C2EDC15D57ACA8BF65B34666C125E4E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789595, "uuid": "b65361e2-737a-4aab-b170-a37d95931351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789595, "uuid": "fd735f2c-6d6b-45bb-ac87-6c36c4a483bc", "value": "12288:/yPUPnB7xLYLmO7sn+WIMcJsI1Y8LPs6CITUo6AMpRFlCHmlkACv72ZOC9VyVy9c:qPUpemO7nMcJkqPs6CITUKMP3CHmLyqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789595, "uuid": "ecc98033-8fd0-45e4-8be3-2958cfe6a5c7", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789595, "uuid": "78ca6817-4059-4c54-8e34-0dcc77186571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789595, "uuid": "9ef66d47-92f5-4ab6-aac4-95dbf2a59f9e", "value": "SecuriteInfo.com.Trojan.DownLoader27.59888.20061.30004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8478028-f14d-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655807745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807745, "uuid": "aa70a6ce-4efa-40c0-872b-6f1e30d34e1d", "comment": "Malware payload (QuasarRAT)", "value": "ab46db084a1049e13e85385e3ec74aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807745, "uuid": "cb85f6dc-1b2b-4ece-87f1-6613f08d2073", "comment": "Malware payload (QuasarRAT)", "value": "00c58e257f0fa7212a55a4895565a8acfb004515d961588b6fa7985a36be3389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807745, "uuid": "4d18c643-2337-4940-a00a-2c76d220feec", "comment": "Malware payload (QuasarRAT)", "value": "ed6b2d9c24dfa14191dd172aa4d4a8610c29e801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807745, "uuid": "337c3f5e-f8d0-4fb6-bfa6-9bb5943f36f9", "comment": "Malware payload (QuasarRAT)", "value": "d6e0b278b1dc0ffd80152ced0de8046ff9364225db2c6395679c822d4d288f22ee5caabb8e2c6f2747864c5bccfce7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807745, "uuid": "ea3abd07-6681-4b87-b1a5-e119d55354d7", "value": "T172E312C2E6DD6761C1A79BB193A75BC800BA9013CBD71FD5F91909180E5E7E2BF48382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807745, "uuid": "77713adb-bd62-4be8-977a-ec14b49ea516", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807745, "uuid": "068f4276-cab1-433c-9950-3b28db1e22a8", "value": "3072:TWayQRBgOqIY33JIwluKjX5/Jc6nz+LuTpm/jpLx9E:iegBIE3JImj1lnpm7po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807745, "uuid": "fd5b8f7a-26ed-4efb-b2a1-00deaa8ea620", "value": 148133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807745, "uuid": "2c5fe87c-524b-4b92-ac39-a7d6e7875d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807745, "uuid": "6b15976e-da43-4e3d-834d-c58d7cc12793", "value": "Client-builts.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79739940-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655806270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806270, "uuid": "c5b3e7b4-db50-4cb6-afe1-44442cfdd581", "comment": "Malware payload (RemcosRAT)", "value": "28657b966ded345476cb24a91a581efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806270, "uuid": "c8ce35c0-68f4-42c2-baf1-b57794caa796", "comment": "Malware payload (RemcosRAT)", "value": "03661d07de24c7fdc11e12bc022f0f1b5a54ef2d6e578e2d34403b35d51fb44d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806270, "uuid": "b878b9c0-a0d5-4e28-874b-1f0b798f7153", "comment": "Malware payload (RemcosRAT)", "value": "06a9578f6610323d7f4338bffef87a0512c083c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806270, "uuid": "6b5927b0-2c62-4417-8f5c-677506f9278c", "comment": "Malware payload (RemcosRAT)", "value": "489092794688df3200caf8e97b3e32ad71fc810ee8b1c06394fad6a7d79d9688cb2c12b1bdcb680c5691451d4c6d1ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806270, "uuid": "bf31a719-a07f-4696-ba41-2a80ae5c437d", "value": "T1B7258D591F89AEC2DCE94BBA91F30B656311AF30585FA70B1294773F063B4CA6EC019D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806270, "uuid": "ab402164-5dc4-43e8-8603-2b238716345b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806270, "uuid": "f045fe97-3296-4846-af86-d2e23faba83a", "value": "24576:pbBHsuubAqpIocODpBaD+PnpLJZObnkYo6:XM1MbsDpBA+PnpL3fYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806270, "uuid": "995a88ca-4f51-4cbe-a7c0-55a98d0f5419", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806270, "uuid": "4af21da7-a013-4d9f-a8a9-bed73bdfebee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806270, "uuid": "73c4c760-4420-4638-b8c7-e0fdd040a216", "value": "vbc (5).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b95c56-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655841756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841756, "uuid": "c99b03c6-ce9d-4174-b789-8a6b5ff8435f", "comment": "Malware payload (Mirai)", "value": "930a4c6455c3d9617ad672d412c22318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841756, "uuid": "e9908846-f77b-445d-98d4-1935486d08d4", "comment": "Malware payload (Mirai)", "value": "04df45704c4e3b47b9e35d8c409ab5e58dbd15f9a99da79df7a06e869d37dea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841756, "uuid": "0880cdf0-9c6b-4015-be90-d82bb3929415", "comment": "Malware payload (Mirai)", "value": "88ed323785347898890f18ea57c6c0159bc40a37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841756, "uuid": "41058232-38c2-431b-98cd-902112d776d0", "comment": "Malware payload (Mirai)", "value": "a92a46e129e2eff0348409681c9ab6f0234cc5b70dc07a7025dd3d7fbb1efd0500818132a508e6e6a1628ef787754788", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841756, "uuid": "628379c7-bb8e-43ee-aaf6-72e35c6f0b6e", "value": "T1CB239D66D42DAEC4C65846B8BA284D3C1B63F404C6532EF7275BC2A5944BEBCF50A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841756, "uuid": "857a2228-25ac-415e-ab65-cff1c5aa2920", "value": "768:0aC/NvCzSsYOYoOe1dKqNhMcqItxepnx8QK0FsC1oBWLlRC7G:0aC/gzS5OYudKqNhbxxCKZBCRC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841756, "uuid": "fff7c761-1e72-415f-965b-68fcffa3df53", "value": 48692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841756, "uuid": "0c1c2a59-ff72-4aa0-b8b4-7716300e5b9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841756, "uuid": "2b6517aa-3281-41e8-a672-bc455962b93e", "value": "930a4c6455c3d9617ad672d412c22318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2f7c2a-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655809654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809654, "uuid": "e6244ac0-db3c-4bda-b36a-2f6ee1d85efa", "comment": "Malware payload (Formbook)", "value": "d2d37362b56af2703f2c3dcfb36b56b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809654, "uuid": "a5b7a2fb-e053-4ca0-b432-3be651a8b27c", "comment": "Malware payload (Formbook)", "value": "04e6039e29e0b8f6fb1ec1502a3225c74c4c18f6c0ba1ce10eb2c834ede7f149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809654, "uuid": "1f3608d5-9785-4e4a-9ae8-2e3bcfda9731", "comment": "Malware payload (Formbook)", "value": "06c6acc7060fb356d5bc7693f8d4bcecbbb4fb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809654, "uuid": "997b5c98-c16d-44b9-9ab1-130f91eeebda", "comment": "Malware payload (Formbook)", "value": "5bb44b29d3204d5e582cec570b5141231b8ac5bfbfd1f63cf72feb1405c76959a30e8a6046d775700805fdd5a2d80bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809654, "uuid": "148fc125-8d54-4389-b24d-3dea9cb2a76a", "value": "T15984CF17BACCC74CC3189A76B4FA41311394EFA36932AB15BDC8FF2D497266D69012C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809654, "uuid": "69da2b05-1bc7-441d-ade3-7437f758aa5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809654, "uuid": "61cf442a-9b0f-49da-b835-2cd1b3807b10", "value": "6144:xphT/VJ4QOEzSB8jN3JKF/EIluUwhACK2395Rvo4pGuE:fTJHOEzSW53LrhZNqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809654, "uuid": "43138bd5-f419-4eea-a2b3-85d8818e0884", "value": 379416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809654, "uuid": "2d64ffee-e90c-4a70-94e6-eb0282ca6a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809654, "uuid": "fbd8faed-03f4-4ce2-8f88-12dd00b0b8cc", "value": "d2d37362b56af2703f2c3dcfb36b56b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072e400f-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655841727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841727, "uuid": "0f8897fe-d531-4308-9aba-89c18afb3cc4", "comment": "Malware payload (Mirai)", "value": "6528ed8b92c7189c5eba2647187a994d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841727, "uuid": "b756e8dd-270b-401c-b43a-cd3cfd0e6660", "comment": "Malware payload (Mirai)", "value": "067a65daa898768bb5af6a7e2883184ec7eb4d51585a1dcca31e060f82d3f19d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841727, "uuid": "50ed4a84-7b92-4c18-bd2a-80c3117c8f62", "comment": "Malware payload (Mirai)", "value": "0514bfabc8fd8f90dee8cdd2c45ac167909eb66e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841727, "uuid": "33fae3f7-c090-4739-936b-3f0333560fb5", "comment": "Malware payload (Mirai)", "value": "add3b2966d2c0991559fa717ae9e59af4112a536c5453eea20561ebebd7843e3777557b0c001788bd5fdf2298ac59a89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841727, "uuid": "14dd5df8-fbf8-4e0b-a89b-59c2d3004035", "value": "T15263934E3E219FACFF9C823547B79E20A24833A627A1D544D15DEA021E7034E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841727, "uuid": "91490558-ddf2-4b26-8e9c-d21d2fdbef7b", "value": "1536:9c164DTmhOhk2pCJs7Px7PWc7PBToFA0/cMezmzg9d90yGffG8:mVDT8OKfHCMezmzgv90/HG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841727, "uuid": "e1b0464f-8fbd-4419-a24a-773699213e2a", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841727, "uuid": "0bfa638d-40ee-4102-aa3a-f13081e52513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841727, "uuid": "a6875384-f57e-4746-9620-4ab50ff5b051", "value": "6528ed8b92c7189c5eba2647187a994d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa58dcb-f12e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655794381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794381, "uuid": "8f592a19-9867-43f8-8742-f5ee3793e5c3", "comment": "Malware payload (AgentTesla)", "value": "08b0f272f1a9e5c484b88e147a06264c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794381, "uuid": "f4d75c67-b257-4080-b340-4232875799e4", "comment": "Malware payload (AgentTesla)", "value": "075f21626c1f459c13b7c269a1bf9ea0c6c8fac67fac8d86ac5ac19e9fe8e5d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794381, "uuid": "34be43e3-4377-4d07-a619-3c39ccb8a988", "comment": "Malware payload (AgentTesla)", "value": "8f4d6c47cfcfe695c9f9887169bdfc784a9d9eba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794381, "uuid": "462b9496-ae3b-48ab-bc2f-f223eb37666b", "comment": "Malware payload (AgentTesla)", "value": "c195d690f7581b0677570980af28e8e32334eac41a25d0288ea5a1c4d61272bae31ae93d312da134573e2860cb25df8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794381, "uuid": "2c9b1477-5591-49fe-92bc-24bcbd08702f", "value": "T1510519AC321C75DED92BC539CAB41C68EAA0747F930B4147A42B159DAE0CAC7EF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794381, "uuid": "0fd3bb98-46e5-4044-a306-1c3d6e4394ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794381, "uuid": "eaafd197-76e7-4237-81d1-dba725df9637", "value": "12288:ky2iNPf+B85FrYwqTNj/QYu4QQMZBv36F4hinWLBU+pWnbPA4KkD0So/nrQECUKw:X1B+B85FapQQMLdenA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655794381, "uuid": "78bfe8de-35b9-4e72-bb02-bcb24277aa67", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655794381, "uuid": "ef4f5f56-e013-42b8-9816-f19b784f2379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794381, "uuid": "8485124c-ea93-48be-bea5-f725987e0658", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685e20f1-f12b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655792927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792927, "uuid": "e19fa096-6933-45d9-95d9-1f82b7293d6c", "comment": "Malware payload (AveMariaRAT)", "value": "ad5c021e9a8fa8eb89f25afa30c5fc32", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792927, "uuid": "44276fb6-1673-406d-93dc-1374356c53d9", "comment": "Malware payload (AveMariaRAT)", "value": "0786692282b616864491cb617850c08c1cfdba19c89320699900738ae2854f2c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792927, "uuid": "5b0b6090-d6df-46d3-ab0a-f7c8278a9841", "comment": "Malware payload (AveMariaRAT)", "value": "9c0657241720e7e36672b866b1d6ae7bc1be6dc2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792927, "uuid": "607d6d43-128d-408b-91b4-f1fc11454caf", "comment": "Malware payload (AveMariaRAT)", "value": "31a0da6c769944b1f70992dd17e790a1621a53d4459e7206f371d7a54ff286a0f1ff2f70a65cbcbf10ae65cd860b20df", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792927, "uuid": "605fc77c-e15d-42bf-8cf2-0f48a256bf43", "value": "T17D0412E2777AF5925F1FAE4AFA120DD60A93D8516020D2635FAC20FF216B1310F2764E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792927, "uuid": "b6c28186-38d8-4efa-ac1d-2d54634a0031", "value": "3072:Tw2HyNPskLr6bigbMmjtZXMKPaa21lmysx4c3ivLorg3nH9ewq5K+J2HuAjcYbn3:TwAoHSbfn/caaaSqVyvLCgXH9C5F037r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655792927, "uuid": "55a34b00-304b-4080-a9e9-a0178bbfe1ef", "value": 178054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655792927, "uuid": "781e5603-ec64-49e5-a525-c46d26004067", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792927, "uuid": "5caba3dc-5143-4822-99ef-d191978fc9e9", "value": "A107 Amended Contract Prime power Logistic facility.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e418fba-f169-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655819405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819405, "uuid": "936ee5d1-6bd6-43e9-82c3-19f25ce1ce5c", "comment": "Malware payload (Mirai)", "value": "fb739ef003720fb7275487b33b0f9b32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819405, "uuid": "e4be74a0-ffa5-4c47-b6d9-a5bb207aeb6b", "comment": "Malware payload (Mirai)", "value": "07a4514906808331b464c27e6719d92f083963de51de01dd98e0df872b26976b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819405, "uuid": "8f0a26a5-b70b-4253-9eab-4654aacf2424", "comment": "Malware payload (Mirai)", "value": "2efe0eb57292d1609ccd4d5d774059b3be446aa4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819405, "uuid": "32a8902d-e5ff-4ba3-bac9-28498dc0990c", "comment": "Malware payload (Mirai)", "value": "c9b336d96a858f8b0b1e622943d182301a386d890749e96c85314ab67cc597f03c67b2b47de55aef095a3e4ac8c7c562", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819405, "uuid": "f8bf1b45-b166-4701-8660-2eb0d20bf2cc", "value": "T1B933026267AD2AE291B05773FC33AC5A66EC17F95C6730D62CF05A1577C58024EB2283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819405, "uuid": "42abdb1e-d4fa-4a2f-9b65-ef432f0986bf", "value": "1536:j9O/ZMAXIxNUk05LcPqF1aBexo4opKZbB:j9O/ZNKy9LGqFUFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655819405, "uuid": "f7bc5c3c-b572-431c-a091-74c3cb938ea7", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655819405, "uuid": "2fb7b1cd-0d03-4eaf-9064-0400ce2b5105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819405, "uuid": "b75d2345-4485-4e0a-b4d1-f4aa699991b5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a73be-f155-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655810980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810980, "uuid": "8a9d6f8b-fe31-48fd-bceb-168d6fa0d8f7", "comment": "Malware payload (Formbook)", "value": "d880e2de89f81c41584300562970fb92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810980, "uuid": "82302618-cca6-4e97-95e9-bda8a4b2f100", "comment": "Malware payload (Formbook)", "value": "085917245898b3d25910807103748a579b389697e79bdceb82b043f66b86a130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810980, "uuid": "01b52eff-093e-4425-9ff4-70b8e87ba63c", "comment": "Malware payload (Formbook)", "value": "edf38c0c4eaa77d865f25ea92fd9e09168893228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810980, "uuid": "31365f7e-dae7-472b-8c2c-ab1d0ba592f1", "comment": "Malware payload (Formbook)", "value": "27bc29218d33cea0f12b5c7ca4a1b46c3c223baffeaba42d31ac39f4336343ffb3129683c294d51a997a91d0207218e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810980, "uuid": "d924f49c-686c-41e9-a9b9-84d54a510247", "value": "T1CA153AAC365C75DEC86BC579CAA81C68EAA0747FD31B4147A027059D9E0CAC7EF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810980, "uuid": "0c0c73cf-b4c6-4f4c-a46a-429196043ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810980, "uuid": "30e7c961-3992-4a55-a939-a1f6c9c311b4", "value": "12288:9N52iNPf+B85FrQa0sgnFuK++JUxtESTZKNPl8Ii9D5wZ4qjdQ0IqhnizLSiGJi5:J1B+B85FhI7zxSTMxlqXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655810980, "uuid": "a57646f7-ebf7-41c2-bde0-873b010a55b3", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655810980, "uuid": "59833a8f-9efc-4926-a144-f8fcee80886b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810980, "uuid": "6125b196-a35d-4e31-8e3f-84a4bc722682", "value": "Catalog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17218942-f114-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655782913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782913, "uuid": "6c6aec06-3ef8-49c9-8c2e-2bdd3b95ff1f", "comment": "Malware payload (Formbook)", "value": "dfa5c9f8b8ee40b5f710fa4138f35fec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782913, "uuid": "84574e52-edaa-4c98-b1ab-f86ab56fc24d", "comment": "Malware payload (Formbook)", "value": "08ee4d692882fdf07c523b9d87a76d6b60f0d8a665beb2a7320de8cda4a5c540", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782913, "uuid": "dc251016-1fb3-419c-9bca-7466d0bbffb2", "comment": "Malware payload (Formbook)", "value": "bdf4899b28e519fa24b28874da0e4601b08bcbda", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782913, "uuid": "135e3893-f757-4d03-8de6-40dbd3ee7586", "comment": "Malware payload (Formbook)", "value": "6f77b2aa3032026f88644ac8c762dba37e3f39dc4d9a5901fa2910b801b63797bd1a75bdd902e079a5579233cb6494b5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782913, "uuid": "298ee591-3991-4853-842e-3ef04815f912", "value": "T1F863E0D01762F00DE60FFE300B11CEE912A4ED663A89727FB72676986DF86353246D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782913, "uuid": "e824d543-3f11-45f1-b99a-0540c2adcca7", "value": "1536:uez7sU8EGjzUhFOaZ4J+zaJtSmTyF7pNzuQ0BNH3wliKH6Q/4tjWaHq:uezVCEhFOaZ4Iza9uF7wPH3wXHdIdHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782913, "uuid": "2214a6df-6985-4e5d-81a0-28d075146944", "value": 73320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782913, "uuid": "3a3a6a3a-a256-4a72-89e1-f12dc7b904ae", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782913, "uuid": "53efdfae-68af-45f3-8425-b8b803344371", "value": "DHL_AWB_NO#907853880911.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03c94cd-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793585, "uuid": "08a3108c-5f6e-4755-b864-5c72b53af9fb", "comment": "Malware payload", "value": "4f5c1bb12c487afacba8802b652210db", "object_relation": "md5", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793585, "uuid": "60a9007e-00d1-4b70-a915-689007e11bc9", "comment": "Malware payload", "value": "0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793585, "uuid": "547c8acb-e760-463f-9262-d8d6a76b7e2e", "comment": "Malware payload", "value": "83883526d86b0dcd71327bad1b1b498fd548b7c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793585, "uuid": "42ad6b24-4c2e-4fc9-ad6e-7dcd3010e650", "comment": "Malware payload", "value": "3dc9b1ba29a0f6cb5339cec859c0d9ce81fa70a65d58c2c5c3053c62ba7732fbad722f0be38f7932555c8b4e88141932", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793585, "uuid": "c0f2ca67-f253-488b-a53d-b61d4824b216", "value": "T130B37B5B77B430E8E5728634CA519A0AEB72B47207618FAF076446A51F233D19E3EF70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793585, "uuid": "e4c89823-0c21-42a6-beae-e7f7836de88a", "value": "123d795e4473ef6f4f48f98eef700823", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793585, "uuid": "c52564a1-4041-4f0d-8a64-e524e2fd491f", "value": "1536:H2+Jxz5ugKNwH6E9RZhXl65YCo/SxeACesjw79dlz2Vgfsbg1gNE4wnX02yI/:/xzBKNk9RZ65Yr/BACesjwzstfNxuX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793585, "uuid": "06c75d79-00b6-4026-803a-eaaf5cd4162e", "value": 107464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793585, "uuid": "e8a23a5d-7a55-45b2-8340-4107910393d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793585, "uuid": "66e62d40-7d53-445a-8889-25f881e0f012", "value": "0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2025df-f154-11ec-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1655810702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810702, "uuid": "64f4c406-0364-48fb-8451-b8dd7c2b9121", "comment": "Malware payload (BluStealer)", "value": "ef6e01ae828e6ad84d7e3c68f3374272", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810702, "uuid": "93fbba5b-e127-4452-8aff-3dec2b89bf14", "comment": "Malware payload (BluStealer)", "value": "0a005b0824bc9b2fa436d11ee4828d1b572fe8c53645b6aa010fd4465a77c595", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810702, "uuid": "e4ea3c50-ef94-4263-869c-c1811928eaf6", "comment": "Malware payload (BluStealer)", "value": "8503172eb211f94b6395bd59fb7c365ca3c4eedb", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810702, "uuid": "f8a90327-72e2-4dbe-b3e6-c722c5c948b5", "comment": "Malware payload (BluStealer)", "value": "a2d350cd8878054f4f8b02a10432cbcddd12ffba5e75a99c207de8f60dd55ab9fff81dd52a99c7dcd44a502117b1fd71", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810702, "uuid": "64b46128-0472-4091-9f0e-69a54d5faa68", "value": "T179046D5FED00AC8CCA7409FB6B35C3406D687E52AE1F46DD238CF68B8272545663C6E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810702, "uuid": "c191a9d3-5339-4653-aa08-944bb2b59c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810702, "uuid": "16a00b1e-b5cb-4bf0-b22f-128b4890d75e", "value": "384:l952CzYJUkqkykhu3xyJpGYPXzeXNoqjroor64oS3ZkX:l9JYJUBYGEeXNoq/oor64o8Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655810702, "uuid": "3fc08094-4e7e-48ec-99ae-7ccc2ab449a6", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655810702, "uuid": "7e1505d8-d672-498c-8a58-cc10742274e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810702, "uuid": "ae3388da-77b8-4376-97fa-f20e97016202", "value": "Requests1250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27c51b8-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808514, "uuid": "92426c79-73d8-4945-bf2c-243b4b4d1990", "comment": "Malware payload (BlackCat)", "value": "615131e320b8f07e4b4bbb01d57a8eee", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808514, "uuid": "09ea1046-ca2b-4435-ba26-19246b4ec8fd", "comment": "Malware payload (BlackCat)", "value": "0b4b97d2dee124877483ffea367d8058bfd2203e32270510486aa5c0f2d6647e", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808514, "uuid": "17394ddd-dfae-4d0e-8bb9-64a404d682e2", "comment": "Malware payload (BlackCat)", "value": "8931c45c9fd1afdc64c8e1fca67e33899560960b", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808514, "uuid": "2c5d11d9-4118-47f9-bc98-f2fe54f13fd2", "comment": "Malware payload (BlackCat)", "value": "e7b9a93fd0e5138693a883186a99e351fee1157029a6f88bcd1f054de47e214da498b1a4af5a1b6f93c37acccd5e1f6a", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808514, "uuid": "af528a6d-6213-4449-8806-9eda76e92521", "value": "T1597533D49B5D414AE3803BB1A9585B76C264EF7386916BCE3973433278E5BC8EB12C21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808514, "uuid": "e5b4d253-4736-4e36-8d92-507b02a6b9f1", "value": "49152:NFMEQj58Ul0qaQYoUzhFWkaLqK+J5Sp7RPPBa:NiZ9beQYlhEkOX+bSpra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808514, "uuid": "7e510f26-41cc-40cd-98c3-f29d1ee1ff2c", "value": 1702162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808514, "uuid": "400347d5-16d8-4fdf-a34d-49f28dbfce94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808514, "uuid": "af7fc769-7578-45d3-9670-1f3f059e50be", "value": "0b4b97d2dee124877483ffea367d8058bfd2203e32270510486aa5c0f2d6647e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2d5486-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655809172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809172, "uuid": "4280b754-3a68-44a6-b1c4-b9832aec5b77", "comment": "Malware payload (GuLoader)", "value": "b4549d8aa7c861683c55131bbc7fd840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809172, "uuid": "357a0deb-310c-480d-ad9f-a4b8af0a5d4b", "comment": "Malware payload (GuLoader)", "value": "0b7e915261aafacd1d6483a5fbb6469a6e36f1f242bcaa3943ffe639dc79aac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809172, "uuid": "0e166e34-a27a-4c6e-9224-3bc3b70b5d41", "comment": "Malware payload (GuLoader)", "value": "9e44a339bbdb7fe2648450b909d3a68d4f21288f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809172, "uuid": "e12ec7d7-5500-4efb-b22b-28c2cf2d1c87", "comment": "Malware payload (GuLoader)", "value": "5705f565989c19a182a99ea4762e6a3cfb3e5b2c1f02216569da807915d5f2e618d45dbf65019207f7c63f86bc1c0a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809172, "uuid": "8e4a8018-ce5d-4da8-b5a7-507e31a0f1ee", "value": "T130F30161A610D5BBEA7217700AB99BB78BEBEC1499605E0717603E5D3CB33D19B1F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809172, "uuid": "6f46e419-f930-4a32-98de-665a77493a58", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809172, "uuid": "8fad5925-93fa-4f91-8964-b04263a5fa4a", "value": "3072:8bG7N2kDTHUpouKj4b+/P7xHT52qdxD9q1N2+rXVMwdAQJkIEzfYo8mSRt4fS8:8bE/HUCO+/NH93dxm3rFpEzF8mSwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809172, "uuid": "150dca89-c9fe-4eb8-bdcc-ff01a36375ac", "value": 172296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809172, "uuid": "5e0af6cd-07f3-4a33-a6b5-6615b21b54b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809172, "uuid": "0e0030c3-6c9f-4452-91eb-4f9b83681753", "value": "backingup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b35a26f-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655832956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832956, "uuid": "cfce35fe-6dec-4470-bc27-9c2844fd56cf", "comment": "Malware payload (Formbook)", "value": "43d334e0dd241375e672869ab1c8cc61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832956, "uuid": "26093edf-4319-4812-9a90-dd6396631179", "comment": "Malware payload (Formbook)", "value": "0b7ef1e2d62174bd8dc71fd5421239414f5aa76106232715caec9ebf054b6ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832956, "uuid": "9162c0f2-d1a5-4181-8b86-724bb56dd249", "comment": "Malware payload (Formbook)", "value": "0d4b81dfcd50ccf1be068661e1afbbf8eee34fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832956, "uuid": "09058760-cd2c-4c99-a5f6-ad959e0b835a", "comment": "Malware payload (Formbook)", "value": "5e9558534ea3da53d448a69639a9308149f1b0295bc142e0049427a6c17881f70b38ff9c6edcdc312cd28f6c8ac9b96c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832956, "uuid": "a0f5d674-29eb-4240-ab4e-d4af19ef4ff6", "value": "T1B513BF56E67EC63DD564067F9A63FA010B71A3624C22C22E5C8425B56C33F60F6C6F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832956, "uuid": "c14f2391-bdfa-404e-8d09-8a3dff8aa734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832956, "uuid": "b77e1c71-68ae-4aba-866f-a65ba14608d3", "value": "768:t+gZvKabuB3m9Nf7oSFYwQjXvLWRgcL0ST8iNxy2S:LLuB3mf97QWRgcL9HNxvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832956, "uuid": "0c8a9bab-90fb-46a0-8c7c-9259bb05edf2", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832956, "uuid": "559c7208-e530-4f55-97b8-12fdac969e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832956, "uuid": "67d314a9-872c-479d-9a60-e1ce14d18276", "value": "boy.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6f0135-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655832990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832990, "uuid": "7b2d0225-bb81-4d45-935d-edc221fb81bf", "comment": "Malware payload", "value": "620a04c6d352c48b0697f73d5993be86", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832990, "uuid": "685390db-c12d-4dfd-8e48-4957d34b815f", "comment": "Malware payload", "value": "0bbce92b547f0e99a37636b090cb05d9633cc05e1ce876e0076ca32dc4c901c4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832990, "uuid": "3dc4ce4d-cd12-4c44-af13-7163869611d6", "comment": "Malware payload", "value": "f545a8b9c1361e601baa2be4bc275a2dff5c4813", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832990, "uuid": "36e016cc-bed6-43d3-8980-f6144778135f", "comment": "Malware payload", "value": "f03c1d2d33206a281849340e29a296713846ac21fd964f9fb01eddc05b3b3fb0d0af169827e11a17838590c116a82425", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832990, "uuid": "c06240cb-ce7a-43c8-bc49-86cd22894f00", "value": "T18DD2F66A5F33AE9C8770237481DD9AD5ED2E07F704210E4A392E95806FF58A5C8F0E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832990, "uuid": "c168b3d5-3087-4f68-9b1e-8741029b45ec", "value": "768:ClxhDPRvLZuH2kuG/HmuxwxFTNT9TW+UiqnEXxqgSeEFs2auAQSR:UxhRvbVG/BkT3yA5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832990, "uuid": "d41b8156-a45f-4c27-8315-5c1f2ec72fc7", "value": 29490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832990, "uuid": "399ad87d-fc9e-4c87-989f-6bf701d77f9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832990, "uuid": "935efd4a-7bcd-420d-a760-faa2ed6bc3cc", "value": "0bbce92b547f0e99a37636b090cb05d9633cc05e1ce876e0076ca32dc4c901c4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331b2d1b-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "94907f6c-40da-4266-9f7f-81732018171c", "comment": "Malware payload (Mirai)", "value": "fa529519c03d91e1a3dad8c988107559", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "2db373f6-7c76-4c2b-a8e8-15b30483fe1e", "comment": "Malware payload (Mirai)", "value": "0c2e4399389b39061922f5b80b4c153c928f238674a1a6ff6c033ffdcccfda19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "6ac909f9-7b61-4b55-ac2e-ee7ee3d0150c", "comment": "Malware payload (Mirai)", "value": "25a79b8ad4f9dc9ff169d721d5b2a865d497a09b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "535ea8dc-be48-48b5-a750-689d2a10bfda", "comment": "Malware payload (Mirai)", "value": "54a86a99ce88c70c0d49cf6b29cfcca232d8ebbe315b75993e118daead87cf77ef3c59ac83b0e907df08b9a8796af501", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "025fbb45-7ef2-4516-a6f5-3e907c5ba4f8", "value": "T182935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B73D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "06059ddb-28f4-4362-a727-d8db68fbffbe", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3oyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKYifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "7db39dc5-46f9-4e55-8c73-221caf15454d", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "a42f1b11-08d6-4b9f-874e-56f88ea7249c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "9d3229cc-6c08-4355-b9f6-9f2c2f8d9426", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8597e488-f187-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832490, "uuid": "bbf5da17-b490-4e14-9ec6-4708c8001ce5", "comment": "Malware payload (Heodo)", "value": "db02701851e397d834345b9934c2f717", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832490, "uuid": "73da9617-166e-4d82-90b6-fbf75f1f2e63", "comment": "Malware payload (Heodo)", "value": "0c5c27d79353d0af41507ea0fe9f91c5564b120b4a5b06753364897bcdcdc3fb", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832490, "uuid": "234918e3-0c1e-4185-86fd-7c6cd28ae114", "comment": "Malware payload (Heodo)", "value": "fb8d7c3286826b16fcd2fb48864c24733d1d5cef", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832490, "uuid": "1c13f65a-2acc-4eae-8f74-3400fda5a1f9", "comment": "Malware payload (Heodo)", "value": "45b804ced6ab087cc913b237760babb448e22bdb146c387dddf7e517f8bec7044ed4495b41bb0d3d3bda22a2ad3211f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832490, "uuid": "249f85d8-8f53-415c-a593-4f681c6d6e28", "value": "T14E64AC06224044AAF74A4B708A17F9D687667C7950E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832490, "uuid": "cf451abc-9a4d-4c49-ba15-693eee5dce28", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832490, "uuid": "583c1ac1-ae5b-4111-b130-0f129e84e6f4", "value": "6144:3MiSTD2He3kjHfNsQnIzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3/NmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832490, "uuid": "62a1a021-a899-4b72-8364-07bba0b79fb8", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832490, "uuid": "a600d4cc-642e-4921-bffd-b5572d109350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832490, "uuid": "e7290edf-6912-412c-a124-bcaa3cf35de2", "value": "rOASkDCepboLkSLvYw7.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8bce7-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655825766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825766, "uuid": "ef0d375e-1e75-4dab-8b35-062bce962227", "comment": "Malware payload (GuLoader)", "value": "c1ed8dc23eb06d7a03b5431d8bb4025b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825766, "uuid": "4d51c54a-72d3-47a6-ab74-88e7c6d903eb", "comment": "Malware payload (GuLoader)", "value": "0e21cb48d334fa636c6a2d9d40726f4b7f03b80ae79bc611d6ac94ff552398cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825766, "uuid": "dd4f230c-4051-403d-9d74-59e09e4705c1", "comment": "Malware payload (GuLoader)", "value": "39a78f697cd48c66e799ebc246b053ed895c14bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825766, "uuid": "33a02cc2-f905-4cd4-80a2-fd2277db6aaf", "comment": "Malware payload (GuLoader)", "value": "c39f455176f02262c97907dbcd4440993c5b1e9ea5dafc3679918ad8bebc476b2fd1d1f269233af777d706e886ad1533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825766, "uuid": "0ad563bb-4c5e-4f98-9655-d25435c4b8e7", "value": "T103D412423B79D097D9880532A8A6967A7770FC244BD15F83A316BF2EDD31243EA1E35C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825766, "uuid": "98750ad7-4103-4905-96ab-7153c343cd9b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825766, "uuid": "7e6cf653-6d73-42e7-9845-8fccbf8e87d2", "value": "12288:EbjnMwJlR1VsP1vVqVi5iwq2JM9IKTQWfsmuYUZ:EbouX1VsHqmiwpJM9IKTQWkmuZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825766, "uuid": "76b1ccad-793b-4408-aa7c-da94c913839e", "value": 649880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825766, "uuid": "0969c12c-e9b4-4542-9cbf-402ca8cc49bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825766, "uuid": "4ab8894f-a5c7-49e3-a2ef-8d75825ce58a", "value": "SecuriteInfo.com.W32.AIDetect.malware2.1462.31999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e06c5d-f17f-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655829001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829001, "uuid": "db971b23-6e1c-4489-9d9f-49f2b9933746", "comment": "Malware payload (njrat)", "value": "74057092a027c56e5b93246729eb3e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829001, "uuid": "9d86fce4-9013-40fd-b653-465f5c00cbea", "comment": "Malware payload (njrat)", "value": "0e29156381dd95e3a986aa7aec1ce6738a9e4cf588427a481968a6ab681d2714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829001, "uuid": "9131bbbc-fe01-47a2-8959-fa94fc49e4bb", "comment": "Malware payload (njrat)", "value": "2f9746b07e69988daaa6e4763ebc552b14282722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829001, "uuid": "e5725450-932c-42df-9e31-f4ba749d1383", "comment": "Malware payload (njrat)", "value": "544f9ad491b8e3ea21f7fa29095b22b1ea098dbbcf437536d52855840fc42503c4540108282ef0ff586d7dabe91d7d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829001, "uuid": "40e2cc56-16cf-40da-a976-8b87be903def", "value": "T147F22A8D7BE08168C9FD167B05B2D4130777E04B5E23DD0D8EF6A4A937636D18B50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829001, "uuid": "75563bb8-3aa9-4c7a-9841-e8f076c4f7ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829001, "uuid": "5e22284c-f288-45ee-865f-aa2955ab5762", "value": "384:rnmqQilQhHeTnMGiyMTFU3nuj346LrAF+rMRTyN/0L+EcoinblneHQM3epzX4CvG:rmLSMGxMTFUej4MrM+rMRa8NuWCvCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655829001, "uuid": "d42d5b36-a51c-4905-847b-382fc64ef3b4", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655829001, "uuid": "35ed78f3-2c20-46ff-9cc7-4256c48ae350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829001, "uuid": "20b7afd3-e4da-4f9f-adf0-19d7e8003fb7", "value": "Server.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb05c90-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808051, "uuid": "f69ee34c-c99c-4a43-85e3-61ef2014dc2f", "comment": "Malware payload (RedLineStealer)", "value": "69dbb2d5bb9ea0330395c90cf35928cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808051, "uuid": "2486fb2e-457e-449f-947d-f2906ef8a929", "comment": "Malware payload (RedLineStealer)", "value": "0e32b0d5aa153def077b06fb04f429deed4a926f2c53446784880fa6fbdec2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808051, "uuid": "beb91de0-bf58-4160-a878-fbc37b175cd0", "comment": "Malware payload (RedLineStealer)", "value": "41341f3e0608899525e4d42d57f23f8ec14e3574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808051, "uuid": "17bfd2cc-31e6-41d3-bb22-5f7d2cb079e3", "comment": "Malware payload (RedLineStealer)", "value": "278c071538af2cec03711537d953b4a85f1f79d56859089dfce66df9bf8377036b8c11b2fe415dc5d8bc415ee79a0a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808051, "uuid": "a36bb50c-ca4e-47ba-8060-98850a2c6f4c", "value": "T17E851210F6B58C39F0F746F52797C39EE45CFC52BFAD48C7A4E166EA88552B0A832112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808051, "uuid": "276ae4af-855e-4226-a91b-766cdfc085dc", "value": "cee4a1e7f9c78cb12f70d046e0f8578d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808051, "uuid": "ca5e991e-2e4f-406a-a00a-219f5f4b2162", "value": "24576:1foxWp/AWnpkNh9Hn+It0RtyCe49EciWULjtAGzE/cFGXUKgv7rqz/6u3I3RJjns:LdPkN3H+ECwP9ccntxh+UK9/6uGjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808051, "uuid": "9b19cbe1-179d-48e5-9e45-e62837f26926", "value": 1747112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808051, "uuid": "39f42746-517f-49aa-a97c-9a2e365a323b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808051, "uuid": "c2461283-4d89-4b71-b225-dd238592b2b5", "value": "A168QvNYkQJd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74b5fb9-f11a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655785866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785866, "uuid": "e8f4416b-aefb-4fc3-bfbc-708df71935a3", "comment": "Malware payload", "value": "64529e23db8b76cf0360af742d93a802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785866, "uuid": "71b7bfa9-2ba7-4433-a758-a90bb6735a4c", "comment": "Malware payload", "value": "0e50028ed379fbfdcfbe3a84cc44ad29034aba473241c0d8dd58ac49fd74c868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785866, "uuid": "85d9eb43-a9b1-495c-a728-b10af8f09502", "comment": "Malware payload", "value": "ff0737faf4b66f8ca92628e2245f439f470c3ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785866, "uuid": "7a017e73-650c-4b6f-bcc8-45a200edd72e", "comment": "Malware payload", "value": "3903c187f9cc82294de6a0bc5ed5761a56c9c89e0705d81bc4cdf2f33af8ee328ce336c187d1a2d56dd09826e5855e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785866, "uuid": "464f99e0-fef5-4865-8421-72662cfc8982", "value": "T186A5E052BBD1C0B2E26302309926AB755BBABD701B3081CBA7D47F1C9D31AE1D939357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785866, "uuid": "17b12dfe-5548-4c0b-95e3-ccb7ca3923d2", "value": "71d0cbb73719951ac49587b13f3b88c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785866, "uuid": "0cba2cad-d735-4d68-910f-7e3f13033985", "value": "49152:QGQ/Q9vd2OHM6wKW9DffrcinaCuAjTVf99Zg6Y0fxfNrBn:RS9Df4inaCh97gb0fxfNrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655785866, "uuid": "c3831c55-dacf-4719-b0a5-2b605fad887b", "value": 2251072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655785866, "uuid": "3e369f92-2802-4655-996b-08d9886023eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785866, "uuid": "18269be6-7954-4529-b7f0-66ab7b499388", "value": "SecuriteInfo.com.BScope.Trojan.Inject.11333.26731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca68f00-f198-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655839991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839991, "uuid": "9f3eab9d-6dd1-4d0a-a3fa-871a4d04b9b9", "comment": "Malware payload (Mirai)", "value": "f8c6a87bc5e6094df1cb9853db5fff69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839991, "uuid": "d3931b0e-f679-4c15-97d3-f5d729a6f100", "comment": "Malware payload (Mirai)", "value": "0fd7f082b3918490c6df7ca592f7e6563e89d8fb64a8951afc73edc12d9efcd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839991, "uuid": "b0fc43b4-819a-4786-a752-ce9a068cc8d0", "comment": "Malware payload (Mirai)", "value": "14731fcdbc227dc8fbfa4238a65cf365b37c35b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839991, "uuid": "3acbfb10-16ae-4ff8-a8b6-4fec27b57884", "comment": "Malware payload (Mirai)", "value": "5254fb2c6af076e50ad3e6144c0e156de17db04d37e57cf00117fe49e77e42777db6d98640b1f311a9721fd62ed0f1e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839991, "uuid": "fab0bf19-5270-40f4-9e37-d98ddf59f21c", "value": "T11C24E6436BA17EB7C8CBDE3306F6C60110CEE4572394672B72B4DA5CBA1E94E15D3898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839991, "uuid": "3d16c080-2a47-4b7a-8754-0ca6d61ecebe", "value": "6144:VeKXXI7hrm1TjECFaTWCt7MB2zvAmLG8XYIS0Hrn05HU:2hry3yt7nzvAmLG8XYIS0Hrn05HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839991, "uuid": "07b3afd3-8cea-422a-b0de-0b6bcbe2be4f", "value": 224126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839991, "uuid": "0fddc35b-12e4-4727-a83b-ca51c5e5bc5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839991, "uuid": "2a55039b-32db-47f7-bc33-d2f26c8850b1", "value": "f8c6a87bc5e6094df1cb9853db5fff69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092bd49d-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808230, "uuid": "468234c9-3c7c-4ad8-8992-0f154f68d6f9", "comment": "Malware payload (BlackCat)", "value": "93f34fb60a180a3a80ca758b97c2e551", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808230, "uuid": "e5506135-d7bb-4a08-b702-225fafb085a4", "comment": "Malware payload (BlackCat)", "value": "1048a41107f4d9a68c1f5fc0b99ac75dc198047f18bb6e50f3d462f262b8f6cd", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808230, "uuid": "045dc9d3-1226-40a6-9fe9-c457f4b53914", "comment": "Malware payload (BlackCat)", "value": "7ca911dbcc159b30e7d71db30a889780e57b6c02", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808230, "uuid": "4bd8cb1f-8bf7-4b4b-ad54-0deb396c9423", "comment": "Malware payload (BlackCat)", "value": "bac27a05ef33c4dc71e875407cbe2899f18aa809dad057a8e88570c0f0f6bb12435e3e8449c4c8e7b6e0da0340a9c039", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808230, "uuid": "d1ea834a-a2e3-4285-b4e6-b1b2519cc9cf", "value": "T1BCE59E46FA4356ADCB971570305EB33AE63A491C602D9FA3E7E89D30FF2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808230, "uuid": "df497e31-37db-44f1-a170-b0bc325333f9", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808230, "uuid": "70b39bae-f66a-4e31-8fb4-a2e9d83c26aa", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NE/RgaJ2w1Ms:rAnCs8pVblGyNM+l4UxUc1BhFyvww1Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808230, "uuid": "4f68367b-66e0-4bba-b3da-551845be8975", "value": 3068931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808230, "uuid": "98487521-17d4-4a82-b55c-6aba6cdac26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808230, "uuid": "8e33fed3-8b55-4efd-9c1b-d3a54cb9b39a", "value": "1048a41107f4d9a68c1f5fc0b99ac75dc198047f18bb6e50f3d462f262b8f6cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194e503d-f16a-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655819853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819853, "uuid": "c0e76513-b727-41ad-a99a-0027c9679270", "comment": "Malware payload (njrat)", "value": "f09a20fdffb51a09759ef49bad16573e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819853, "uuid": "bb4c7656-05d7-41e8-a532-9641c97f48b5", "comment": "Malware payload (njrat)", "value": "107435bf08485e16d781f4bb0e012cc23a3b1573ea508212d9c0ae21d5e2537e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819853, "uuid": "e6301406-6ee2-4212-88f4-a7a16fd57d2c", "comment": "Malware payload (njrat)", "value": "a435202e700dadf18f2055697f01e4c13287f724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819853, "uuid": "5de1d76c-29e7-469e-92d0-1c584a425527", "comment": "Malware payload (njrat)", "value": "8105c9029e0deb2e6a0958d11de3e66ecb1893303c7f51047e690f0ae0a02bad35b7324de8d078e1769cd058443de3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819853, "uuid": "029f9392-b798-4bdf-9eec-917014c8f4aa", "value": "T10A033A4D7FE18168D5FD067B05B2D41307BAE04B6E23D90E8EE164AA37636C58B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819853, "uuid": "6c450e25-cee9-40fc-9582-7923995e444b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819853, "uuid": "69f0bc32-f19a-4b54-894a-6f15743c9a40", "value": "384:jDmK3hUidksXR21cGMy8PIU5fHkFlacp1rAF+rMRTyN/0L+EcoinblneHQM3epzt:vmK3bLGv8PIU58KcvrM+rMRa8NuHNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655819853, "uuid": "745fd9b0-1e08-488e-a0c7-f8f0ee811763", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655819853, "uuid": "30c68ec2-81e3-45ae-a38b-f8bff4faa886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819853, "uuid": "c9c3eb47-311d-4008-b9b0-b1ea211f91d6", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cbeca6-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655840572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840572, "uuid": "578824e3-6173-4f25-b9e4-fbda7dfd679f", "comment": "Malware payload", "value": "f393c2741da9ca4b01398011e57122ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840572, "uuid": "40b0ad0a-1e7f-42dd-9707-633e776ad97a", "comment": "Malware payload", "value": "108abfe3c89a2dba7dfd79f01c83cad6e1acba473ec1a4981d696ad103f51330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840572, "uuid": "15f15870-e38b-41a4-b6eb-56d11778a79a", "comment": "Malware payload", "value": "fb9fe43ef8afbec7487a7477e4cfcc07ee78ae26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840572, "uuid": "3f813ee9-2b3b-41a8-b981-584f17fbd9e7", "comment": "Malware payload", "value": "6d2dfee85048bf6961892c71faefe219248a630439a113cbd2b14939303caee042d4231f386db1f8e874baa05b0926eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840572, "uuid": "9aaf7798-b848-4ae6-b5f8-5263fe279fca", "value": "T1D815DF4B67849FD0C4B9377E92A7E21013F2FDCA6250D70B6EE8A5D995336C6AE1C301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840572, "uuid": "32929b12-e01a-4c26-b9d5-8091d908320e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840572, "uuid": "2d6f644d-731a-4d81-9a75-07338225c505", "value": "24576:h7dUPSDVJGyhPZvAq2HmJGf88LbZKpRl:h7dUPiBPiq2HmJGp1Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840572, "uuid": "fdc423bd-ac91-4115-bb0d-299b7c4099c9", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840572, "uuid": "75ce2df1-3088-4b10-aef4-728148e7ad11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840572, "uuid": "d946454f-19a5-49e9-ab48-93a41d480d6a", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.20873.1141.16492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e792857a-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655808603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808603, "uuid": "7bd26035-19e0-4f44-8677-4233cdf2aa4a", "comment": "Malware payload", "value": "4ca1a6bf6600beaddc58811a87dbe254", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808603, "uuid": "bd4e315d-7280-4972-9533-ab0aeae5853a", "comment": "Malware payload", "value": "119c9d63fca76e8a1251df59e7fd6e95b0b0f013425c01c78ffaa031f723fe77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808603, "uuid": "369661ca-63f6-45cf-9a46-949283f14b29", "comment": "Malware payload", "value": "2088ac5bf12754cb18a77bb3784717238452f2ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808603, "uuid": "56683635-f3a1-48b3-b817-3990db7372d1", "comment": "Malware payload", "value": "7f179d51a04286727e1297f4d355ef7d2eaf655f1488fd920759b7521b2d11a40e9dabfaa0d5921e51a5fa7f815415eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808603, "uuid": "47222952-905f-4f94-8118-257329725784", "value": "T1F0A5333268DB1F2BCB6C6576806EE07D24327D0C5B85793B27A1BE5531BBA3162D212C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808603, "uuid": "52e10135-a88a-4130-89ca-74649d172b54", "value": "24576:HZz6c7sHlsRXvvv4SZaZB6NUXec+b6BT+GCYz2qCpIt2enpD0tmmUd389eyH8hkL:kc4qvvv4SZa0UOb6BSGCM/pnpDM2tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808603, "uuid": "2baf80f3-e1ac-425e-a8f6-b5a5bebd83ec", "value": 2115072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808603, "uuid": "f7d2b490-b29b-4897-9b36-7f768d35aad9", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808603, "uuid": "4e7bc163-eb27-4a8e-b612-dcd185c8c9dc", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.17266.19712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfd85af-f12a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655792397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792397, "uuid": "f12fa9f4-437a-497e-9387-f7ef9af79ba1", "comment": "Malware payload (Formbook)", "value": "1fff88b07a5cded5c4cf7bbdc6e99e51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792397, "uuid": "4cac1dd2-0c6d-4aab-8cb5-3219e1e4bd51", "comment": "Malware payload (Formbook)", "value": "12dad12ea40f9ea651fb7f6fd53bd397f824111f1f57cd88f567fce0c71a2c6b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792397, "uuid": "26fa2a00-59f6-4f4f-a498-4e4c806262b2", "comment": "Malware payload (Formbook)", "value": "8d32fe3e3eaf255de22fc6cb264e3171d96d7e6a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792397, "uuid": "ee02ceed-b9f9-4c3c-8499-9c2d91e5866f", "comment": "Malware payload (Formbook)", "value": "cdd15a1538f1f4fc75482129dea325e1edecbd387e24ea36de3ce98ce9c5427d5d295f29b227b6ff9c0bd59dad37674b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792397, "uuid": "c4688260-073f-4e73-b30d-8febfd28a7da", "value": "T122B4230432E3D9384AFA06432FA99BC263F5C46850A6AFB51AF5914C22343F9DD775B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792397, "uuid": "81dba355-5863-462b-ac1b-db43b8f8a8c6", "value": "12288:kx8H2EO4939Ny55zttNBUZcW9CRdxjUEUAy5:kGJO49NNNV9CDaoy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655792397, "uuid": "e4e39fe3-7be2-4bd3-910a-9e5ddca97abf", "value": 498757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655792397, "uuid": "7e22b5df-d879-4eed-92f1-d84d23830bf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792397, "uuid": "56cbda9b-5686-4359-b399-58c83722d3a1", "value": "PAYMENT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d365d7-f1b5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852219, "uuid": "a7a64230-7ca9-4bc1-8298-6d48e9e7ee10", "comment": "Malware payload", "value": "49919281a4a41a77a43d231a75a01888", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852219, "uuid": "76cc7d83-122d-4269-ba31-c491cd5333bb", "comment": "Malware payload", "value": "13fb4c73eca2cd9ccd1e7a6b5ee44faf9c15af9768d66e1c6ac196263719a335", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852219, "uuid": "1e76a974-fa39-4787-a5f4-83ca55a20771", "comment": "Malware payload", "value": "315423661411e784d49fdd01fe5234ba89821a69", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852219, "uuid": "b75fc37c-e5f7-4e7f-8a38-735a757fc0c7", "comment": "Malware payload", "value": "4d14077d7a1fd18428fcafaea1b48e7d0e9654d64da9d214e6300bca17679783c8d3f2a0408ec2bde4d7cfda54a2c871", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852219, "uuid": "2f77f464-a87c-420d-ac60-18ae2d05dd19", "value": "T1DC05334E1F14A1A9373F1A3F1B95A77CCB97E0BD15486E2B5497E60CAFDA82B03141E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852219, "uuid": "0d504c62-a142-468e-ad47-3cdc48bdafc7", "value": "24576:fmvMw8TJZaqBkpQmg+Ez42nW5H+4Rp+w60:fmcJZaq++oEc2nEH5r60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852219, "uuid": "9425e7fa-6c67-4150-871b-59f60d840e2b", "value": 842410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852219, "uuid": "45e6f2b8-9cb7-4174-a947-3eb0c9b14486", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852219, "uuid": "720c930c-3dc0-4a58-9a48-b95bf22e8ffc", "value": "dispacho lista de empaque viernes 23-06-.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8a3736-f165-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655817734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817734, "uuid": "01eefb85-4e28-465e-82d3-eb7b983692d2", "comment": "Malware payload (AgentTesla)", "value": "f74a9fa3bdfb6a1892233ca4c50ff650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817734, "uuid": "16d7e8a9-ab8e-4fbe-a7e1-7288ac754ad5", "comment": "Malware payload (AgentTesla)", "value": "142a8c3277adc1807ea704d8119821e8fa352afb101850b610a093e3693fdcc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817734, "uuid": "60e9a3d1-bcf3-484f-9ef9-81e1031f2aeb", "comment": "Malware payload (AgentTesla)", "value": "a33a38c2f0d13e5686764c48745d8e3717c7a746", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817734, "uuid": "e5fbac43-1995-4c05-9adc-3c445fd1a291", "comment": "Malware payload (AgentTesla)", "value": "ac32cc3c9303ec9a3c1fb25c002bf9443976382d1cb8b829fc7a01b156cea4479c59fe8f0d6d3bd87f14a957fbd168a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817734, "uuid": "e589edbc-e4b8-46b4-8bcd-964a8f53da0e", "value": "T11B153AAC315C75DED86BC57ACAA81C68EAA0747FD31B4147A027059D9E4CAC7EF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817734, "uuid": "364dd7a2-7f55-4664-96e8-79cd293c6c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817734, "uuid": "107e376b-f28a-433c-958c-bbc434cd5e4a", "value": "12288:0y2iNPf+B85FrUqrxPlC6OfPjNAjoxb+EkRgg4ljrq3dd9k3vhPV+KMj7oYO9o4E:H1B+B85Fp6B5AjoxbPDqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817734, "uuid": "c3d0f055-38d3-47d9-ae00-b0adbb1ace24", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817734, "uuid": "78e823d8-08fc-4a86-980c-a8b72b2294ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817734, "uuid": "0e295a14-e673-4fd7-a5f0-43370afe883a", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbbba2e-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655831568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831568, "uuid": "6f6fa2fd-302c-49d9-aed2-70ab7abbd758", "comment": "Malware payload (Quakbot)", "value": "c84b57f722d4402f1bedbd28d22b20f1", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831568, "uuid": "61c82e99-926d-46ba-9551-c6476c7123e5", "comment": "Malware payload (Quakbot)", "value": "142d465bdbf028d9035d0bf496ff73147824535f88d1e66f7fe32c55a36301b8", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831568, "uuid": "6a5c3688-3b0f-4197-bbe1-57d1aa3275b2", "comment": "Malware payload (Quakbot)", "value": "863903621d8d1b6a174ea2a35001683b83fb7e8c", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831568, "uuid": "4ef9e54c-06f5-4379-933d-8291fa788d4c", "comment": "Malware payload (Quakbot)", "value": "0e13ddf826c01f1861f8b27b8ce718de9720a4581aa77deb27c14962e23ca19211965146e6aad33e9df6d9701e52314e", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831568, "uuid": "03a1d7aa-6a67-47a0-bb7f-8968b58fcb64", "value": "T16EF49E72B3E04837C1771A7C8D1BB66898297D113E3C988A7BF41D4C5F3A781366A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831568, "uuid": "dca79544-3d57-4129-af08-718eff22f001", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831568, "uuid": "2edbaa2b-2bc9-4f76-989b-a2d6ed99d8cf", "value": "12288:0SHEVZKP1O+hamzhv1fm3R7yhZF0WGNYW:xSi7NvE9EeYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831568, "uuid": "4c940eee-1c2c-4972-b523-344bb3ba9e80", "value": 734651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831568, "uuid": "9270c299-e765-4b99-929f-349891b3903d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831568, "uuid": "8e2276f2-463d-4638-bee4-918091f8f0c5", "value": "q.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc91929-f195-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655838352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838352, "uuid": "1a3d9e80-5bb0-4cfb-b867-dcae6afe50d4", "comment": "Malware payload", "value": "8415dbf0bb48732513140ab0502b0fd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838352, "uuid": "ce339da3-4db2-46ec-b7da-cf4ed4927824", "comment": "Malware payload", "value": "14da7c334b73a6bc5cb1862520b51255b5cbfe207ff2ec8d1993edf9c84d1c58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838352, "uuid": "c30801ea-fde5-434c-a70d-92c2f51af671", "comment": "Malware payload", "value": "d41419d8fdb4bc302d5a89ee8ff65b849e2f23c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838352, "uuid": "1e19648d-dfb2-4faa-b6cb-6c4523679007", "comment": "Malware payload", "value": "61d35788e43259c69ca49110f38d36f7311015eb7be712222a2a3580a9eb3cf1198698bff1ea0fcd39b93b810260f9ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838352, "uuid": "53b67408-0936-43db-968e-03fa92f4d7cc", "value": "T169A41242A79D8B23C7BE2BF811D6424003B5B519A165F74FCDD3A0C65E6AF4486C2F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838352, "uuid": "7cb98ac5-f2a0-44b9-97c1-50b85801dd4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838352, "uuid": "04402a4e-7abc-4403-9e44-27723c88bf0c", "value": "12288:prl8tTSkBtRUTmqAy2jcJspiAw3TvMn6Q2yN:prl8tTNqmj2sEfvMqyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838352, "uuid": "c0d6838e-53a4-454d-b8ca-b88eb4edde82", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838352, "uuid": "a65d45c6-abde-43f1-a86b-5def6ad56b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838352, "uuid": "6a2e91c3-8517-4332-8565-c30f01442a9f", "value": "8415dbf0bb48732513140ab0502b0fd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeada84-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655801743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801743, "uuid": "dcb2dd18-a8d4-46bc-bd0b-1fa400463113", "comment": "Malware payload (Formbook)", "value": "dd46ed89d3a3980b0bc2777d4add5ccc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801743, "uuid": "4651a0c0-67df-45bd-8445-db2792021e27", "comment": "Malware payload (Formbook)", "value": "15aef9c8fb1a266c387dcfa0c8f432b869f6ec38bf0cbc32a0c4165342a2f122", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801743, "uuid": "4c1d615e-6b51-4336-8f96-526ad38901e5", "comment": "Malware payload (Formbook)", "value": "1a2f9c8cccc09cded5d37dfa2b0d036c2c9c1aa6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801743, "uuid": "8ed67eca-064a-4b4c-9aba-3b948addcb02", "comment": "Malware payload (Formbook)", "value": "51a55b8ba7be7a76db8167020c83b160c481a70af74d2c4c6bde2e4498f3a0b13ca1bdb0e75ce32fe97e5bad87fec785", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801743, "uuid": "003bd5fe-9031-4653-bbfe-606de6c887ba", "value": "T15D83E0211AA2DB40F0F3FBBE35654110E6A96F1825A150393CCEF73539FCA32545BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801743, "uuid": "a973a1b2-e203-4050-8096-4968c3d099ca", "value": "1536:l+HX7b6xB4nbVOO44zAyUFIFTb6h4aDqObEQqS33mCwyewM:l4X7bhMOtcXWyh40qOr2CwylM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801743, "uuid": "27f4fcff-dfd3-4ee6-860c-c6195a708b8d", "value": 81416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801743, "uuid": "84f65f84-a9f5-4203-84cd-f4a4474d8ee4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801743, "uuid": "e552146b-87b3-43ab-a33d-abe97f4f2ee0", "value": "CRT CO._LTD __ 22E000300.xlsx.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b482950-f1ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655848203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848203, "uuid": "278c0f82-e8f1-45cc-bde0-1f9d16fcaedf", "comment": "Malware payload (Mirai)", "value": "687b0effcd5e9b6eac4cf1ebd74c0e04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848203, "uuid": "b4647aab-56ee-4efc-af41-e71ce89924c5", "comment": "Malware payload (Mirai)", "value": "161fe60f67d24a289c01f1a368aa3b177889e8330f87881c297a68a03affc54b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848203, "uuid": "5b25c3e4-7a66-44b8-b4ec-e1c428253091", "comment": "Malware payload (Mirai)", "value": "79958431d3ff6a60379d1bdda0e96570abaea9c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848203, "uuid": "c6f40b94-48b2-42ab-a544-c2205018fec7", "comment": "Malware payload (Mirai)", "value": "d12dc741c0522d9e377e580185e69809cf20a6d680fdba7524c4d8adf62391ff577a85f0cf63c29d8c004a141ac22aeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848203, "uuid": "662ef1c9-12cd-421d-8df3-1d5db71d38bc", "value": "T119C2E112DBEECD4BF51FC0FADB7C885221115892CE8997D2A9E7C16C63914B02DB8790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848203, "uuid": "226db52d-eb2a-456b-ac46-bbfadd63dff7", "value": "768:A+xJN5GcRCnLcQXBQUpR+PdBliCF9AEgaTqvyqu6WXKd0:AU/CnQNGydiCFSaOaqu6WXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655848203, "uuid": "cd3beba0-d403-4668-8a58-130f3fce7bec", "value": 27756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655848203, "uuid": "c2c8eca1-52dd-4e4a-be5c-27ee55184757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848203, "uuid": "de62e918-7fcf-4744-8430-102fbb9019b3", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5a133d-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655782329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782329, "uuid": "5d36b612-1b1d-44aa-bc82-b13bae52b88b", "comment": "Malware payload", "value": "896a9091bcbe32144c6bbfa2bba4ec99", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782329, "uuid": "0e00ff95-239b-482b-a455-478e5490a8ac", "comment": "Malware payload", "value": "16262c4613bd83f037253dca7f7b34d85c9887b213ffb4d9362209d36e8d5cfd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782329, "uuid": "c9ac4f88-4575-49fd-b4d3-9d14bea20fee", "comment": "Malware payload", "value": "26e1b54243ec897ee5e5993be4ac182ae95e6fc0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782329, "uuid": "badcf7c2-4c41-47d1-a311-2d9abb1f2f13", "comment": "Malware payload", "value": "195103376ca260d0224c6b6a2ef894054065b735e6ec091cc0dbc753f69bab7c8b3cd0dd6362828b666107d0b51e0970", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782329, "uuid": "de81bdda-f267-4710-9558-f4e20af1a51b", "value": "T18E82941032F1C673D1569A320EE2E9DE7731FD01EE21871B3188736E2E7AA509D9375A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782329, "uuid": "b14a9286-05e6-4ed1-957d-0db6d5d6b164", "value": "192:9h4Z1XEul+Z/imKQBCwnTBqHoCZf0gUtbFlE2uZI88gW:n4zXhl+lDKQAwTBqICagAnEp688g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782329, "uuid": "35a6a008-45fe-4158-a513-4cd8e27e0d87", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782329, "uuid": "04d2cf84-844d-4b6c-ab2e-e2f644f3cda4", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782329, "uuid": "132fe1ad-2fc9-486e-a730-171925cb84e7", "value": "SecuriteInfo.com.VBA.Logan.3190.15728.13201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1eea4a7-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655793507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793507, "uuid": "5bdc8786-bd43-4c1e-82b6-bb632194865a", "comment": "Malware payload (Formbook)", "value": "ae23b3027b10f2c48e3272bfe680dfc6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793507, "uuid": "c833d7ac-6f7b-493a-82db-4e8595ade84a", "comment": "Malware payload (Formbook)", "value": "16a6035998ab93446a8f04d59c6e59ef5cfc6514fa41a6fd2367ff3d1f4540bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793507, "uuid": "b09254d9-8d08-4987-ae68-a6481a2f33c2", "comment": "Malware payload (Formbook)", "value": "8da7b19b607dc84977ab6c2c6e3cc945c13e55da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793507, "uuid": "024fbccd-ba38-4b7d-bd03-ddd966561a62", "comment": "Malware payload (Formbook)", "value": "eaf94698a9d035c1d2cb3596ce244c263791d2a9b318100dd7b4a4183c62595d8455fefef166efdeb68219a76a9f9505", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793507, "uuid": "66879907-c51f-4e29-b9ad-e53597e8b460", "value": "T15452C1D5788D056861EFF02496A3827FA4A80371069DD33417D1BAFFFEA4CA185F3444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793507, "uuid": "0d0dac9b-05d3-4919-ab12-5c861d9803fb", "value": "384:Fw+lHMh6icYR3h2VU9zlVIhUnSO3x6s7G0LAtO2+ZNkv:GO0f3UinSEc0Ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793507, "uuid": "2c26bd14-0661-4b37-b21d-be76f17803e7", "value": 13537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793507, "uuid": "a3d6bd03-85d0-4b50-b0e0-f4dd6fbca69b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793507, "uuid": "ab4ef1d8-b5f9-4a00-af38-b5c9a6c68e3a", "value": "bank-info.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb5ac69-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801823, "uuid": "80e92d9f-6daf-44b4-8d0b-8bfc068f39fe", "comment": "Malware payload (SnakeKeylogger)", "value": "72731a8f70c65bd4d77d611d0e753c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801823, "uuid": "514a0b3d-63a9-48d1-b3e7-e57dff7b6065", "comment": "Malware payload (SnakeKeylogger)", "value": "16e6086897059d30ddde828b6c5e435c045a281b3f3065e348b080377f55c33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801823, "uuid": "79dc5ac6-9f29-4142-ad2c-700c64f1c005", "comment": "Malware payload (SnakeKeylogger)", "value": "4beecb2fcb9ee3c38d3f5f4581cb8048ded6f156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801823, "uuid": "e3bae546-bff2-416b-8f5f-2474138eaea3", "comment": "Malware payload (SnakeKeylogger)", "value": "31dd1c3c6265768275ed5bbe24f27789c7003d5a14c55bb53e5912c0fe3f2a0e0732c19c1763531c2a30138e08b19653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801823, "uuid": "d83bf76c-1410-427f-afbd-add04e377768", "value": "T11304B835F400E70FD97887FA1DB4E79819DB6C2A081886D923493B9DE2F26336D1D53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801823, "uuid": "1efea01c-cd41-43a8-bd41-f192358746ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801823, "uuid": "374276dc-bb99-435d-bad5-367bf8d6520e", "value": "384:tx6nEsPe8kykhuFxy6cPal0T/QSMzMrV/zBZ8tz066666aqJyyyqLFvzYsKyyfy2:mnEs7l07gENZaw66666aqv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801823, "uuid": "81a76d9f-ce40-4d7f-bf3f-fbe12f9d7fa3", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801823, "uuid": "3be52ddd-d3f1-4a88-bd68-5b550fe28710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801823, "uuid": "ebccf1fa-400d-4f0d-9db6-49e407d21773", "value": "99 (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a960ac-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655813638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813638, "uuid": "369d8dfd-4415-40a5-b172-2f88e7c11753", "comment": "Malware payload (Formbook)", "value": "54471ddd206fafeba1c73948f48ef258", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813638, "uuid": "c7dd2384-25d3-415f-8822-680cc108c7f0", "comment": "Malware payload (Formbook)", "value": "16ea528e9912bfca30351fb41ecd54eceab33f52d011c9b68f34d122c71980ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813638, "uuid": "5a551d35-f95f-4c9a-8d8e-6e154acc8cdd", "comment": "Malware payload (Formbook)", "value": "2f59811f4afcef21b532358025d5a355387530d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813638, "uuid": "6d92dd90-2b72-4029-9295-0dc40572bceb", "comment": "Malware payload (Formbook)", "value": "d194d83b66e28433ce72f833c63ffc528eccdbd0be6d5c0a93bc91152e706a5b56c4730c70ca4465bd48e07f30ae7a42", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813638, "uuid": "ec395618-28ed-485f-bde6-25eeba773f9a", "value": "T17B83E1A92834826CE102AF3C1B1FAEEC09544D2D8DCCB464F241B2DA9974FD9BD1E577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813638, "uuid": "7b4379d0-80f7-49cc-80a3-02072fabb08e", "value": "1536:jgXH6PSSV//FbIT79QaidxggH7qkY2j3WyQ4EMGsRg/gCPReG5rAg:jUH6PScuT72aioHHyQ4Tm/B5tBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813638, "uuid": "9bbe4249-3f05-4ddb-82e2-e13cb19e859c", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813638, "uuid": "d4f63755-1b2e-4aaf-802d-1d6f5d92022f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813638, "uuid": "fff9c8a8-defd-41af-be09-3d1ddff7633a", "value": "FACTURA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21180b4-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789588, "uuid": "00b9db56-b2d9-4332-a920-b12efb11671c", "comment": "Malware payload (AgentTesla)", "value": "0e5f85e84cb48d1044bb53e8fd0f7cdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789588, "uuid": "d8d2dc57-0479-48d1-be83-aa0ec53542c4", "comment": "Malware payload (AgentTesla)", "value": "1700e238a0d876ba03c3dd71776ebe5b32801f8844213dab3ad6d728973ccf26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789588, "uuid": "b90c15ac-c029-4fe3-aa4f-819dd0a09f77", "comment": "Malware payload (AgentTesla)", "value": "e5624caae50c56069498fcffeeee348ada496d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789588, "uuid": "64e2ea00-6472-4e7c-8a2d-3e401bcd5102", "comment": "Malware payload (AgentTesla)", "value": "c35c0b17de6810f7ca0f6d6d3d3df1d055e9d26655b03288f13a7f0b779edec3d953752b0f11927fd1c5fdf9309d8566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789588, "uuid": "0155638f-514c-4eb2-817f-42656a0b2449", "value": "T19CF402F18FF8BD61E92960737094A03C37E69E1DDC52E47AD78BF44934A6AC151E0A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789588, "uuid": "62ffaa0a-0445-4560-bd87-33c4e2247d2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789588, "uuid": "a71a36b9-5a85-4d31-8008-a595d52425d6", "value": "12288:/MvHi0UABtdDyArvEaHX1/hcBTPPXBtVVpbdPtyRJHrPYL5H1CUGY5:UvfUyttzrvEaF5cRPPzvpbdPITQL5H1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789588, "uuid": "55a2b1a7-0308-4da4-8690-1c4fdfe157db", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789588, "uuid": "040b4127-40a8-4850-8c3b-d01fe7588fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789588, "uuid": "8599cbb2-6ef9-4faa-b7b0-fe0d8b135d7a", "value": "SecuriteInfo.com.W32.AIDetectNet.01.331.17285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b985dc-f15e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655814933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814933, "uuid": "44c1a9c0-26b5-4639-b914-ea730bc9e1a1", "comment": "Malware payload (RedLineStealer)", "value": "5759fe3d656adad3274772d87b0065a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814933, "uuid": "bece7a5e-c470-4a4c-8a99-32fbcd47cb5f", "comment": "Malware payload (RedLineStealer)", "value": "176ba820e0ebbe1c892393a5ec6468418ccf792fb2a21a41c472c6dc950248b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814933, "uuid": "65c8e723-5df6-4756-ad9e-97cfe6969776", "comment": "Malware payload (RedLineStealer)", "value": "0a8db8d778202aadf6859498b6c33f7e898c8d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814933, "uuid": "c8b86a65-683e-4cc8-8019-0965b13e5760", "comment": "Malware payload (RedLineStealer)", "value": "407581f276c183bccea2e70dab5c27a86c2fbbc1b59e43950d057eee03b835be3dfaa1f26060a450f4212043e9bf1695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814933, "uuid": "717ab993-f37e-4e97-9d4f-f14e702d9683", "value": "T167C4812DBB425A72ED8E913649104B48EF2E0F237645F9C653DB23CADB6F8562D09CC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814933, "uuid": "e1462855-06ea-4eb7-afa1-def607421d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814933, "uuid": "abefdf40-01a8-4209-8e3e-68f2c52ee759", "value": "12288:g3kdRk/izKefJo1mJxRHHE6mRsc9gC8NLhPtD6IA1:gUn+izKefJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655814933, "uuid": "64b5aaf7-257f-44ca-91e9-d34c28245819", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655814933, "uuid": "2e5f31f8-340b-491c-89d5-b63a76782c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814933, "uuid": "32be49d2-a37a-4d52-af18-4c63e5c13efa", "value": "RFQ #062122-ABU DHABI METALS LLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc14d385-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655808986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808986, "uuid": "65248984-cc95-46b7-9228-e46b8b74269b", "comment": "Malware payload (Formbook)", "value": "1836fc11495367a5604e30b0847799f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808986, "uuid": "b0e38707-29ca-499d-847e-22c66e4d2993", "comment": "Malware payload (Formbook)", "value": "178290b5c5120a28e46d4990489739f35a287ac7e716cfae4ccec002d0c6177b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808986, "uuid": "3c25b578-451b-4f85-8e2e-2d0589d28bd4", "comment": "Malware payload (Formbook)", "value": "054ef0249fb9772be2e307291e220b7fb53a05bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808986, "uuid": "d2c101a6-ee26-40cf-b821-b332b7a9d9ef", "comment": "Malware payload (Formbook)", "value": "f4ad0858f5e7af26e5cea184767f93c8ee2924fa41852b2d4d17f6d1f5febf1b809e03341baabda8a35981597cec27ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808986, "uuid": "a6fcb313-5204-4a8d-811d-4cb2a905e7c8", "value": "T18B158D6E17846CC6DCA55F3A91F307D6612AAB70A45F8B0F025664FE0B2F8C83F60D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808986, "uuid": "e4f46413-1a57-401f-9df0-cafc8d5fe36e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808986, "uuid": "ba8eb7aa-f70f-4440-9066-d012382336f1", "value": "24576:AU9C+vW4eKuS8e3EwpWoNQJE33H56IkFueoGtC:AU1vWI8HJVJaZBsoGtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808986, "uuid": "013918bf-1ace-4bb5-9e5d-fd8dafd86b11", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808986, "uuid": "6010bf27-e290-4b6b-b5d4-bb6e021c0c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808986, "uuid": "5e769946-0c18-4ce5-a2d9-4a84c4036dd2", "value": "SIPARIS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97fd547-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655823585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823585, "uuid": "05edf87a-2fc7-423b-b07d-2f4e3f6c6e95", "comment": "Malware payload", "value": "a4f2f86dd00c89fad3c9dcfed70061ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823585, "uuid": "3f2ba661-ef69-4f96-ab6d-35cad7726d63", "comment": "Malware payload", "value": "17fe425332354bc78c5da746b7eec4a1129d186637fd3b1230088d820fd0e8c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823585, "uuid": "2ff8dabe-84be-4651-84b8-37dc8107a10b", "comment": "Malware payload", "value": "9405ed6ea0b784820dd1ebf5a9d26e111ec62378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823585, "uuid": "c1b16941-29bd-471d-b0be-2c4d44fee2ae", "comment": "Malware payload", "value": "a78c9936972c9f463071d461a9eff5ab75ca897bd6e7ebb20d29a30aa3cd156b14db763bcf4da57841b031544d596d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823585, "uuid": "64048c4f-7ac8-4aff-8df4-88208f5fe05f", "value": "T15B04F350A14453C0E7A73AF3BC1297C60726EC9368E1C58E6BC87EFD1A76B92CD12365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823585, "uuid": "a916835a-f7de-4468-ba16-2bb6d4784086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823585, "uuid": "3a07f194-db33-4caa-b08c-6d57b227aba7", "value": "3072:yTJnW9tEL8jRbAiPTwE4b2QCYp17xpWZ6LgjPRYR+dBeZqA:yA9/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823585, "uuid": "fdb28709-36d6-4cca-adfa-2f5655094860", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823585, "uuid": "1b11609d-e7b3-49f2-8669-fe6eb89c7081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823585, "uuid": "ea2923c1-44c3-48e6-9aa2-78eb8bbd522a", "value": "a4f2f86dd00c89fad3c9dcfed70061ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b758c670-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655833003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833003, "uuid": "989bbe88-2bf3-4ab9-ae76-f3dcdf6e1760", "comment": "Malware payload (Heodo)", "value": "46011ad3281d06749d10a9efd7a2510e", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833003, "uuid": "2dc0558c-d0cd-46bd-8dc2-84f5ead1aa1e", "comment": "Malware payload (Heodo)", "value": "1863261e238973a3ee5c5bd187903726ac3aac68ddd493e21c3b2918fbd2f0a8", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833003, "uuid": "255531e5-4ef8-4e59-ac64-38869033590f", "comment": "Malware payload (Heodo)", "value": "9dbc1da1c287095bc9aee3726753c0feca5ef6ad", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833003, "uuid": "9ca888d0-4f24-40a8-84d2-20443655bc38", "comment": "Malware payload (Heodo)", "value": "0fa1b2709654538325ba74ed9a90c51ef08e58d09d5f33dbeecbbb4b8fc73b86391f11bd22da8d942d0a75cdd190498c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833003, "uuid": "b360cd0b-ac34-49db-bdb7-986fad36ea27", "value": "T132648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833003, "uuid": "a66be509-d834-4180-9b35-ea3586add266", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833003, "uuid": "f68ca899-eec0-475c-a1d9-5384332ce9f9", "value": "6144:JqdSTDcHe3kjHfNsQnJXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3JIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833003, "uuid": "7b47b9e7-74f4-4900-ae79-8f34ef71794c", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833003, "uuid": "3a832033-0025-47c3-b46b-1af99afb37f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833003, "uuid": "3e8627ae-839f-48f7-80e5-1dfcf6219a91", "value": "fD7CVy6TFScmsyoWY2u6VrZaGtD.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6620a842-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655793353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793353, "uuid": "41c93921-9ec0-4da5-bd30-28a38c84d2e7", "comment": "Malware payload (Stop)", "value": "b32e822718b7395510bb079af1c8755f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793353, "uuid": "e4cfac2f-655f-4a28-b762-13c815e982ef", "comment": "Malware payload (Stop)", "value": "194cec1092eae187193c1c60104aa8efc9c2ef9c5229c595400b32d05b2281cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793353, "uuid": "53f6bbe9-ee7f-42de-9d02-5778c80274f4", "comment": "Malware payload (Stop)", "value": "5a6ce0159cb2b8599d395e5694d42c373dc54544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793353, "uuid": "d3d071a5-02ca-4598-bd59-d6a01f93d3eb", "comment": "Malware payload (Stop)", "value": "5ddea052459f8bc5b38753e98c135060b4c83df2c0afde476548b4378ca1209a0d45324f947880d825c01db9e2587875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793353, "uuid": "e56ef41d-7967-4a24-b5fa-a4795d2ea43d", "value": "T1EB0522117290C832DB220BF089B5C7614DB5283727F87ACBBB9427AE2E553F02B75756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793353, "uuid": "ce04afea-7900-4b34-bddd-28b0c696c0d9", "value": "5b554c388a3c865e206967d272cdc3f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793353, "uuid": "e45a5969-4e60-4688-ad16-e5d2de12694d", "value": "12288:j1oLO/PBMNkNLYE4/bh7NKN5QKJk+WeBbpkL4HqR45jgYpLqYR:jm6/PCNkNLYE4/iVWSbpOCqYVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793353, "uuid": "2d2ea99f-b711-4963-a8bd-11b397e99350", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793353, "uuid": "9b0c0f00-d16b-45ad-8068-a853a7f7340a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793353, "uuid": "efd6e44d-e9ee-44fd-ba08-0ed3ce513187", "value": "194cec1092eae187193c1c60104aa8efc9c2ef9c5229c595400b32d05b2281cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd972898-f170-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655822759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822759, "uuid": "4966a6f6-1c53-44cf-a6b0-9be80d7e466d", "comment": "Malware payload", "value": "9a9e31dcf05385a8d07124321cf2ae36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822759, "uuid": "a22d7406-f31f-4c21-bd37-294972cac276", "comment": "Malware payload", "value": "19533bf0ecccd56fefb33af9f4ba7d8b3a11046b9b0e88d3671a2a2653ae619c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822759, "uuid": "712b824a-6f3b-4109-a994-074a7a17ea2a", "comment": "Malware payload", "value": "805bd322e28fe6ebb3b6d5edece0122b9cc585f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822759, "uuid": "abb1280f-3efa-4097-a7e2-a89799e669a1", "comment": "Malware payload", "value": "5137bcac6061a92ff5f991aa4dee1662f082bf6f90e10e2e1c0d13ae0821bab3e2098254ae1c6c95cdf83bcdabe700cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822759, "uuid": "32e02065-aad8-4abf-b2cc-9e04a0c69498", "value": "T14F4623B749817DCBD22087B67C279405CC14F6B28F052629F16F6AE1D19A58CDFF8BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822759, "uuid": "975a1e3b-60a8-43ca-9c92-a4f54d4428d8", "value": "d3b3bbb83879e5e9a3733079f57d40fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822759, "uuid": "26808d90-92da-462d-9d87-466f8209509c", "value": "98304:SPDDw9Zn03o1FnySfMbF9jVyaNaA8ee2oRKkIc8rcBq3DqBHrNHXgTit:6E95vny2Mx9jIZeZogkYrcBq8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655822759, "uuid": "4b6c0e17-ef35-4177-a6c2-92b84a1e6bf9", "value": 5486592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655822759, "uuid": "4f0e006c-c990-4c39-9e76-baa0668d2cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822759, "uuid": "b311c95c-1e67-4b5d-86f8-293f7216bc83", "value": "19533bf0ecccd56fefb33af9f4ba7d8b3a11046b9b0e88d3671a2a2653ae619c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af101d8-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655802434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802434, "uuid": "62c96163-953e-45b5-8cb5-74b52ddc0df9", "comment": "Malware payload (Vjw0rm)", "value": "f992d6aac0c0d0ea532d8128827c1492", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802434, "uuid": "2f49729a-9911-47ea-bebf-b09ca09db546", "comment": "Malware payload (Vjw0rm)", "value": "19c2b2552b72e578804e41f698eb760655ec2826fc42fe365eb1bd5b7e1ce38b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802434, "uuid": "e2a43246-d677-4cf2-b079-ff7e2a66d7dc", "comment": "Malware payload (Vjw0rm)", "value": "135f458e0f462fcd95a420af6e34169a0e66a3b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802434, "uuid": "0f7ab9ff-5a0b-4eb7-ab0d-77717721a03e", "comment": "Malware payload (Vjw0rm)", "value": "c5d62900823458fd86d31bbe721d43291e47afb1e7b8ad263b82b80132368557de1c6242291b395d7518bda229cc3aa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802434, "uuid": "f6193808-936e-41b2-942f-f55ffe09d34f", "value": "T13A9459DCAA44B5DDD924A23AB07A2DC983F4230BD44153CD796D77025BBAB40C3DEA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802434, "uuid": "38ab2ddb-9d3a-4782-86b7-064bc7c1922a", "value": "6144:tv9GsqT+7W0UCYYP2BweMR4s+zdy4/UpyHLEpQtQWNnzGTlpM1S5ujxX7dhFBDF:FhqTq5PPUHyyrPSTTkZnhFBDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802434, "uuid": "97f747f8-2e1c-4dd4-b66a-9fa051c234b3", "value": 439567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802434, "uuid": "05892a0e-355b-4772-99fa-524d5754d1d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802434, "uuid": "472c4964-f494-48f8-bf34-a5e938a0fb6f", "value": "Shipping Documents AWB#5305323204643.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d501c6-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "cec8a65f-de5e-475c-a331-101b18fe7f61", "comment": "Malware payload (Mirai)", "value": "678fe827938b2b1ffaf48da512b984ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "e26a162c-e7b2-42d2-ae1f-a256a8d19269", "comment": "Malware payload (Mirai)", "value": "1a583ebadf7e2acc90b03ee1aa3b35c49d4ee368ad8391ab43abe47b3a4a30bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "6264e80a-d044-471a-8bb8-9c72aad4857a", "comment": "Malware payload (Mirai)", "value": "e124fa297ffb6d6f296269d1ee99029889c5cbe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "6b9e70db-0701-49be-a716-93d1b3e59fdd", "comment": "Malware payload (Mirai)", "value": "5d90c75e4321f9c5ffbf37856bea96eab6b954f405d6c9058679b8a703c72600f8e46bf71778da62ad59b8425aedad22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "4209f2d9-6b8e-436d-84d2-7423471f7313", "value": "T193E319C1AB52FEF3D5C39FB552E3D21005F3E8265B5B8E04E3ADADB04A195C8B11A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "15df3d4c-7579-4444-8f22-6315486125e1", "value": "3072:GtLZIxipo/5luw8Hf5uxj87boIvRgGLG/30cHXNP2+gz:QS+wkcxA78IvRgGLG/30cHXNP2+gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840569, "uuid": "efa9ce6d-b9f4-47ad-99a8-c11145b266f0", "value": 149498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840569, "uuid": "ac9b8efc-6821-4a6d-b2cd-c15bbc2f3765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "1a99f366-6b8a-4bcd-aa5e-b31646a0ec68", "value": "678fe827938b2b1ffaf48da512b984ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaf9dc6-f13c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655800451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800451, "uuid": "7f1c70c5-6f64-454f-8219-75f8fa020953", "comment": "Malware payload (AgentTesla)", "value": "207d01a3a7b9a7daeaa70d034130faee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800451, "uuid": "9579b345-5d50-4bc0-8284-b5683249510b", "comment": "Malware payload (AgentTesla)", "value": "1addaf4427d6aaad756983d66ee3377f6a54bb0834db9b07fa125cb75efc9dc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800451, "uuid": "27958023-8201-4586-8b02-1bebb677ec30", "comment": "Malware payload (AgentTesla)", "value": "ca20eea9f59d46cd222206cfcedd128799c1fbd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800451, "uuid": "5b025571-170c-4e46-9bdb-ee96bc248e85", "comment": "Malware payload (AgentTesla)", "value": "f72831bc7f98b5dccafa73df579b6afc69eb1b1598481078eeed4601a883121ad9a5be2ce5b16cfb737979fa8ecc27e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800451, "uuid": "a66b56f5-f231-47b9-92f8-78368932e1e9", "value": "T127F401F58FF8B966E16520737060A03C77E31E1EDC51D82AC6DBF18A3496AC125E4E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800451, "uuid": "05e2b813-3b79-4128-a795-fc58c84e5fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800451, "uuid": "39ee90b3-16ad-4f0a-8929-6937753f3649", "value": "12288:8+wvoVrpQBO1zMCg+eKjAfda188IOOB6MDaFE1YpHBZR6KQVmtokYVhhM:83vM9TVjn6a28k3YPZ24tQhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655800451, "uuid": "11129d12-060c-4620-8bed-f011b53e3086", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655800451, "uuid": "980b6231-26ef-4194-8b9b-b8b7eea963af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800451, "uuid": "43b408b8-9574-48f6-95fb-1b1e40f28d49", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29249.818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaddd63-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655782333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782333, "uuid": "0d47fede-9cd7-4f6a-a240-047a83e54c56", "comment": "Malware payload (SnakeKeylogger)", "value": "a6556c98227915f8bf048d3a55e725c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782333, "uuid": "026750c7-7da5-4646-b425-f1c816391363", "comment": "Malware payload (SnakeKeylogger)", "value": "1b7fa876bd56a7439e668dd55dca79d8dd092580474c36354864640cf4ab465c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782333, "uuid": "58ecdd34-c9b3-4387-8b2f-8f4cdb081415", "comment": "Malware payload (SnakeKeylogger)", "value": "8a4c42c85327ebda405004fa22fedb8ca2455317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782333, "uuid": "360ceb59-d45a-4c68-9a61-b383e863853b", "comment": "Malware payload (SnakeKeylogger)", "value": "ec1359b80d6db742e82888fdcc359e9747dcf12ba26e0e2ee34fecb4aca5a8e1ca6fe0e010ae83e6e34daf7a5ec60de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782333, "uuid": "0f00f2c7-5bfb-4b9f-8bd4-dc3f94fca636", "value": "T137D4F1F18FF4B962E028327374A4A07C77D21D1DDD55A53ACA8BF58E34A26C164E0E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782333, "uuid": "8b694ef3-3ee9-40d6-a1b6-10c040f1f314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782333, "uuid": "aaf8050f-90a8-41c6-9038-a78fcf720968", "value": "12288:1XvlbSLWW4FAmvaCWwd1sNxfw6cqIRqOJLaMPL:dv5Sr4hyhrfw6cpRqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782333, "uuid": "bb167d39-2bb4-415c-9541-f31aa648a7ec", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782333, "uuid": "339e7486-8c1a-4599-9811-0272dd9804be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782333, "uuid": "45cdaf17-8ea4-4626-89ee-5ede0aff2958", "value": "SecuriteInfo.com.W32.AIDetectNet.01.27675.5928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b47d05a-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "8481a64e-9c6a-41ea-8cca-2c4886c22697", "comment": "Malware payload (BlackCat)", "value": "20855475d20d252dda21287264a6d860", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "b5fce902-ed7d-4d83-b1f6-a477a90b4720", "comment": "Malware payload (BlackCat)", "value": "1b90e6f959db883fb4a036dac06242be724a7637708058e2c439e2250222d6d1", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "11b8bc65-c3cd-46b4-9d8a-a5df3397e529", "comment": "Malware payload (BlackCat)", "value": "04589618b18ed1e073768bd5669127aaf916c4f1", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "8048bb50-f8c7-404c-93c3-23b07a0617d6", "comment": "Malware payload (BlackCat)", "value": "3e8f0d045198bf071d9f794933156fcd2bd23e8dbf8ff82db132cd7d342f1a8c41625f94453b356af3cddf44d83414fc", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "8424c492-4299-4a39-8987-18476945320e", "value": "T13264940AF7E610E4F5BAC13999A2316AFC7239A54734E7DB56804A0E1B31FE4E93D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "b0014b3c-bc94-4c15-8fc1-4e18074e3f39", "value": "832cc9ec182625e9d64d3e9ecb1b1a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "86c1b147-e3e6-48e1-9c80-cf80ca00a27e", "value": "6144:EPCCc/B3WNwhIQyYY14xRjH5/2tPBBBm:UC7lWNwhIQqQT5/2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808770, "uuid": "e796593c-1d91-4da7-b7da-aae1d66f0391", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808770, "uuid": "db73b3d5-1c72-4e92-b426-8dc1bdd8a5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "d148fe85-1e87-49e3-ab07-361f98345fb0", "value": "1b90e6f959db883fb4a036dac06242be724a7637708058e2c439e2250222d6d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645fac2d-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655809242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809242, "uuid": "1612fde3-249d-4f84-bbd8-515267c2dcc6", "comment": "Malware payload (SnakeKeylogger)", "value": "1abfd6dda878b03833bb46646af048d2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809242, "uuid": "0caffc18-1799-4614-a012-b1bc499fad7b", "comment": "Malware payload (SnakeKeylogger)", "value": "1bbed4f6a5b143ade31c6128b1808581c1d8fd6538e7de9b3c82665d21e814aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809242, "uuid": "65efe396-fdb2-451e-9879-14f459e25fa3", "comment": "Malware payload (SnakeKeylogger)", "value": "0bbaf5c7c4e5e99e9a835035f53bbe13f4cb1ad8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809242, "uuid": "39d32097-f6e9-424b-b1cc-6eee0b25027d", "comment": "Malware payload (SnakeKeylogger)", "value": "e8fcb44a2619f414a8f289347bdd7fcd1adbd4e3e36d7e9f9cddb3b9de129d6e33a86d7176f6bb6fb480f518152828b8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809242, "uuid": "6ea31d64-320e-4b15-b99d-e985c52998ca", "value": "T1AA524B3CAB88CEEEC79DB2E66219BA08409DFD6C57C1E5E256BC63716B910BE0157410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809242, "uuid": "db98869c-a2cf-4c0d-ad67-ae4c53bf026b", "value": "192:EbUh/yaO3gjVIXcEh6pPywnQMBMkWBfjp91T8gYz5DXlZsDqhueG+MJt:eUh/yt3+inh6YJBfjp3wz5zLuFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809242, "uuid": "3018d9c6-d7b2-49dc-88a5-6f5717b006e9", "value": 13738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809242, "uuid": "3a266340-2eba-40bd-b228-9d80fb0e2388", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809242, "uuid": "16e20a32-0839-4323-a568-f796726619c1", "value": "ITEM LIST.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da689939-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655808581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808581, "uuid": "1f7d7632-abad-4e2b-92d9-41d0f8377c82", "comment": "Malware payload (Formbook)", "value": "bef72eb124931f8e96965b4e5062605c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808581, "uuid": "e209f66b-a25d-4394-8aae-6fe4d5fe9ae8", "comment": "Malware payload (Formbook)", "value": "1bec941f244d3f69b90f2b3166509ccffdfb11959003f53c1ef097beaf4a0969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808581, "uuid": "918d5e70-aa39-4d86-94d5-bc49d24a8e52", "comment": "Malware payload (Formbook)", "value": "f2f7fb4c3c0d130dfec7ede1efa1b5187b759ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808581, "uuid": "e75aebd5-211d-440b-86e0-dcf65e60899b", "comment": "Malware payload (Formbook)", "value": "a4a35b91ff9af37a39541c5b4e120a8677c2bf7337cbb4cfa67214d707439a997d392451dfd654537810603d38bb9557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808581, "uuid": "f2accd17-9e5e-4ccb-a223-b1f77d22c207", "value": "T1E764C09677E88F50C66C29B5D1EF483953E1AEC71B32E2C73F4476980E423639C85B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808581, "uuid": "152b8e52-a4a8-4bfc-8bb0-8b3b466a27cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808581, "uuid": "b09012c2-adaa-44aa-9945-1017d1795f0e", "value": "6144:W4sV4cpYQ1qKih8cv915D7bC327jeYk+m8cI:hu1ppih/V/D7gyjeY7xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808581, "uuid": "3c862120-4980-4748-bfad-023c733de3d1", "value": 310808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808581, "uuid": "0d98b384-2eb1-4166-b402-6ed29abab675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808581, "uuid": "73256a94-af70-46ea-a472-d6c312cf5b36", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29403.16321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8077204-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803798, "uuid": "cd1ec888-f971-40a7-bd63-3e0225104910", "comment": "Malware payload", "value": "b028dae964d51eb9e7f76c9879cf5300", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803798, "uuid": "7868211a-bd82-4e41-9e5d-dbccf0fad1c5", "comment": "Malware payload", "value": "1cab97d73c3f92f4d080ad9d8f5c2ccb3889a10ab6ca5e23ff90de5a91b70eeb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803798, "uuid": "f2c82474-421b-4730-a688-b50d3b01ec2e", "comment": "Malware payload", "value": "84e5d6406e52e3ad3666b871a0b0741fa64b891c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803798, "uuid": "01dd1c33-0522-4f55-8e62-96afd71a7c37", "comment": "Malware payload", "value": "a5026dd39e045fe2b2626b723a2538cd52ae3ad92a5ecda5f1a8608df081501812dc6b9ebb7579e8c766925796e8c06c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803798, "uuid": "33442b06-c4ea-4eaa-b29b-33ead57b6635", "value": "T1C634DDA0685F49B2E708DD1E25A4F6546EBAFEEB30C1047123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803798, "uuid": "650f693d-b4dc-4376-9459-6b274e9882cf", "value": "1536:iG3bL5/IJX06cOpW1SIPqt2RNL8QZVzFz76mAg5eeVhMDw5wfLc:iA1PaiVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803798, "uuid": "9b0e2b21-52e2-4d1f-be44-66b83bd6ccd7", "value": 238565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803798, "uuid": "5ff7da53-de34-4bc8-93c5-f9f6951ca38e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803798, "uuid": "2bd18ab5-5ece-45f7-b275-5643f7b69c59", "value": "New Order M0977.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2865df-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807943, "uuid": "dad63101-aff0-403d-bf5b-a89e6a925d6f", "comment": "Malware payload (BlackCat)", "value": "7a48c7bcae4a7ae5cd9ba1d68bcda78b", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807943, "uuid": "522b4e69-2adb-4305-b546-c31fd42f5ef0", "comment": "Malware payload (BlackCat)", "value": "1e8696116c400742d13d6dfcad676badee68eac4a42a0693556f5dcfa82d0a46", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807943, "uuid": "6dba2534-2ca6-469f-8f6b-3ebec0e45752", "comment": "Malware payload (BlackCat)", "value": "126b741224956490d78515f1c5ddaf1f5cb448bc", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807943, "uuid": "b58fecde-f50a-477b-a450-9fe3613462da", "comment": "Malware payload (BlackCat)", "value": "960ded667472c3ec913436ae9bb9a76f190d957b0d7477eeaeebe53c00695a98fcc9b648f8e3ab20517219851f1bb556", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807943, "uuid": "c2acd469-4c28-4b18-a711-ca73a082d765", "value": "T1F5E5AF95FB43E2ADED6B14B0305EB33AEE34481C01199FA3DBE45D71B92EB105E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807943, "uuid": "5a3c109a-1dc9-414f-8b9a-08507dcadcd9", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807943, "uuid": "1752ed25-e2b1-4f33-b865-bbfc5a6e0208", "value": "49152:nQMStZChL9rV/HFHVnR3/sTUfCgUdbdNSJIdTgtX6e/7SM:oghLfH1xR3/ZqSTtX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807943, "uuid": "0b9fec9e-742d-4ce1-a02f-41eb83a7fb7d", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807943, "uuid": "e8f4a5dd-a6c0-4930-a7cb-126536f5f087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807943, "uuid": "9b7a5072-d1e0-4108-836a-c8c3b9a3e257", "value": "1e8696116c400742d13d6dfcad676badee68eac4a42a0693556f5dcfa82d0a46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1777356-f12b-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655793050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793050, "uuid": "f8991427-e85d-4de5-be18-d3c5002db480", "comment": "Malware payload (GuLoader)", "value": "89f9aa23d43fb75dd19b6bba00ee2f33", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793050, "uuid": "10fd4229-ade7-4c83-ada3-3975e96753f8", "comment": "Malware payload (GuLoader)", "value": "1ef090ca95ddaa0c15d3f91c86028848990ad82d262d48d42cb7236b70148c4e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793050, "uuid": "3392ca5f-265f-447d-91dd-34c00f05a8c1", "comment": "Malware payload (GuLoader)", "value": "714c86281382c18b2940b24d510090ac366f73f3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793050, "uuid": "f5693862-14fe-427b-8e0d-350b2548c47b", "comment": "Malware payload (GuLoader)", "value": "8a4ab30b3cb589157a1a016e8fb1dd2c1d3bdb5822de47e31fdd29acd6e6b16550fe8f311483612366f21be81b09b685", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793050, "uuid": "0879fe6b-a582-438e-926a-76bcb7807249", "value": "T1CA74230FA94AB2D45E88E592D0BF3B7FEF253B6B11912647F4CA2859476F56DC0BB000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793050, "uuid": "7619d179-5922-457c-85f5-bc49e5db1308", "value": "6144:1JdUDQM3H6cbck0eWY/DVOBMDkGaf80hBSQ65u2AR4p4EM:1Ux0TYhOWRakzu16pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793050, "uuid": "70008322-4fca-432c-8dcc-ceed3ba1d588", "value": 339001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793050, "uuid": "5d0da45e-aceb-447f-8410-862b3357c9aa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793050, "uuid": "f927ac55-b048-44f9-9c4c-c5c79afd6f79", "value": "Bank Copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59c5485-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655823229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823229, "uuid": "5b0821f2-1779-4a9c-bb17-68f8030dbea3", "comment": "Malware payload (Formbook)", "value": "1a6ef7858bb11328c05d843994e5c5ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823229, "uuid": "0310bc5c-d679-4fb8-8c0d-c086c92393c4", "comment": "Malware payload (Formbook)", "value": "20abbef0a386be20828344f159293e55cfcf89942c3b26c21acc7b052fbe896d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823229, "uuid": "7943129c-9d9e-4742-9a9f-e50dcd305abe", "comment": "Malware payload (Formbook)", "value": "9338f87b1b38bfcd45508003a19cdad968ddeab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823229, "uuid": "afeab7ba-412a-4199-ab7b-ef9c8db1ad6d", "comment": "Malware payload (Formbook)", "value": "9df71ef5bcd8f598487cdc9926ba4cc9db8f927649d3e465f12e814fed56154c85f4dcb704886727e1b0e0a8113bdbd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823229, "uuid": "e7f8efe1-6d9b-4895-94bd-098e3bb54789", "value": "T11F158DAE474A6DCBDCA50B3696FB4AF162158B70271F870B5251B83E1A2F6DD7F0008D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823229, "uuid": "2c5a812c-3a37-4682-8220-cd02933bdd76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823229, "uuid": "a3a10b14-6666-4b8f-992b-8bc801ff8562", "value": "12288:92Pk4zQa1Zk5q71WIICKGaLgf82RwmYS3PMU+vrSzwbg2a+tB9wA+uo:ks4zB+GWoK62mYS/BKg2jtky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823229, "uuid": "85ef3bb3-e879-45e9-826f-34cff84b9da2", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823229, "uuid": "38364027-9e17-4f5f-b5ca-1a9373246a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823229, "uuid": "fc6f1f28-91c6-4953-bc41-4e3f016d0636", "value": "\u00d6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13da08b3-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655799658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799658, "uuid": "7434802a-1e95-4051-b39e-2eeaae931d42", "comment": "Malware payload (SilentBuilder)", "value": "c574cb01d2a394c3b879be05a4dbf476", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799658, "uuid": "87d4a7de-3cbd-481e-a187-c9ddcf490690", "comment": "Malware payload (SilentBuilder)", "value": "20af4fd7fbeb87c8c40946683190650b7234e19627d4412e19a8090706907e5a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799658, "uuid": "ab51b0db-eb8a-4d8d-bd6d-86b2b5722898", "comment": "Malware payload (SilentBuilder)", "value": "288e41fc3d120617d99b089fd975e11ae084ffa3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799658, "uuid": "8de7060c-8a8e-471a-8932-c80782b7f95f", "comment": "Malware payload (SilentBuilder)", "value": "7e78443370a80854fdebda8ae01f0357e2eed26b15ea140b9965d419bda97331493bb25c79ad4e51f1b4a3b16ade03f8", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799658, "uuid": "1b75180e-d0e6-4a75-9791-592bb0e1974f", "value": "T13D733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799658, "uuid": "2a41d2ce-04e9-4acf-ab19-588206039497", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBI:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799658, "uuid": "c884d310-6d1e-4757-a1ac-b2484370f7ac", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799658, "uuid": "4a83b4ab-2c5d-48a7-96b9-7167be3e3f20", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799658, "uuid": "2c7093a3-7943-4aff-a2bf-96f00ad9bda6", "value": "Rechnung 2022.20.06_1232.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3eb578-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809013, "uuid": "9bb8bbf2-3e19-4b85-beff-dd4959a92bbe", "comment": "Malware payload (AgentTesla)", "value": "a0ccce1be48fa1c3c892568731778251", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809013, "uuid": "c15bcf4c-b5c2-4ffe-b9e1-e7530cf9d3a7", "comment": "Malware payload (AgentTesla)", "value": "20be9fab26e356d48aabb0afb8d51424f022cb8fbc236470713d04a5c914cdcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809013, "uuid": "50d30ab0-e2f8-4bdb-8d2a-45e63e9b6b8c", "comment": "Malware payload (AgentTesla)", "value": "c5fa4c05147f8e933eb524e2005c8c5ba632ccde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809013, "uuid": "dcfd243f-d611-41f5-9e04-f55445823af1", "comment": "Malware payload (AgentTesla)", "value": "f15f3c02ae51a7ce1a83af17addcf7fa96046eb821eda0c228811380174a8e71c8c11ee489c7e7ce3703af8d368d2a27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809013, "uuid": "27d46e79-39e3-4287-83ce-a46a8f7765af", "value": "T16D029FF5D558E48BC535893D7BAD11EF5E38D5174C81A17A338091A80BC1893AB9F09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809013, "uuid": "8f11d5f1-5647-4a52-abc5-9e420d203341", "value": "192:xrXP/+LJqgMJaxiaVW+LggqYqBun5rqd7vI5ma0Ik:dXPm4gwaVW+LdqYh5rUIn0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809013, "uuid": "98e22a97-cc49-412d-a97a-16c7d859e645", "value": 8787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809013, "uuid": "95356b10-139a-4fe9-8c76-04d83448ed7b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809013, "uuid": "cdb5098a-b9ac-4f00-8535-ab1f5e180a48", "value": "LDP00113.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e18824-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655831922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831922, "uuid": "e9d9fba8-ba55-4a3c-b4a9-3a66a12fe73f", "comment": "Malware payload (Heodo)", "value": "d2fd68f12a214d65384306349abb0c80", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831922, "uuid": "9304f8ca-41b1-4060-82d3-715bd536814d", "comment": "Malware payload (Heodo)", "value": "212983d02473aabed187f76974a02efccaecb143a524b6d8f08a04a84e5fcfdf", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831922, "uuid": "8feade07-0e99-4db3-b8e3-f5b693042918", "comment": "Malware payload (Heodo)", "value": "a23e2de952702aed409cd9ae6c80efd295458b74", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831922, "uuid": "f56726bb-3ed0-4810-ac2a-3287f7f2afed", "comment": "Malware payload (Heodo)", "value": "d7a01b75fbc820e95f57ea5af0aa06aca0ba7f7eac17b2d8317407924a95d92a165a2a14b5d52acd22b3c1936b315efc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831922, "uuid": "219c957c-07d5-4aaa-a3de-f1d6e5701884", "value": "T161A48C17E29412B9E467833C88135D66E7BABC01C763F6EF0394465AFE2339C572AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831922, "uuid": "a10da859-8529-49e9-b144-648444907e55", "value": "0c55d7d801539bc945a4c9a78f4d837d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831922, "uuid": "fc8f3026-1bc5-430a-a95c-a4a4ce098c23", "value": "6144:WAKiBME7573E3RZPdvBzFoh4PFSz2guNMkuZ5qWUdlD7wAPIztsys:W2ME7573+hBzFoaPSd3IEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831922, "uuid": "7c68e88b-ad88-4d29-b911-e103eac0c499", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831922, "uuid": "341f5f93-d19a-4ccd-9cf9-37bdebb8bb41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831922, "uuid": "4d315069-57ec-4c8a-bdcf-bf73ea023169", "value": "kVTd.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c615c5ed-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808546, "uuid": "4d584078-8e59-4af5-9d7b-917c388fa4e6", "comment": "Malware payload (BlackCat)", "value": "6c1b41913748b2283ce225173b94c09e", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808546, "uuid": "62619104-3cfb-400d-acc2-26854d66d391", "comment": "Malware payload (BlackCat)", "value": "214ea9347df948e515af3f0ed446722e36f011e8cd34a221eb6e506269b955f3", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808546, "uuid": "f9d6d728-d910-4ba3-be30-f0fcabe09f5e", "comment": "Malware payload (BlackCat)", "value": "fbaeaf7d5c7ff488c070483a62fff6c2832ec10c", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808546, "uuid": "d32ece34-da71-41d6-a43e-4b05550b78bc", "comment": "Malware payload (BlackCat)", "value": "2b4e470dedf5d9f9ee875dc979465a726f642808d78a64123c04ba854c096e6fcd54a29588b4b80e1957e6350457c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808546, "uuid": "3b507f77-e22d-49fd-8c19-6298d86a3f92", "value": "T1EDE5AF95FB83E2ADED6B14B0305EB33ADE344C1C01199EA3DBE45D71B92EB111E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808546, "uuid": "80b01663-7aa5-480a-8857-20d0ccf676f3", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808546, "uuid": "3cfc205f-f3d8-49ff-8b79-7e77ecf15fa3", "value": "49152:bQMejJ/oFaOKIV+Wv40nM338KVKKPgTxDeL+k2GNp+e1QL+ckk+S7:El/VOKIVvLM33tQKPgw9p+9L+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808546, "uuid": "c4615c68-0b3b-4749-9096-76f0a00846b2", "value": 3077120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808546, "uuid": "44a361cb-9277-4b27-b8e4-6da531b24af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808546, "uuid": "a9a825f6-232d-48bf-9fa4-d24135e5fc9e", "value": "214ea9347df948e515af3f0ed446722e36f011e8cd34a221eb6e506269b955f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d489b2d-f105-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655776695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776695, "uuid": "f3224594-4f90-425c-9a81-9ade4e60db6f", "comment": "Malware payload (Loki)", "value": "3c31c9877e89205364176845e609c2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776695, "uuid": "1415f92f-31f4-417b-98da-c1845ec9ea25", "comment": "Malware payload (Loki)", "value": "21c8a7e0febde5e77ba88f37eeb31060b76a66091ed5b532b68cd3e69ee5f3c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776695, "uuid": "773b5525-22f5-4cc5-9bc4-8ee9cc676805", "comment": "Malware payload (Loki)", "value": "b01e3de17326f257c13686889dc7a25f5b147313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776695, "uuid": "d0265b57-7b09-4596-99be-6598af056856", "comment": "Malware payload (Loki)", "value": "ecac1ece0f68896e3e9f0774702a9934758c3ec386315c9239c1d615ce51a5b6698b63eaaf34695cdbe1369aadb1b170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776695, "uuid": "e8ee6c32-5e0b-43e4-9c25-3d3d6b3e5de6", "value": "T1A5C4BF9C3660B69EC42BCE7689541C1096A1A4BB531BE347989711EED90EBCBCF143F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776695, "uuid": "c3891dbb-2713-4a7e-b17c-3a0191be57f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776695, "uuid": "1eecb9fd-3489-43b8-b89a-8b8a8044b3d5", "value": "12288:OVhh1ns8ZGrcNCaysr2iNb8hxxSYfI3VjH70KhmkgjQr220NMumV2OlYd:OPZBy41x8oYKxH70KhmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776695, "uuid": "5511549f-26cb-4a1a-9973-2c3dbad1a779", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776695, "uuid": "803ed777-902c-4e1a-bc94-61c759bf1ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776695, "uuid": "5593575d-fbc0-4d59-9f2a-3c01cdd4bdd8", "value": "DHL-6-20-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65398f88-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808813, "uuid": "0c4c858f-4680-42fd-b1b3-313b12f3327c", "comment": "Malware payload (RedLineStealer)", "value": "c6f41196afaf9256ea5de485b5b5d33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808813, "uuid": "ec134bd7-c6ed-4fa8-bfb3-6f33bc878483", "comment": "Malware payload (RedLineStealer)", "value": "21dd2d82b89187f731d2af43bff393d948c0a92ee4e2ad1c94416f670a391099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808813, "uuid": "3c6255f1-27dc-4871-b92b-95a1b8f655c6", "comment": "Malware payload (RedLineStealer)", "value": "0e5d8c66829aa7ff017e737acb15a31c5da74473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808813, "uuid": "110e2cb2-30db-42b2-821e-fcecd190e131", "comment": "Malware payload (RedLineStealer)", "value": "911f6d394ace8b9e42be03ad40cddea1d730ae578812bc36b6250e16b3915800bc9c5ebed04f470002705bc0e16f8ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808813, "uuid": "2bbfafbc-6288-4e8b-a61d-1383f28859dc", "value": "T1F7D4C22CBB115A72FD1EE1306D110B08BF660F5362B8B98257CB16CAA74F065FDD5CA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808813, "uuid": "86d941ec-ee28-4af5-821c-83f129f7e262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808813, "uuid": "04daf1ba-6718-4024-ade8-4e5a655823e7", "value": "12288:6p0S+LBAhrqkiK5LbdyAiJPJTOl3vm2bXPJkZdXn8vdewC:a3rji6dtmBal/m2z4nQd9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808813, "uuid": "86d22e32-c896-4d78-9c53-0353a572c989", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808813, "uuid": "5d339e45-7b61-4597-b0a7-d5c115a2b523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808813, "uuid": "d3cc32e6-cd37-45c8-9333-3bab04065035", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692b8057-f114-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655783050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783050, "uuid": "f4e3c8c7-66e6-455a-9753-bbd441e0a322", "comment": "Malware payload (NanoCore)", "value": "617a5e683eb9f142139a860b9fb84959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783050, "uuid": "e1bb7ae0-0746-4d7e-afeb-a9d80ba018a1", "comment": "Malware payload (NanoCore)", "value": "243695e7081c87c1a14cfef0f89b75bd326edef6e651ef8b124fa8052dbee7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783050, "uuid": "f13c67aa-adb1-4ec1-b6c6-863b342f6710", "comment": "Malware payload (NanoCore)", "value": "49e92c99c8b0777dc93ec4f3b13fdc6de99e80b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783050, "uuid": "d3c509fc-b295-4a2e-b20a-ed3444560109", "comment": "Malware payload (NanoCore)", "value": "ab3ca192b9b3ff53dba74483f8253a6c1924fae544def99403e496c8d89bf842ab03c526c125897d94921f17bede7b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783050, "uuid": "9b8952a8-fc71-4b5b-adc8-1380450bf126", "value": "T15314CF5677A9892FE2CE86BD612241539379C2E3D8C3F3DE28D415B69F263E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783050, "uuid": "8dd4f1b3-0aaa-43cd-b89e-5f416da2a493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783050, "uuid": "0a9a221b-027e-4542-8ae5-8cd2c77f83a5", "value": "6144:MLV6Bta6dtJmakIM5UUBPnGZd3wwMi5T5:MLV6BtpmknMOhwwMi15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655783050, "uuid": "21530c8f-3f07-4125-a781-9336100147c1", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655783050, "uuid": "3f3387c4-c9d1-4ef2-8924-b5b180d11893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783050, "uuid": "8567cc26-4fb6-4ed9-8a75-eeb0da7764ac", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157c33f8-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808250, "uuid": "da7325c7-beb1-466b-97ac-1b45ede5feaa", "comment": "Malware payload (BlackCat)", "value": "32c76e28c932f693598ea020d184784e", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808250, "uuid": "f572ea58-98d9-4775-8947-0254c14e646b", "comment": "Malware payload (BlackCat)", "value": "25364fb9f14a97437eb079e0778f724f3817faa7d23de316b2eca11bdae1e343", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808250, "uuid": "90050b93-4258-40af-b109-df20ecd1a9fa", "comment": "Malware payload (BlackCat)", "value": "3b4765349a0b9f8000fb76a8f71bbede183b2c74", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808250, "uuid": "8dd574f1-a9c0-4283-b36c-b47b0f2a44d5", "comment": "Malware payload (BlackCat)", "value": "9ab0c3f5d46e197b6183430802735498fb376f85d4c5f6e0a0e63a05368e9ce4a75100a4556a655d13771425509ff13f", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808250, "uuid": "70fc5158-017d-48a3-9247-80d45359a3f8", "value": "T118E59E46FA4356ADCB971570305EB33AF63A491C602D9FA3E7E89D30FE2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808250, "uuid": "3c3da237-9092-430b-965c-cfdb5a62829e", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808250, "uuid": "74bf9c4f-4fcf-4677-a0df-ff5017a8d984", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NS/RgaJ2w1Mq:rAnCs8pVblGyNM+l4UxUc1BhFovww1Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808250, "uuid": "bd3bff08-743a-4cb7-9984-798ba7cbdeb1", "value": 3068948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808250, "uuid": "0d6ef571-16f9-4dbe-a303-e0e3ffb9f620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808250, "uuid": "0820d6a1-66be-45e5-93b2-83d265d6ee63", "value": "25364fb9f14a97437eb079e0778f724f3817faa7d23de316b2eca11bdae1e343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dfd35e-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806456, "uuid": "d4887bfe-98d0-4965-b443-8e98024b9046", "comment": "Malware payload (Formbook)", "value": "cb23ffa7172ac837162ecdbdf770a714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806456, "uuid": "0c23346e-4422-40ab-bbbc-011fbf6d76e2", "comment": "Malware payload (Formbook)", "value": "253adcfc2f1b80bd56a30731ad5b7126507910706ddd72832ed2455d894ca9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806456, "uuid": "d9f85426-02ea-4dbc-a47a-bfd351b1b441", "comment": "Malware payload (Formbook)", "value": "0288cea8002e2f065f8b39a2e541cc90769d50b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806456, "uuid": "d3f56874-134f-4283-a476-96e7374bd673", "comment": "Malware payload (Formbook)", "value": "7c45f56a1111578d981300d947349a884eb439735cf74415aeed02cc9a02f139529498c8ad09d24b94487fa4066ea59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806456, "uuid": "9567b546-9995-48a0-a6e4-56629e9d6fe4", "value": "T19AE4F1F08FF8BA21E42561777064A47C37E30D1EDD229939D6DBF05A38A6AC125E0E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806456, "uuid": "93e578c0-1c2d-46ec-9451-6aee4245c9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806456, "uuid": "f4ef4380-1a6b-4a5a-a01a-fb6a3208de0a", "value": "12288:yJvT0cq1RGMqwRY6RSRmCC7IgqpoeA1nVzUGPfK/S6yiB3UyV5QbaDoZ:2vT0cuB26RpfUlFAxVz/I3vbDoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806456, "uuid": "24cd90d0-e70e-4b01-aed1-a8918ae4aa41", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806456, "uuid": "b7508b6e-4a27-4b26-8c19-3680b5a7dd22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806456, "uuid": "5d983b75-784e-412c-9f8a-d81827b7fba2", "value": "Order97464477474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ddafb1-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806821, "uuid": "852a9e76-6ff0-4afc-a72e-9cb105d52ae0", "comment": "Malware payload (Formbook)", "value": "0a7ee72e2b57214272b36a91835ece31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806821, "uuid": "f44e8676-5362-4bd8-8bf2-07ca97c96792", "comment": "Malware payload (Formbook)", "value": "25773608894ed7dced5dd50dc02483ffdd6d9ee3d79333aa8292c5d2a2586e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806821, "uuid": "374c7556-a870-40e1-91ba-7a24221a845a", "comment": "Malware payload (Formbook)", "value": "4f8ba6b8eee9c2f612cd046b34905cd110ec1b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806821, "uuid": "e2f30c48-6bb8-4d25-bb7b-3abadcae375c", "comment": "Malware payload (Formbook)", "value": "af82458c5bdf263bcb6ca9f38026c5db72a8cc5aa485bc60676dea8c9e584e2630002ff9815094b172cb713f6d7f042a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806821, "uuid": "32054873-fdec-4c1f-bc5a-aa0e979ef4d6", "value": "T15EA4D0F48FF4B966E02421B7B4A4607C77E35E1DD851E53ADA9BF04A34A1AC264E0F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806821, "uuid": "142e74ff-e40e-4757-84d6-143be8cad4f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806821, "uuid": "964b32cc-580e-402e-adf5-d7998b633792", "value": "12288:2bv8HcnIaGNzBjgZOIl1sRnUg0kWIb9E:Yv8HctGNziZ3l1cUgIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806821, "uuid": "1ee55bee-9a19-4475-bdad-ca3139b7ace4", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806821, "uuid": "3bae7275-6a0b-477c-b4c2-9a1d5d589aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806821, "uuid": "84a79a33-0dc9-45bd-a303-24fa7fba3f32", "value": "networksec.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33b5ee8-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789590, "uuid": "9a551bad-2538-48e4-ab14-53ef8b2b28f4", "comment": "Malware payload (AgentTesla)", "value": "03d37bfd3eb0beb36bd5ce680f8cd11e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789590, "uuid": "749996b0-064c-4a2e-95fb-055322eed251", "comment": "Malware payload (AgentTesla)", "value": "264487d5b9dcff05a30655580ea5336152daf211a7908159bc0bf817c88cf3a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789590, "uuid": "f9fc1131-f125-4c2e-bc9b-41df84270349", "comment": "Malware payload (AgentTesla)", "value": "6351971d0bf600a74b2f3a6e1cc23404513019c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789590, "uuid": "c926956a-7e22-4dbb-b183-9dca619daf73", "comment": "Malware payload (AgentTesla)", "value": "7e72e0f912d5598a25848088bb972308e1ab253d25d2560e5e2efc3a5139a3ddea1f8446c0c0085f84f20a1b4ff921fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789590, "uuid": "4e640358-69ec-49be-bd23-61731d0119e9", "value": "T191F401F09FB8796AE539247734A0603C37E34C2EDC55E46ADADBF40A7492AC161E0E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789590, "uuid": "df5c1ab6-1248-473d-b3c0-d40b9ecb6fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789590, "uuid": "1cea9016-e2d0-4e27-bc7a-586e60995df6", "value": "12288:1CPBJOJ4GLHklVMOd5gpAKRt1K/lQCIAaSTWu6KnQVBgCF+/qYDGsA:sPnBG4lVMOPguKnZ0L2BjF+/NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789590, "uuid": "a2324a27-67ff-450b-b6c0-73a36b136f79", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789590, "uuid": "e3252ee5-6f35-43f4-90c7-eda107fbff78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789590, "uuid": "1de2aeff-f295-4f10-a237-5a7f76cdd8f2", "value": "SecuriteInfo.com.Trojan.DownLoader27.59888.1663.17681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692e63e2-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655793358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793358, "uuid": "9405bc10-f959-44a3-8492-07285c40dc74", "comment": "Malware payload (Stop)", "value": "5fa248a42c26779d13d8221e04dcd558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793358, "uuid": "c9dfb284-ae8b-4b0e-897a-a5c4942def78", "comment": "Malware payload (Stop)", "value": "2696bf7026227318186dd5129a9840e81da0350ac0e0645587700148ea21f3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793358, "uuid": "ef939a16-1d34-49ab-9322-635da7aec26c", "comment": "Malware payload (Stop)", "value": "bcd688c6f6dcb69fc70455447572a6498f7f9a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793358, "uuid": "be092d4b-d31a-4e28-9983-091a617a1ebf", "comment": "Malware payload (Stop)", "value": "35f335837ab010c69663394f926141531104dd7bc11b7d66c1b1fc907e3ca2582428892eea42196f08b21e45c07823df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793358, "uuid": "f6afe08d-1ecd-4dab-bfaa-e9bfe8061baa", "value": "T14705232233ECCCF6D0A946B044918BE1597939731265658FBB14366E3FAD3909B7C3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793358, "uuid": "ecdbfbd8-7223-4e88-bf43-7bb88fc391d6", "value": "32138f5b4c47f39b193f3de45cb1e6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793358, "uuid": "293ed9a5-ac42-47b3-b88c-cacae8320703", "value": "24576:Ys/qaYstfMsT8MR+ozzk1d2CWAbqwaCXo+:YhadtUxMRUyAb73Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793358, "uuid": "bdd9e3ea-3546-4b0b-9f50-7428121e7f69", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793358, "uuid": "994198ef-b544-4869-8736-5bef35c61589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793358, "uuid": "4377a886-1a60-43cd-a70a-c26d3b57cd8f", "value": "2696bf7026227318186dd5129a9840e81da0350ac0e0645587700148ea21f3dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9ee165-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655801657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801657, "uuid": "f86240c0-a7e8-4da6-9250-59886dc54840", "comment": "Malware payload (Heodo)", "value": "d7bef26bc232b94bf4de516653734d50", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801657, "uuid": "d76a40a8-9637-4646-8681-bb46dc736a49", "comment": "Malware payload (Heodo)", "value": "27cfeb4a2ac3556be9707e3be71df20d5d0f6a5c0fb5c3dbc1b08042cf6d7fe4", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801657, "uuid": "340cdfe9-825d-40b4-a7eb-8e76f8a7f4a6", "comment": "Malware payload (Heodo)", "value": "3d7e852be333edd3358c32b464ad6131e7cf5b8c", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801657, "uuid": "0b822aac-6f51-463f-bc18-f29ea8b26bc7", "comment": "Malware payload (Heodo)", "value": "86a8d493721dfcb76b7f365d58e0d83ef4f9741ca0b5dd3bf6a3244573a71cf63f0c38dd1decf9934df689692870bf0e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801657, "uuid": "5a366b9a-0703-4cdf-8979-c15c436b9206", "value": "T17264AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801657, "uuid": "d49f7376-0151-4d99-a9b7-41f7ea9677b9", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801657, "uuid": "c2c80fac-9f9c-4891-b536-3e8d21c2c6cf", "value": "6144:3MiSTD2He3kjHfNsQnqzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3NNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801657, "uuid": "ff00742d-8c05-447a-aafc-9b77e24f97af", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801657, "uuid": "5eadce6b-67e7-427a-8f7d-235ea51b7b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801657, "uuid": "3a5fa86f-d7fe-4ca7-84a5-40cc537e67e0", "value": "X9bvVVRZwngXmHKc4.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5aeaa9-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655823485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823485, "uuid": "a474b595-2b71-4dce-a965-19d421d56e54", "comment": "Malware payload (AgentTesla)", "value": "ae1902f9d194dfc89dfa20cfef4c1220", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823485, "uuid": "908f93cd-65a5-4972-a67e-e2ab6a276e3f", "comment": "Malware payload (AgentTesla)", "value": "29117482a1a5a018669c1ecbb3365851dfa6b0dfb0cad892b90c8abf81d68dd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823485, "uuid": "9c89096b-6551-43e6-8740-3e9e6295aa35", "comment": "Malware payload (AgentTesla)", "value": "71e153c3486f292a4868080d2acf15f1f7a5eadc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823485, "uuid": "1d574aff-ac78-4192-a91f-e21955a2a6bc", "comment": "Malware payload (AgentTesla)", "value": "9919e6067575327017d396661dfc4b291247b3b127793904e06b12af8f6b839aca0a48e78e0ec0c8e9346010413152fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823485, "uuid": "3adc7171-2c3f-4537-9e85-4f5a6803df5a", "value": "T18B158D02A7C91F27E2BDB73A2175481843F6F9D61254DF8E3D8525CA01F7B809B92B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823485, "uuid": "b7fd3fb9-aec1-495c-bed2-36520f77f898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823485, "uuid": "62b7d82c-7d1e-4d65-a61c-ef85001be02f", "value": "12288:j82SLkKB58bBZ62UFfSdMAEmtZXsq9975oiEaSSvU+bxXbHwNB:j8L2tUFP/Wzd5UaRUuVUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823485, "uuid": "51bcb2d1-ae73-435a-91a1-2e1644a88f05", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823485, "uuid": "532330f4-804c-44e0-b870-aa154dc63c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823485, "uuid": "22ec6a2a-2689-41c6-88bf-c170b371a9b7", "value": "Claim Reference No MAR048780314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33267011-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "c7981ced-0db3-46a5-b3d5-da203a6363bc", "comment": "Malware payload (Mirai)", "value": "128f8db23313c1a235afdcbe6d48f2b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "95828a0f-0b0d-4424-8530-acb17e164c1b", "comment": "Malware payload (Mirai)", "value": "2a00a2a70041f67dccfae112dba00cb45875652f7c52a5063383d9486e793740", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "d6b2fbf1-98c6-4149-8734-a6953005a6e4", "comment": "Malware payload (Mirai)", "value": "ab824b3c9a4b51b0fc931946fc231a7e1470befc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "e20bddfb-b7b2-41d8-a2af-758d76297797", "comment": "Malware payload (Mirai)", "value": "b361ff11368e2a849b5eecb64466dcc8286d7fed197fcd3113a90f9c90e1c4a2c5a243f7792909a1be425c6e2dcd9058", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "5c558988-8f57-40b0-acf4-934c71fce371", "value": "T100C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "65cb7cb6-7f20-47f5-8d19-49da547b790f", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpM+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Eq+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "d480d926-e368-4285-982f-d579dd7f95a5", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "5df2b30a-a756-44ee-935c-ee00d0cff7a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "285d1677-a5db-47af-9141-3fd0f49f7466", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73276785-f0f9-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655771471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655771471, "uuid": "53f1c989-66aa-4128-a630-76b938785eff", "comment": "Malware payload (Formbook)", "value": "453c0b465552ed69e96ca33681caeb5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655771471, "uuid": "5c7f16ca-23b7-419a-bdd1-da53c8e5f3d7", "comment": "Malware payload (Formbook)", "value": "2ad56747e278edae67621cdebd42ee161e4663756980d0caec350de0ede668b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655771471, "uuid": "b7f25340-4b98-402e-a9bf-e9c54e2039bf", "comment": "Malware payload (Formbook)", "value": "7c3c61848234f3bb22fd48cfa197ee6af513a78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655771471, "uuid": "321fbb28-6cf5-48dd-a7bd-03b11307fdcf", "comment": "Malware payload (Formbook)", "value": "327a2d73d1cc8f7ca2bb9d55a3e62cb7eb8f46a6442fcd9b05ea4f564f473ad80b5b8455844d45a7de07866954d9aecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655771471, "uuid": "c029a3b1-5e94-4c1b-99c3-972bb094731b", "value": "T1D0F40218B70E0E5CE120557BECD2233F0EB626F5747CD6C75FA2602668B3B078617A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655771471, "uuid": "7a88267f-c604-46ab-8da1-f857616f08e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655771471, "uuid": "e225370f-f2a4-4a22-b79d-1bc0c2b12365", "value": "12288:VlmEjxRz/1taGbYmkaw2q9etURRJ1KaSxRH23Dh8n+l2mJPB+w870x0Xv:VlmEjxRRtdi2ztURRWZRwh32mz+I0Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655771471, "uuid": "6f85afd1-d71b-4d42-b76a-87dd89b89823", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655771471, "uuid": "960fc676-0842-4b83-81ab-0d8ade2fe71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655771471, "uuid": "4274f207-f14c-4f47-a46e-226bd3721c63", "value": "SecuriteInfo.com.Variant.Tedy.114288.19033.19769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd970e8-f13c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655800453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800453, "uuid": "053a3491-1d30-4347-a8f1-372e15a28c3f", "comment": "Malware payload (AveMariaRAT)", "value": "9773d744fa3e475db9dd9fef3313373a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800453, "uuid": "88a6d8f8-d247-4b74-9535-6aeaf6fbcd55", "comment": "Malware payload (AveMariaRAT)", "value": "2b874df82f858897af1c8037ff41b217251d358a44bb27aca811ffffd7b7d1e7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800453, "uuid": "0705953c-396e-405f-a1f5-e7422450f211", "comment": "Malware payload (AveMariaRAT)", "value": "47172b568b191bf0a0ad0f849803f5b0b419a1c2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800453, "uuid": "fb04f779-8df8-4fd1-a999-aca16936ffff", "comment": "Malware payload (AveMariaRAT)", "value": "c34e7b5f4b95e1cee55a29fa4c01df5f297781ab57a3ac215b135bab7948a0c3b68d0beeef02b12351afb56f2b0c74f3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800453, "uuid": "d6cf6d3a-d478-4202-9307-fd3052eca2ce", "value": "T174D4E0F18AF4BF65E12E21727094217C37D34E1DEC41D6BACADBF84934A2AC164E4A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800453, "uuid": "cacb6ebf-8b70-4710-aa9e-e627d2d7a6f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800453, "uuid": "ac692b28-8739-4da9-945e-d761d9fec4d9", "value": "12288:mTvxEsp7lw5/7PgVTwgJCZv0DpkGCAW70i2MPI2acqSpFEb:gvxEKODghLYl0Nk3AW3SE7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655800453, "uuid": "2b2c82ae-1d23-41c3-9191-9af5b5aa6be4", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655800453, "uuid": "9516a703-0196-482f-8f4c-8be3d0ae9e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800453, "uuid": "41cff81b-3f4d-422d-9a09-601ba9e075cd", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22341.10005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364e1612-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655823338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823338, "uuid": "0b58c859-7a0f-43c6-8b44-381c3fac4d26", "comment": "Malware payload (Vjw0rm)", "value": "4e242d24414292cd483040d98077d9c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823338, "uuid": "1cb5998d-6a6c-4df8-93fb-560aa268427b", "comment": "Malware payload (Vjw0rm)", "value": "2cbdc90aff35e74892a04e4ce75834f0c419996330f15692575c1862781e63b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823338, "uuid": "31fe2995-8e81-4511-b05f-f2895c0bb23e", "comment": "Malware payload (Vjw0rm)", "value": "eb905837358a70d81ef596465fad195c4057a015", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823338, "uuid": "d3d78bed-d9f7-4f3f-8c1c-71cb5d7f704f", "comment": "Malware payload (Vjw0rm)", "value": "e45023a7ca969e1840f914f4db00b0d28d2aa90f77f187b8396ed158b6cf21f093ea2d504efc2a167c70ba79350f340b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823338, "uuid": "5f5a9b8f-637f-4b38-8581-0ab17e6c96c8", "value": "T13DE48C61FB841A9DB6980A8BE07D6D6E37F32B04C5E3B3CCB3A77547265EE1D6119800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823338, "uuid": "981aeb4b-6ad3-470a-8787-36dc128bd520", "value": "6144:TiArG8ZmVLfks1p9yEeqTe9gzDmSMuqX+qd/A2Nrn92kmIPYNyKDCg7dIzDt/fWt:r2V2qTecw+z2Oo0ygCg7dIzDd0xv81wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823338, "uuid": "75878444-58fe-4dc5-9c65-b0b43d7a7d7d", "value": 708361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823338, "uuid": "a0b28967-c759-4eab-a351-fb696eadfb3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823338, "uuid": "7bb7ae6f-05b5-4799-8aae-ddf6472acafc", "value": "Product Pics.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a4bfe9-f149-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655805868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805868, "uuid": "96e78cbc-c217-4e18-8c3c-f07b6dffe85b", "comment": "Malware payload (GuLoader)", "value": "c37e6f5da00efca227af3989fbc79748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805868, "uuid": "bfce9361-5d29-48ba-8295-136fe9b480cf", "comment": "Malware payload (GuLoader)", "value": "2cda831930601621dc9a9c659ae6dbf72d0f6a4511863a2b246a01b834cc5cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805868, "uuid": "126ab544-b323-4a8a-bc61-b3503f1257ae", "comment": "Malware payload (GuLoader)", "value": "4fea1f48f2600221e26e0b5dba88d9c7b0458324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805868, "uuid": "db741423-b62d-417d-9e34-bf7ba48a5274", "comment": "Malware payload (GuLoader)", "value": "1523f21eb8ab561435af0f7d5298fc3035cc512727f463329cc87c2284b9faef2f923691b4bb28a41ed7044c7fce05ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805868, "uuid": "31b6ecb7-1187-4001-92eb-0a8916075c90", "value": "T1B3F6D6F0F839FE47B366D438A424F668C6D91091E706D07AB03AFAA455B3390255DB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805868, "uuid": "98805004-9835-4464-aa59-60cbc9f9f0c7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805868, "uuid": "80a9eed5-2fa2-4016-abee-a3463bc5fb11", "value": "24576:OY460caLHHtHHinnQHHCnnngHHBnnLHHHCnnEnznnnCHHAnnntnnLHHOHHH+HHL3:T4Xc7nnnnnnnnnnHHmHHOHHHHnnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805868, "uuid": "79caa500-bcd1-468a-89f3-881b49e6c054", "value": 15868456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805868, "uuid": "f7caf6ec-4e71-4e12-adc2-d04a46d98db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805868, "uuid": "6e25f323-acfd-401c-8bb7-c31b0ba58513", "value": "Kyssene3.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5b2e84-f16c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655820742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820742, "uuid": "765b21b1-909b-470c-9092-bca051b7aabe", "comment": "Malware payload", "value": "8de218ad14cdda0dfee153cf349d9f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820742, "uuid": "c059277e-2bfc-4b3a-9f13-67c4f3852fb1", "comment": "Malware payload", "value": "2daa785895f9ff331c64230e56ec68944bdf830fc3dcaf75520fb284e5464612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820742, "uuid": "76d2a4fd-5961-4dd5-a9fc-1523830b531e", "comment": "Malware payload", "value": "3b4b689b9f30c651fe59112a266d796c553f53bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820742, "uuid": "ed2b56f6-b893-4a41-8649-07cab9c558d6", "comment": "Malware payload", "value": "eb89c5c68ab3d4f72683e21723ab98cbe0a9ef7c0e5c6ed2169170013a690068ce5985db3e4b0e9f897923b7ce5a8338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820742, "uuid": "e0006ad1-46b4-4343-8fae-83642670ed0d", "value": "T1744533285841454EF29483FD3E864DAC67344F84334E4652A6E8FBDE194E0762F9EEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820742, "uuid": "bd9f04d5-46b9-421a-bc2c-797b5fb67a71", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820742, "uuid": "7dfd4550-700b-4578-947d-4cd9468f0928", "value": "24576:z6+qigJW2hWmXwvYJXcgZ5opde873GfAuJ/x9DLGxjF:zTIW2/MYJX6pE8SfAuhfDGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655820742, "uuid": "bbdce0dc-4767-4b24-b57d-d1631f315d08", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655820742, "uuid": "d3979495-5bd8-4c49-b0b7-08ede97183e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820742, "uuid": "f723b63d-1da9-48ba-a922-2263e92885e5", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f9995d-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801807, "uuid": "534dbda9-f625-4a49-8bba-496868c5b684", "comment": "Malware payload (SnakeKeylogger)", "value": "7318eff7d3b5cacd185558cddfae2c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801807, "uuid": "c40b50fa-71cb-428d-8436-be97fdf72da8", "comment": "Malware payload (SnakeKeylogger)", "value": "2db5bcfdbe6f023d6378b26222f0cc7f4a47edf1ba6e9a0a313a72385e6fc899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801807, "uuid": "18c0f519-a385-4de7-b347-b9b2bd8cf6c0", "comment": "Malware payload (SnakeKeylogger)", "value": "a8e49cfed09f5953d7dab616878ece779e90c30b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801807, "uuid": "defab7da-b1b8-4e44-8b85-7eb6e33342ae", "comment": "Malware payload (SnakeKeylogger)", "value": "3144a9c9148ee5c5f482ba845b51a471ad6a0a97da795a305ce07aaacfd94e4ea6bb6e29fda6dca5df784437f53076ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801807, "uuid": "d7744892-9dbd-4b6e-a8aa-730d1c258876", "value": "T18AA4F104AA7C4762F93D8BFC48E2610193FC60269196F7A94FDA30DF9C67B018B51A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801807, "uuid": "27431044-6dc7-4965-bf02-0b7dc0f8ed05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801807, "uuid": "31d607f5-ed72-4f1e-a6d2-3152d973b984", "value": "12288:K2iN73wLd5K84wsnF6fX5iA+cECINedyArJT8:K1N+vKd9ngX5iA+UGmtT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801807, "uuid": "d3923590-2ca1-49da-8ec1-cc408cf9ae62", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801807, "uuid": "9d50f8a7-8031-4d7a-9f08-4764cf4a1dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801807, "uuid": "56ca3d18-9643-4c71-82e3-b4302c69f47a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6867c6-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854545, "uuid": "c4adfac3-fec5-4fd8-bae0-06cd8f7662b6", "comment": "Malware payload (Mirai)", "value": "95db1dc6f312c2d1a4c91e6d1f11c8f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854545, "uuid": "fa975ffa-552f-4f42-8997-853f7612074a", "comment": "Malware payload (Mirai)", "value": "2db7d7bb213ec29647f1e399912d5a35d332ccd04fb01cefd97b29a4e3392097", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854545, "uuid": "40120456-ff2e-4686-92b2-f2094cdeb4f4", "comment": "Malware payload (Mirai)", "value": "0ab9c9f80ce004ff6e43077a948f061b18a3b8e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854545, "uuid": "573b2a71-9515-4b15-a7ee-63e4134dfca0", "comment": "Malware payload (Mirai)", "value": "c4d6405ad260e33bdb12bd32bd8cccf6aedecfaac016f64dc673aca4ab296fdcc00f211f2ba668c1167349c62e25b7db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854545, "uuid": "ea34a2a6-341f-4900-a8f3-f86ce9465d40", "value": "T1E4C2E168D9C36C63D3349D3D76F98A47666F9BFC50DC353E2B0546E5DA820104BFA10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854545, "uuid": "d9b15655-9313-419d-a421-44feefddc96a", "value": "768:5B63tbAuOjkQfXItUzb95Cg7iTV74Hss3UozP:jstojhvIazZ5CgWpQpzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854545, "uuid": "67b3e9a8-c93b-4ba8-80b4-0bd25aee5f89", "value": 27600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854545, "uuid": "6de3f46d-c87a-47ae-a261-bf51b18b8bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854545, "uuid": "684d1b98-ab0b-4b54-b834-222ec5215a7a", "value": "95db1dc6f312c2d1a4c91e6d1f11c8f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0e2e8f-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655809707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809707, "uuid": "e921bbb0-d1f0-4dec-adb6-c0e3e9ec5e0d", "comment": "Malware payload (Formbook)", "value": "5424f2ae032c7e5bf9a9262264e026b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809707, "uuid": "805ed807-b10f-490f-bc1c-71e523af3314", "comment": "Malware payload (Formbook)", "value": "2dfeb829c78dc22c561ba638169661d92c8d99b23d624dfbbcd36b95f26cb9c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809707, "uuid": "973494be-7b03-4c46-9ee2-ca35d214b054", "comment": "Malware payload (Formbook)", "value": "34aaacc7d282803747f257d4b813fa94f28763b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809707, "uuid": "f5ebb0b7-f344-40bb-bf0e-1751bb460a8b", "comment": "Malware payload (Formbook)", "value": "b4d05f4009b460be8b5015606e566ad466038489b8564c2c4a13a7b11925e7fa919da4939957ea6fe7bbf4879c9b97f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809707, "uuid": "2de6cf12-35d6-477b-acf0-1cbcdf4e8c29", "value": "T14534AE953DFC00B3E4F628378CE695221E1BAEB20A2C505B97C5E98B757C994E00F59F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809707, "uuid": "2e7ffb9b-201f-46e2-b93c-f5d8d27917f6", "value": "09876ad8ac5cf1f5f38f35bc6647489a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809707, "uuid": "74ae1c6a-2e4e-4315-93d1-34b8f3772217", "value": "3072:emyPROh4GyW5ANmk+A8jtrBaKZijSLmsgarIY/kuz01S5PowHooWYKj1iIHn2nTH:emysSxNmsmijSq8Iij0MKrpiIH2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809707, "uuid": "ffb7d199-27c2-436e-a844-61a0e00b0f9b", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809707, "uuid": "94e8d95f-962a-443d-8828-03d775de5c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809707, "uuid": "40d7046a-5ae6-4606-bf6a-d2be6acc4153", "value": "5424f2ae032c7e5bf9a9262264e026b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332494c4-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "6c3e0ebc-1aa9-49f5-9a69-39642694a6a7", "comment": "Malware payload (Mirai)", "value": "5cade583b82921a1d81185a5916eb6d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "096972ef-bad0-4be4-85f0-8a1f8da06a89", "comment": "Malware payload (Mirai)", "value": "2eff308133840e3432f9fdc34bc2ea319671948d4a4a80c9ff5261f35167b949", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "2e8c2e51-5bcd-41d7-911b-337bf3e854a6", "comment": "Malware payload (Mirai)", "value": "e7d7eb887ec34ab2a60c90f21fd2dd3a504831c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "6bbe23d6-f408-4ea9-96bb-118db539504d", "comment": "Malware payload (Mirai)", "value": "fb8e0fd028692c71d0c0555b8f9052cf72c37340f0c98fb66d7703166af39ebfa1c60782b6b1991a0f303672682952bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "57139a3d-a440-4ed3-8039-12ed832bc6c3", "value": "T189B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "61697f6f-8a23-4af4-a59f-e612b6c3ae7a", "value": "3072:MSY+46m1qOzss9FPPKNy+AmkZrQAhPDCXFke:06mgOzJ9FPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "4b504ef3-fc1a-4b04-bc2e-81bde45043e9", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "d239bed8-5d61-484b-a501-1c03e9f9aa31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "bd24171f-582e-4163-93ae-5fdab2a8fcd0", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da7168f-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655806170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806170, "uuid": "a91f3eab-3e4d-43e0-98a0-913501febcd8", "comment": "Malware payload (Loki)", "value": "01d1f797c05acda61e10c1dbf830e5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806170, "uuid": "8b6caa82-86e1-4064-910a-4194b04d70cc", "comment": "Malware payload (Loki)", "value": "2f370d4201e18eec58daba5effb25836788d530f747ebaf7593b3457d3d0c743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806170, "uuid": "42f34e00-fc6a-427e-8b63-c6df4e28fa81", "comment": "Malware payload (Loki)", "value": "6b4a210bc77a5fb2882c05c9eb5a8db29acc3093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806170, "uuid": "a0f9ed51-0867-471a-a0d6-cd58a6038508", "comment": "Malware payload (Loki)", "value": "e3b1ed2b18d27c122900e7e117f5404f4b49b0beada5f10fb3cbeaa9a4f514c207e92bcfcfef79d744e89fcff620a7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806170, "uuid": "3499e322-4224-4973-a377-02c2758508c2", "value": "T1AB84CEF59EF4B9A1E43562B770A4607C77D35D0EDC55E82ACACBF04A34A26C260E1E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806170, "uuid": "2277a20e-b2a6-4ed3-a23f-f91fccd8c382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806170, "uuid": "d03d082d-6e8e-468c-a5eb-3fa06ebb73fc", "value": "6144:ozTZP4wJIuGfiv25TEiT7FxhkOp55Iqd/o7G+VpNAOMF7eCuO0U:ozpvPG6gEKd5tp/oy+VpNXCuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806170, "uuid": "542e088f-5381-4896-a801-bd3f45e0f790", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806170, "uuid": "a8985ce3-fba8-4d34-88eb-787e70c4c31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806170, "uuid": "bc543c93-69ef-4e0e-8e7a-2f1c4bcdf322", "value": "_rundll32.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc350e94-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806812, "uuid": "4d6d4a91-b6b2-4b72-a636-c11e73346d5e", "comment": "Malware payload (Formbook)", "value": "69efd2080a9d62fddcaaf1b76e123c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806812, "uuid": "f0476404-6071-4bec-86ca-a8e39556aa11", "comment": "Malware payload (Formbook)", "value": "2f43a94ed8cdf1891e4f45eedfc41247781fca19cd5047a4a95389626789e129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806812, "uuid": "eb47793e-b0f4-49b6-a740-062184810da6", "comment": "Malware payload (Formbook)", "value": "579eded7746f2a7d699c723c2b290c2c55d688eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806812, "uuid": "ef401fc5-d647-4e9e-b56d-bc5e9496ef3a", "comment": "Malware payload (Formbook)", "value": "d28356ece7907412ffbe671ff4f6205ee0241346331d9521a9a3d0c535f1163aecb9af7b8d289d155800dc364eecd189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806812, "uuid": "336cf311-85b3-4d1b-b34c-b7588a6a5477", "value": "T11D23AF0BE66CCA60C6E49F7EC9D3D60007B0E4D66C16D75F71492F422E1BBA9C94172E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806812, "uuid": "4f436798-a238-43ef-8815-df378dcfb6ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806812, "uuid": "746efb16-965d-4bb4-bfa0-785292a79ec0", "value": "768:MD89ON+tnOpdh9HeWCuk5w79Nf7oSFYwQjXvLWRgcL0ST8iNxy2s:MD89OBBe/J5gf97QWRgcL9HNxvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806812, "uuid": "74a35ff9-5853-45fc-ba09-5acb1ee9501a", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806812, "uuid": "b488bf56-13fd-49f1-b8b0-89854ae58647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806812, "uuid": "50bb6d13-862c-4b3c-9928-9bed892f145a", "value": "lov.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dcc404-f10b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655779042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779042, "uuid": "2c0cfc25-e43c-4808-b398-d5f30f3303dd", "comment": "Malware payload (AgentTesla)", "value": "c8a25e0b92818202b9234e50b2c1a6c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779042, "uuid": "55fc60d3-885b-4268-9b55-a0359d1983e9", "comment": "Malware payload (AgentTesla)", "value": "2f6e373efc63922d90b62bfbe8ea4b5d0524f5f12d2f61fed3c605d7e3dee33f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779042, "uuid": "405238af-b9a4-4997-90be-bd83139dc4c1", "comment": "Malware payload (AgentTesla)", "value": "86235f981feef1db66c0b624dff652dd56b42e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779042, "uuid": "5603c99d-b10e-4913-b56f-b81c7a59f0e7", "comment": "Malware payload (AgentTesla)", "value": "959b8a1c038646191b3284c0fcb05a1eb195cfe00ab69eaeb3b5a97be9ca5f0423c987d83e0acd650990f4deee7e7d55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779042, "uuid": "7cd27ea8-7b56-41d3-aff6-d394413edaa0", "value": "T1ADF4F14522E42959DFF24B3EE4E6110EAB36FE072340DE597D4C903A962B7409AE3737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779042, "uuid": "13b09369-e327-45d4-89be-d239cc2e6756", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779042, "uuid": "9dd1b9b3-0e5c-4a3c-8164-9a64a8845648", "value": "12288:WhUN98m4E/hW0L8U54FpgcFPsbAr2TeujJzxTRsV+MfKt:+LE4a8U54FZZSeulVTRsVvfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655779042, "uuid": "fcbe53e7-31a8-4925-ad9c-917729561911", "value": 727880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655779042, "uuid": "5d512a99-c499-4fb6-819e-a8d636d39bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779042, "uuid": "906504f3-b809-4c93-bce9-e10bb810babe", "value": "SecuriteInfo.com.Variant.MSILHeracles.33736.31374.7743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53c8ae9-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655793513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793513, "uuid": "321fae29-f5fc-48ae-abbe-0af29bb69ee0", "comment": "Malware payload (Formbook)", "value": "f7f186620e0ea9f4278baaf94533b6aa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793513, "uuid": "41cdf97b-accc-4bd4-b4d4-ac5ba5d3126b", "comment": "Malware payload (Formbook)", "value": "2fd76f5bd73eeec44ca3ef9a2783e496f66b07f0b6b814f0046ec3aaeac6f911", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793513, "uuid": "a30c5208-2dba-488f-b8c3-15bbe1abe993", "comment": "Malware payload (Formbook)", "value": "e96fe532994934680e3f5095ff40555ce3c710a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793513, "uuid": "8f5abb38-bd41-4643-b8d4-5064b2936bff", "comment": "Malware payload (Formbook)", "value": "c4b18b059c3440441c2ad78ffd4ecd3b8ab0a6aa35f7dbe9c401d8e49517efca84f58522ba3cbf190f9101030d3bb5aa", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793513, "uuid": "68159579-3d91-4fec-9b45-798bce9062db", "value": "T190046B5FED00AC8CCA7509FB2B35C3006D687E56AE1F46DD238CF68B8272545662C6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793513, "uuid": "fe703af2-fce4-438a-b371-8a30979dcdff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793513, "uuid": "d1d8e7e3-4a44-4522-8a34-a82e02ae1c83", "value": "384:RpooUa13f9lt6nfg2nECy83Gj6htCiXzNXNoqjrooAz4oxXZSK:cja11E9EULNXNoq/ooAz4oVZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793513, "uuid": "4ac433b5-6e99-447f-9706-1df6ba9dfed3", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793513, "uuid": "7d097e7f-f877-47a0-893a-68883386dc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793513, "uuid": "d38ebc65-e09a-47bd-8af0-5cab328ff526", "value": "bank-info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9bfe32-f19b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655841203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841203, "uuid": "3eea7c36-b764-43b3-b9fa-ba431b116789", "comment": "Malware payload", "value": "0a40867418d1c81d3b4a6a7f6d5b84af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841203, "uuid": "1ac08317-c1a6-42c0-add1-1f1dc7b759e5", "comment": "Malware payload", "value": "306be28465d999ceaf119fcd5d5a120d59d68beca4183369f5a3a3e1b0d9abde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841203, "uuid": "eaef5df9-fb15-4caf-82f3-debb701c9b46", "comment": "Malware payload", "value": "436d78fd912b6db2f7ddd8c1502a579b16b6806e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841203, "uuid": "abe98c36-d293-4c26-bb18-ba6a1d0fd307", "comment": "Malware payload", "value": "c95f79d5e7e1e0c9d81db170ec657842584a8a1de8382914e87ba6fa3fc923e0aa9658b72bb2671452d1a869dd67b5eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841203, "uuid": "6f35567a-4d35-4388-80d0-890d300b5b96", "value": "T18374BE00BA90C435F0F711F889B69368B92E7AE19B2850CF52D466FE57346E4EC3275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841203, "uuid": "c5fc014f-25fd-4f14-9d5c-d32f760186d2", "value": "dbe7c866442b2c90ddc4d147097c4eb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841203, "uuid": "2e6d193c-f5e3-4d3f-95d5-23e9d0fb55b3", "value": "6144:LbVN0auIu9z5tN0hR5WuGMDW9nkk10CNqEPiWNqQuhWyDFJNLhU:LbVmauR5tNUjWuT8kCJ2WNqQuhpXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841203, "uuid": "bbbb411a-e6c8-47f9-9792-6529642c1bd8", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841203, "uuid": "146f50ea-033b-4333-abd3-89d8d54306d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841203, "uuid": "36f1271a-bb3a-4e8c-bc54-e02c36eb0fdf", "value": "0a40867418d1c81d3b4a6a7f6d5b84af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4f3ddf-f1bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854620, "uuid": "0084f7a5-d1fb-491d-98f0-f01fb00a16b9", "comment": "Malware payload (Mirai)", "value": "ce052360fa4d58bbebbaed045cffaf86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854620, "uuid": "6b992116-5762-47a8-a83c-1ba481d819aa", "comment": "Malware payload (Mirai)", "value": "30ae18d8af7809e23c9aa791e83bd4aba62bd4e5458374136a59149680204a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854620, "uuid": "a14670dd-3b16-42cf-9113-96703720b86d", "comment": "Malware payload (Mirai)", "value": "b94142149f4f126276cc3f416544b4eda25ec0ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854620, "uuid": "974cc543-142c-4edc-82e1-7fb42248e2d2", "comment": "Malware payload (Mirai)", "value": "fcc0885aa45ef99fd835dcd21d0ae1aa3b3592a9f1545975c22311ae90a3cd0568d4999edaa7d4db172b2b0baec2360a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854620, "uuid": "9bf31178-f296-4a27-96cb-5555e6126492", "value": "T17FD2E0EDF608BC93CCEB58F7B28913E6441853C136DF426A23069A803FF8581798A176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854620, "uuid": "d5534b47-9b42-4f03-9376-233bc5e87276", "value": "384:e/jETW7r1lp+CheD3yli0izTw9CVtteI/QmSBaCfJnLtrXaHIMNW7CRWGVCz0Nvu:kD8iliDTwsntf/zSBRBtDWIMTWUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854620, "uuid": "96883fa5-09cf-4491-b2cd-d8a90c2a902e", "value": 30984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854620, "uuid": "a996c0d2-c593-4f7b-a800-24ff7abed7f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854620, "uuid": "2a509520-e2c5-4b39-8b29-dab37f520252", "value": "ce052360fa4d58bbebbaed045cffaf86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a2389b-f110-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655781479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781479, "uuid": "f8173faa-e944-4116-835c-3d89853b8453", "comment": "Malware payload (AveMariaRAT)", "value": "d6486d103e7fb9110971204e03d2dc61", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781479, "uuid": "98066ff3-891e-459b-a991-bbd4fde8c56e", "comment": "Malware payload (AveMariaRAT)", "value": "30e1b2fdb865811863c907ee77ebaa60a9394396842273f23c84b531b579dc58", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781479, "uuid": "2ce23900-cf2f-4a82-aaa1-4c91fde7b3be", "comment": "Malware payload (AveMariaRAT)", "value": "3ffcc0284f6d26cf141082378c87a71bc86f823d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781479, "uuid": "2c77b2cc-b24a-44e0-bead-fc141cf59dc7", "comment": "Malware payload (AveMariaRAT)", "value": "195bb6cc9cffcc85984ca9c9c2b694d22e3dad2f25b3e4b5145eea25fd94668ebb88d7435cd8e6473cbae787c155011d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781479, "uuid": "a9665d35-ce07-4f66-bc94-c66c3b2ff28a", "value": "T10692D50037A89B37D97A5BF428B3450007B1B62AB966EB5D2CC970CE1E73F1446A2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781479, "uuid": "f885a4e1-c096-4371-9d80-a756edc56ca0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781479, "uuid": "3e9b0098-bb30-4758-ac53-b1aa0dbf5372", "value": "384:VmulY56oblH37/MaoHaWy409dxznDNNGQ+CG0N78akoPZur/HoNkjvisIQNzffgC:VU6oxHQeSziE+GYsISkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655781479, "uuid": "faa4e48e-9f64-461a-8b86-3b74eba26a1f", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655781479, "uuid": "b46386f2-7ba8-40aa-a3d5-94e285d5e6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781479, "uuid": "ddfc7a10-c2f8-4887-9367-235e8cddc598", "value": "06202022-excenes_PO-025194813673839029122-9692001343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2528ff-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655825471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825471, "uuid": "993a9341-a41f-4c20-ab91-2ab66416a6e6", "comment": "Malware payload (Heodo)", "value": "d56594691593feb83025d0a7d172d001", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825471, "uuid": "85995620-5b84-410c-a3e1-ccbfb67ebc63", "comment": "Malware payload (Heodo)", "value": "3108b202cfe4954b757f119f1b8e2bcaccf3eeb7b286bd42fcec9d64f087c401", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825471, "uuid": "4835aae2-417f-4414-bfb5-f08db0ec25cb", "comment": "Malware payload (Heodo)", "value": "d0eeed9e1eb804e49f7dd65ff789ada439dcb6c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825471, "uuid": "83b652be-45ed-4cbf-8864-f1ab47b39968", "comment": "Malware payload (Heodo)", "value": "ccc0abe2b9fefca353f1fcc195d981b6b45f42b7db1700e0d30ab8ab0c668b67c013fdd36dc9fc5dc740ac0190e0f1cb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825471, "uuid": "47316e29-b00d-4d91-9c3f-8e395091d396", "value": "T154648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825471, "uuid": "59d15373-8d4b-4ce2-b0f1-f9218bfbe9d4", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825471, "uuid": "aff9712a-146a-42be-8237-18115992aeb6", "value": "6144:JqdSTDcHe3kjHfNsQnkXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3kIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825471, "uuid": "4b6641ac-7699-42ea-8212-02f5a4ace25b", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825471, "uuid": "de3dbde2-c092-44bc-9da5-e58d39dc7a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825471, "uuid": "5a9beab5-dcf8-499a-822b-fc3da4f9e627", "value": "7HsqEduddHVHyF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd086dcb-f180-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655829684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829684, "uuid": "7e6f8824-bd67-4183-b7ef-4f2deb25b925", "comment": "Malware payload (Quakbot)", "value": "75ed203aa9e7908a314d9043e6e19ae1", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829684, "uuid": "21e077e8-4c54-46a8-9b0c-0d504a72c4c6", "comment": "Malware payload (Quakbot)", "value": "311730a296273acfbec85799b25f23b4698c8cc532ca2028a55f31c8b0686b03", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829684, "uuid": "d0910428-b06e-4605-8ff0-6d6ad0fb7b2f", "comment": "Malware payload (Quakbot)", "value": "d3eb3788a2e24a08c8181b15ea80ddbfb24eb055", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655829684, "uuid": "558ad418-0243-427c-bf0f-d9b1c396d385", "comment": "Malware payload (Quakbot)", "value": "6e6fd3be9cf5ba66493b4d4f89da20bcab36934c30641697110be589f7194d3255731aa86c6cc07cdf5d135d8bac5739", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "E98346", "colour": "#6FDB7E", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829684, "uuid": "152090b7-9a11-42f5-98a4-16c4374e4e45", "value": "T18A2141A1C6ED22D9CB6E37F1F01A1F29584323CE008F642BA5E82646A19F0C53532B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829684, "uuid": "8582ba2d-89f6-4685-95be-f5721fe00b47", "value": "24:nyul/G6fiaMqiKQDB2qKNQmxtbbmEnx5N/8WbI/s1x7l/6Y:y2u6qaiKQD9K37N/JEexJCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655829684, "uuid": "b23fe9b6-86b9-41db-b99d-da991f6bd56f", "value": 1230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655829684, "uuid": "41067861-499f-4c85-904c-211aaa1fcbf3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655829684, "uuid": "b0193b77-b1c7-43d1-b762-1dc1444179c7", "value": "reiciendisperferendis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd11176-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1655831994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831994, "uuid": "de51fc64-d914-461b-92e0-d1c7f660a629", "comment": "Malware payload (BumbleBee)", "value": "44d59a1217ca98cf3dc0e4057b49b9a3", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831994, "uuid": "e96dd858-a496-4a58-8561-2b9ac741a07f", "comment": "Malware payload (BumbleBee)", "value": "313033a2d5bba8af7df75a0ff8b5b94cae7dbd074c1936a849050fd585aab969", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831994, "uuid": "c3c5b7ad-3970-4376-bbc1-569ba94b0b7c", "comment": "Malware payload (BumbleBee)", "value": "05c25930700ee4dcb99115c799039f9c686ea8ef", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831994, "uuid": "3d68875d-5278-4738-b3a1-16ec859aa9ff", "comment": "Malware payload (BumbleBee)", "value": "2493961763a427a93e0684318ac3770f9153fbf5d90dfbe9d7065a4f14b2c176922ed4c6af1038e4b7e9ee0a3aa5820d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831994, "uuid": "9e9b7318-05ae-40a7-ad30-276553caa435", "value": "T11575F1E3016D80F6D7D770B8AD4A4BD26949BE78D2CCB7551260CC62FF9A227908DF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831994, "uuid": "27f229c0-124a-4767-96af-9d51db001ca0", "value": "36f1284d8ec9124f75b516e003ff308f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831994, "uuid": "a4827bc4-4ea5-4832-8f58-72be17247195", "value": "49152:Zfu1o59KYdxdXGLo5RXTAh1MTjpDlzjQw+GLRE9p:Zfu11MTjpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831994, "uuid": "da700a39-f6f9-44f4-bdf8-090c3f6da351", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831994, "uuid": "23ffbf53-83db-4a95-a101-086ddc8f839b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831994, "uuid": "99706834-27d3-4d2a-b57c-151ac402ddf2", "value": "s3negar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5840df-f1b6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852661, "uuid": "54f463db-32fe-4fd8-9856-4d6b63f5509d", "comment": "Malware payload", "value": "1413dde9657bfbc58c1d216d193f9696", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852661, "uuid": "a5a2bcac-3e58-4cb9-bfea-c4ffd8b1b26e", "comment": "Malware payload", "value": "3152b0c1941c0cb14c1fd18d6451c7fe28d49887c97873e208d0e108d04f3a0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852661, "uuid": "30a98b82-428e-413a-bc2c-82b2cdf5889b", "comment": "Malware payload", "value": "3055fa7024cd7ffe8f957e748288731bdcd03569", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852661, "uuid": "1b1c5785-bb8b-47f1-9c97-736df302b010", "comment": "Malware payload", "value": "dc39394ab26ac899319501ceeb07c4031949e532cf920fc0597db01b733a7b69efbac630e41dea68d6ade3c5a10f3bbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852661, "uuid": "6edc99bf-b7d9-4f11-92f8-dfb9ad07f694", "value": "T16384BF00BA90C435E1F701F45AB6936CB92E7EA05B3454CB62E56AEE5734AE4FD3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852661, "uuid": "00589e2b-47a3-43db-8c40-009419b8c57f", "value": "dbe7c866442b2c90ddc4d147097c4eb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852661, "uuid": "e92fbaf6-fa1e-4056-8fc9-3eb84d75954f", "value": "6144:GXr3KxufubH+8gv7HBMKmOwL9ATSlNfoFzY0ihjYLm9nIUDd/+vvqcB:GXrax1r+8gThMKBHuHcUVjYEn9Dd/oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852661, "uuid": "f61d6292-cec5-4f7d-aaa0-7f75fa02ca4e", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852661, "uuid": "16fad36e-21c1-451c-9541-439ea148b7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852661, "uuid": "a81a050f-296e-43ae-a318-9242113f568c", "value": "1413dde9657bfbc58c1d216d193f9696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058aea60-f1bb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854609, "uuid": "be925ed2-0cc7-4cd0-bc17-688582f2b310", "comment": "Malware payload (Mirai)", "value": "faba095c4ef8fa47c42bd2cc23850b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854609, "uuid": "68e25562-9fa4-4f53-a22c-680b16cf98ee", "comment": "Malware payload (Mirai)", "value": "315a49e0d6bf7c6b53b23029a1092867b5c41ebe3da508ffe5b47a082c4529b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854609, "uuid": "d7bc08ac-7242-4810-acad-b5de03fa61c5", "comment": "Malware payload (Mirai)", "value": "98cd8f736b36776c35b658bcbdfae07c4d38f9bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854609, "uuid": "f31b23af-912a-4976-a280-5790c1b38626", "comment": "Malware payload (Mirai)", "value": "1d2c80947a294967b71a80a99e4e00a3eeebd2b84814641fd8bc3807a5ffd4ea3e70d90edf066c9a82c98cfe12573969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854609, "uuid": "d6d231e1-f2f7-4ab6-9482-fb82b3ccb4e6", "value": "T1D5D2E1C6FEF22C97C298E030CF2584AF179E5021906F6B765A48401BCE6F3579C48F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854609, "uuid": "2c5819ec-b8a5-4fd2-95f1-58c9fe7bc502", "value": "768:CjsX3BDPU1cZ4S2c1qiunhs/M5TIEtMaIr9915Fi:CjsX3BDPecZ4tdi9/uer991+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854609, "uuid": "908b44aa-2e93-419b-bf0b-3f55fc5530f5", "value": 28424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854609, "uuid": "7bfc5226-b6d5-4db3-963b-a5fdafec11c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854609, "uuid": "7acdb818-c99d-4ffc-b66b-87cbb646071f", "value": "faba095c4ef8fa47c42bd2cc23850b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568b9b1f-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (MimiKatz)", "timestamp": 1655808789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808789, "uuid": "f8a54b80-b66a-42d8-a4cf-18d9891ef629", "comment": "Malware payload (MimiKatz)", "value": "a3cb3b02a683275f7e0a0f8a9a5c9e07", "object_relation": "md5", "Tag": [ { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808789, "uuid": "8ca79766-ff2f-484b-99c0-c3060e7e9bdb", "comment": "Malware payload (MimiKatz)", "value": "31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc", "object_relation": "sha256", "Tag": [ { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808789, "uuid": "fdf30c3e-38bf-4758-af7b-c28a63e09eef", "comment": "Malware payload (MimiKatz)", "value": "d241df7b9d2ec0b8194751cd5ce153e27cc40fa4", "object_relation": "sha1", "Tag": [ { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808789, "uuid": "b384e822-bdbb-4fef-9f4e-92a8384668d4", "comment": "Malware payload (MimiKatz)", "value": "a614b9950deb2c90ca94ddf7ee448e198173eb61b7eda6b91699b09a5e8d0a2cc3f8145b8912697c8449f158d86da76b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808789, "uuid": "0fc2202c-dbec-4e19-8f8c-5dc6b93cb430", "value": "T16A551801A7E90098F5B79AB59EF29516DBB378D61834C30F02AC875B1F73F619D29322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808789, "uuid": "db40047c-c3d3-4254-90ad-bacede27b770", "value": "dbdea7b557f0e6b5d9e18abe9ce5220a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808789, "uuid": "5e2a38d7-f8ca-4e2d-84c4-f55fdb78e99f", "value": "24576:XOzE5EJgB1alEruZrnnDGgMsnPjKesPbqJgUe8MAm4rCNG/:XOSwrDzLj5O2JgUe8M0n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808789, "uuid": "079441d4-1a0c-4e66-9555-4a81fc27dfe8", "value": 1309448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808789, "uuid": "78027f1b-a67c-432b-81a1-2b92ac59ebe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808789, "uuid": "d3724b2c-f126-4c1d-b3c4-ee335ee72bb0", "value": "31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9b1ce8-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807990, "uuid": "3a83ca89-5b6c-4758-bb17-576b52164b93", "comment": "Malware payload (BlackCat)", "value": "84df9c44f3c262467e172b20a76a024c", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807990, "uuid": "f8733ef3-840d-4b23-8af2-06bf308d67a5", "comment": "Malware payload (BlackCat)", "value": "32304c278117353bd112132323055e113b62182d1efcc83abec1e736cf8da9e1", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807990, "uuid": "928c53b9-6ce2-4dc2-b2b1-c814503cc66b", "comment": "Malware payload (BlackCat)", "value": "e24e15d81589dedb9fb25e71d5da775845433aad", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807990, "uuid": "5fff7847-ec90-460e-9ebb-5c6b8ec68c93", "comment": "Malware payload (BlackCat)", "value": "5903fc2a12dcb0f5a3210da720f01bc85a9260355e3219656ec5e9b075a38d70e0c99f28fe86045a4b6544e72b5047e0", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807990, "uuid": "e28f47df-a196-438a-8351-f8c25e5a89e6", "value": "T101E5AF95FB43E2ADEDAB1470345EB33ADE34481C01199FA3DBE44D71BA2EB111E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807990, "uuid": "3639ac5d-7195-48af-84e8-1ce35350c051", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807990, "uuid": "6d56e125-9c79-4300-8b39-db27292aa403", "value": "49152:BQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNk5eBZw4KAzQmy7:eO7xei83ksPBqancABK4KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807990, "uuid": "7602793d-1e49-404a-a670-f3959a3b77ee", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807990, "uuid": "38bc6eae-e0da-43e3-ace3-c792d7058191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807990, "uuid": "73162b6d-0dd9-48ff-8e87-a0ce77361026", "value": "32304c278117353bd112132323055e113b62182d1efcc83abec1e736cf8da9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7d3da4-f167-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655818600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818600, "uuid": "d9052b00-e00b-47c6-b718-072674ead092", "comment": "Malware payload (Formbook)", "value": "b3686fc772390a22d5820cd9a2b49f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818600, "uuid": "1eb76c3c-9815-46aa-81fd-485cfdeb6c73", "comment": "Malware payload (Formbook)", "value": "339b554a5b390a79a79e2277675c729bbee07a57ee441a2a29cb7166e081f090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818600, "uuid": "ccd7f2a6-9fec-4660-8b3a-bc48a4f246c8", "comment": "Malware payload (Formbook)", "value": "ef2c23eff30b99e9f9bca2b456ac85e8cd4b1bdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818600, "uuid": "44725a51-5dc7-4a1f-8da2-e50180d10c62", "comment": "Malware payload (Formbook)", "value": "520619f08503fe0fe755e80c08c1df9890907409a2d8ce016acebdb27cebbe66a6825d605fcaf711e225e9f8f2aff82f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818600, "uuid": "0302ddf5-d359-4ae0-ba4c-2b4f1ab18dc2", "value": "T15C82C76DB3981BB5C93FC335A97206809524F5532E32CF8E0BC349095EBA79B524EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818600, "uuid": "8894abef-c828-42ac-8984-61fb17fc0f92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818600, "uuid": "8bc47c39-388b-4677-b44f-d8408881a050", "value": "192:msX3xtVIZozw1nG91m/l4dlMWW+Be4KIJJICtTermBvc5gPR2ODJW:msXMozKLWnMcBeGJSCiWU5gPR2ODJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655818600, "uuid": "f44f9e11-f325-478b-8ff6-eb1285861e78", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655818600, "uuid": "11e500e2-3b07-4d1b-92bd-659b0e5b7e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818600, "uuid": "70ee3920-0c11-432b-9cfc-972c7681362a", "value": "SecuriteInfo.com.Variant.Tedy.147471.27671.159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e3d3cf-f129-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655792009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792009, "uuid": "5983f51b-8e52-4230-95de-47bcb20e01cb", "comment": "Malware payload (GuLoader)", "value": "23ef97be3d29d4937c96cf6b621f3d8a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792009, "uuid": "5635ca25-07b3-4d07-9219-31e5da3dda5b", "comment": "Malware payload (GuLoader)", "value": "341cfc3e6bf0c1e921ecd2a03006c6bd171688221cbc8e6a4aa85072b1e6d8b7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792009, "uuid": "34bdfb60-89be-4038-b4c2-43a22dee75d0", "comment": "Malware payload (GuLoader)", "value": "6c9f1b786af4cfaff05cb9066a6dbf44f40314eb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792009, "uuid": "0f635031-6210-4031-ba8a-bf02dd7d64b9", "comment": "Malware payload (GuLoader)", "value": "50524bdb249fe2a0ca84e64007d88ec862710636a5fab6519342817975bddd6ce1363ca14bd8e6012b043c853cf3d694", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792009, "uuid": "58672ba5-d3eb-4a02-aa1c-c72a2eefed34", "value": "T1505302B24604952BD186FDA501870FAC13C15DF79B49B9E9DE05CCA6BCFB443A0E5383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792009, "uuid": "e1396987-99bc-44f8-9312-25ac25059168", "value": "1536:MQolYX1RW5+FklEKmjMfYyFFTsIqtoJEz6F9rzCbJq7a:MbYFRW5J9mMXwSE6F9KFq7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655792009, "uuid": "170f1c0a-d492-46c0-83fc-9844d538229b", "value": 65830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655792009, "uuid": "1c251386-c502-436f-8e4a-e87b5ac68a30", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792009, "uuid": "baa0cd7e-4eaf-44d9-a60c-ae9de7d7447d", "value": "dvblindet.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a76ac1-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655799640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799640, "uuid": "8155f7ac-cabd-4f35-af7c-9544ee9e58cf", "comment": "Malware payload (Formbook)", "value": "d3f60231b4a3c60f3546c22dd22bd826", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799640, "uuid": "a6938b84-0b7b-44ed-8fb0-530c6ca40345", "comment": "Malware payload (Formbook)", "value": "344c94ef6c05cefb4f3f36497f4f9ccc039ef43afbd39d1b6f239169c53d8df4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799640, "uuid": "faab1bf0-acca-4418-b6bc-97229e41c3c2", "comment": "Malware payload (Formbook)", "value": "9965530e0e3299d0ed53a6cc7849e256069fc4b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799640, "uuid": "4d28102f-b2ec-4323-8753-07381d685614", "comment": "Malware payload (Formbook)", "value": "49d338b2f655ab7a401d191f0665fe57e93825fa032606b677bc8f632e4786c6ad4d13a95fc423e587e0d6070640aa01", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799640, "uuid": "08741b32-a3f6-424d-938d-8e666a324c03", "value": "T12B83E17C1764C718FE6A4BB4E8928A272B543F31705EA8F7D109F68E19FB61CE061831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799640, "uuid": "d6d04e23-af30-464c-9d5e-9ac8919aa27b", "value": "1536:G3TyfRg1W1DhwYMfxJXDMM47nvbaLkbWfGjcsK1iQWY6OwC2kfsZb5rsbwg:Gjq9twYMZJA7nTaqSArKTWkfsZbOwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799640, "uuid": "263e9a4a-f5d1-4688-a9d6-94cc6daa13a2", "value": 81544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799640, "uuid": "178f4be2-8c2c-4ffc-90c4-620e7b2bef91", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799640, "uuid": "e938d32c-dae3-4197-badb-1450cb21ad1c", "value": "Fawaz 2100355_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4075944-f191-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655836943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836943, "uuid": "98f8a614-1c88-4a3e-a8fc-d553385e0faa", "comment": "Malware payload (RedLineStealer)", "value": "8d206daf11b5ae188df6dbd62c855935", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836943, "uuid": "3978dd93-3288-43a7-8789-9dd72bea9119", "comment": "Malware payload (RedLineStealer)", "value": "34bbdb8503c24115948bc31e7bbbe7a266d15dd511bc5d10227d53d2246e19fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836943, "uuid": "e99e8fe2-2384-48fa-a54a-794165bf9609", "comment": "Malware payload (RedLineStealer)", "value": "c0e6c2d0258ea245079c5386b5632a7299ea28eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836943, "uuid": "f8e69e0d-ef2c-4944-b6ae-c3e225436bf2", "comment": "Malware payload (RedLineStealer)", "value": "fc2e9d872cdec0231e3685100dc0147e5262e9a699293c6b2183633b292a63f506ca58fab4046dbc0f908a1ae8f8c621", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836943, "uuid": "8120075b-21ce-4e75-afb4-2a850fc76067", "value": "T1D0349D4376009BFAC9664B32F51FC19023709DAF5B51471B36DAB7256CFB39B8D2A201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836943, "uuid": "5f4d1cf5-605a-4c01-b424-2262cfcd810a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836943, "uuid": "d6377688-2eeb-44c7-b7dd-d2ef918510c9", "value": "6144:LT7hn6xkcNYh2TiRfEgRdrVqAzvHG4zH:H1vsTMcgRdrEAzvHG4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655836943, "uuid": "2e540d3f-8315-40ae-9d54-27f40e5262a2", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655836943, "uuid": "5feb962a-61f6-431e-8bc6-581b71140584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836943, "uuid": "22e4a602-7c40-4ca1-bc61-252bd6b74824", "value": "8d206daf11b5ae188df6dbd62c855935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bde3fd-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793265, "uuid": "f05d13ec-583b-41fc-82e3-57c54ab07184", "comment": "Malware payload", "value": "33a43acbca1e25982c955736c8a66fb9", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793265, "uuid": "caa68795-1bd0-4e8f-a605-b3e23d7f9c07", "comment": "Malware payload", "value": "3558840ffbc81839a5923ed2b675c1970cdd7c9e0036a91a0a728af14f80eff3", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793265, "uuid": "cde78f58-2a5a-48e5-8481-2df2c717f957", "comment": "Malware payload", "value": "2031ff32e379676e03bfcc062813862ee4177e19", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793265, "uuid": "ba0eb0fe-98bc-488e-90a7-b76bc47f45dd", "comment": "Malware payload", "value": "a21dcb28a8f4499ef3a1b068c50eb33414d4b06f28d73a56ad7481e6bb1de12e5df9ad59a80cc767f719c4ccbf94ef09", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793265, "uuid": "dbb8b862-b4db-4504-9c4f-2480f34d649c", "value": "T19EB16D74577518859065319701FDFD968B52BC322602E5ACADCD051BF10AB08ECFEAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793265, "uuid": "07324594-08ec-40b0-8e1c-9da0921a52fb", "value": "96:NUfLkrDTLr4ywTHbmEIo2sLty9G0kAUP2TvYzxF/du:G2/4PbmEIoZ/bAUP20xbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793265, "uuid": "41b3b373-040d-46d4-a965-ce04d651e562", "value": 5284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793265, "uuid": "629479d8-18bd-490d-adcb-71ce44ff000d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793265, "uuid": "851fce47-9e46-46eb-8d5c-db7ef4bba2ed", "value": "3558840ffbc81839a5923ed2b675c1970cdd7c9e0036a91a0a728af14f80eff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52631c21-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655840565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840565, "uuid": "e7e42535-2d7b-4992-9224-9ebc7d89f48d", "comment": "Malware payload", "value": "f98c7def2331f5a4ab49334d688d6f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840565, "uuid": "6aa9b1fd-31e8-4ece-a5ad-7baa3fd9df86", "comment": "Malware payload", "value": "35b0d1ca273287daaadb2766c5772ef7275b4778fdd487da18d9b69f44b58032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840565, "uuid": "f25c7cc9-2daa-48af-ad53-075513c56838", "comment": "Malware payload", "value": "94e802dd4c437e587a1cc3bc5083a02eb9d3fcc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840565, "uuid": "f9ba9224-fc51-45b0-bb76-958bf84a5d02", "comment": "Malware payload", "value": "be9a8860d451a9949f82ee43175e27ca4d7aaa196348fee8a3697310891ac4d597cd8adba3e76c550709586ee423b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840565, "uuid": "1a53cabb-6ad9-44e2-9ee1-ab68908389c0", "value": "T134A4124236B88713D2FFB7FA4485928C87B4A065E5B8F76FCEC214D5186AF144A8274F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840565, "uuid": "d5394130-0469-4d37-8133-d0eadee84c63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840565, "uuid": "a35be4b7-834b-410a-8197-df607b66abad", "value": "12288:srl8QJ2smS1ddgnsnF5Z+O/gF9lzaV1xUvfdU:srl8QJ2hS3dZHdcFMkdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840565, "uuid": "dfac0121-b922-44f9-ba9b-ee24e259e891", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840565, "uuid": "ce683efc-9cd2-4ffb-be54-6b984677fc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840565, "uuid": "e3817ad7-f008-4277-a2f2-4a58838c08b7", "value": "SecuriteInfo.com.W32.AIDetectNet.01.535.32313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be119cbd-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655823565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823565, "uuid": "cf9546b4-0bca-4813-8e37-fe2195b421a0", "comment": "Malware payload (ArkeiStealer)", "value": "3dadc4d9abb9dd16e6578d9d516ab3f5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823565, "uuid": "6d12d4b5-07e7-495c-8d53-a2b00cfc6372", "comment": "Malware payload (ArkeiStealer)", "value": "367f3a5a589ebb253496871b6b2d4cc956134e22c1b5d41edb0c19c890176a1f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823565, "uuid": "9c3e6ce9-deac-4366-a50b-0672c684951a", "comment": "Malware payload (ArkeiStealer)", "value": "b03c83831ac873011b7596b90b28eaafcf57b660", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823565, "uuid": "02dad8c4-eaa8-4011-baaf-157f48efa1a7", "comment": "Malware payload (ArkeiStealer)", "value": "c251e9b1350918cb8a9140394967452a95edd8bf90a8559a3f952d5a03cdf7efacbecc29a864cbfa6ba818dd7b7a35a7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823565, "uuid": "9b57a586-1102-4f5c-8218-2645627afced", "value": "T1A894D020BA90E434F5F712F846A6A26CB92E7EA0577451CF52D52AEE47346E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823565, "uuid": "8778a51a-d255-4143-8f6f-1ba46cdb0eda", "value": "3781bb01be22688d5a8de1b4c8b859f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823565, "uuid": "1cd0de29-649b-4a32-981a-a64e955b2cdb", "value": "6144:IpO+VnqtE3FSga7Y8jYHLrWaLD2nQ9yZmqXXmbGtgdOqL8ouHn:IpO+0qFSga7Y8jYfWaPX8hXXmYgEy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823565, "uuid": "b8be2e42-16e8-45ee-88c0-dff264ef7f65", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823565, "uuid": "c5301bbb-e7dc-4d3f-b302-b9db8ac40f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823565, "uuid": "302b2973-68a4-427e-9f14-d693feb25cee", "value": "3dadc4d9abb9dd16e6578d9d516ab3f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8162e7-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854570, "uuid": "b58678ce-0832-451d-bfa2-0096174310b7", "comment": "Malware payload (Mirai)", "value": "93a34cbd5ea0812df7ad391f5adf0a22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854570, "uuid": "b10f0d43-c085-4c07-bc3c-120636e09bb0", "comment": "Malware payload (Mirai)", "value": "373d492495a327a4148821833aa27cc99727185da8ee3fb78eec1d9b8a86bd80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854570, "uuid": "ba5a1f8d-e0fb-4a3c-8a7d-6a4982ee216a", "comment": "Malware payload (Mirai)", "value": "602a142dd12758e9d73a56b75221c4f91ca0902d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854570, "uuid": "b1bb77eb-56bf-44d9-9db7-f5da0bb678e6", "comment": "Malware payload (Mirai)", "value": "78767ea3f65e7dc2bea14ae354e71f4bcb0e8ae4e9b49631ddec52818214e9b35cd90289121b6112d6213d9b78bf4f81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854570, "uuid": "c37197e1-e834-4320-a4eb-4d5bb44d54d0", "value": "T19CC2E0D8E70BED4DC86DA2321C5662CD2F740FA9EA819CD2A195FE024D17247F6927C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854570, "uuid": "9220adde-b542-49ff-939b-b09efebf7328", "value": "768:LLoxsQAiNXW0J3gP2gaZ89YUrb0jv44e24uVcqgw093:LLoxIidWNPCouv4X24u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854570, "uuid": "47051a36-01a4-4419-8209-97d3020e15d0", "value": 27792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854570, "uuid": "ee0ef44f-b1df-40a6-bc7e-11416bb75147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854570, "uuid": "0427ff05-1459-4569-b5a6-b96acd452cf6", "value": "93a34cbd5ea0812df7ad391f5adf0a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076882b9-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801784, "uuid": "53016e51-6808-49a1-ad8d-e1d3c10d7f23", "comment": "Malware payload (SnakeKeylogger)", "value": "b9928c40914ae3500026e8afd7f97d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801784, "uuid": "dda710e2-d861-4e2b-8a71-ae303caf4dd5", "comment": "Malware payload (SnakeKeylogger)", "value": "375e3b9aca92cb15f9e872d6d8495b40bef87ebce8fb10a67d7e6e816da3c40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801784, "uuid": "491b1388-58b8-4209-9c2e-61568ae284a8", "comment": "Malware payload (SnakeKeylogger)", "value": "26c0b68067cf47dc07dc1fb8390854e73c2cbdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801784, "uuid": "8f747cf3-c32d-4560-960c-d3f9819a456e", "comment": "Malware payload (SnakeKeylogger)", "value": "1faf4599b2145222825a8724d7e3baec55e37173b1a9879be166fab8064434a7e6d7e77d1372107b8ca44f6656a26e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801784, "uuid": "51d2eb22-94e5-43a7-a514-a28a3428472d", "value": "T14A056CC9039569CAFCE3177D45F30F20910A97B8191F8B9B0B462BB7436B2C9AFB1255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801784, "uuid": "befeca44-2a1d-4747-b393-f33cfc57e690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801784, "uuid": "8bcc9e7b-8fb2-4fe3-a6dd-42d2ae6800c3", "value": "12288:u1nF8ZgJIJr7DpTCUH22qla5w/yXbxit6hIZTZVZlSyIr22jeHQ3:u1FEg8r7FlH0MW/IbxAVjZlJI/eHQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801784, "uuid": "4866f75f-19ab-4013-b199-2e1afaf45684", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801784, "uuid": "5e3f1eba-1b7f-4546-870a-d325b25e3546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801784, "uuid": "f18f1076-5573-445a-9662-7964bf3bc687", "value": "b9928c40914ae3500026e8afd7f97d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f790af59-f147-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655805194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805194, "uuid": "0bab6801-ba3e-4f9a-870b-a1d4a894a101", "comment": "Malware payload (AgentTesla)", "value": "14b4bc0a106a5ce5570a0386217ea290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805194, "uuid": "58907731-79ba-42e0-b4f0-e132d8a9343d", "comment": "Malware payload (AgentTesla)", "value": "37f769d4e4ac1afbb5dd9ce6efb6e8d153021867e2b74091a2a165d295e3213f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805194, "uuid": "b2e640b6-a85f-4686-b904-b0fea5bedcc5", "comment": "Malware payload (AgentTesla)", "value": "1235d454b8b6fdf4fa3eff9c7668087dec33080a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805194, "uuid": "1af2ccba-baf6-453b-9b61-e02a491a3b96", "comment": "Malware payload (AgentTesla)", "value": "6d24ba8687020f384e18df22e15ca073b8cc63f15215ba84773724e511e67921aee331cc46ed9f3e092f96fde4ff271f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805194, "uuid": "22e66e30-12c1-4e10-92c7-14433ce7329e", "value": "T143B4E0F08FF4B966E56522733094607C77E30D1EDC91A436DA9BF48E34A2AC164E0E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805194, "uuid": "6afa66c6-6f1d-4062-8572-ababfc81fb25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805194, "uuid": "e6b290ce-8acf-4e70-80d5-68dd4c1b6fe8", "value": "12288:PdvLfNVt0ncsOznY2TvkPxVhgevkqxK1CrU+d4stt4g:1vDrt0nn8nJvk53kCoQzig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805194, "uuid": "f2875996-27df-4aaa-9fa3-d6354260f83c", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805194, "uuid": "24d7b9e0-84aa-4348-9732-0c03e4206979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805194, "uuid": "3d408283-5585-4166-a458-ac72a8194c58", "value": "SecuriteInfo.com.W32.AIDetectNet.01.26751.2793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94806c9c-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655803739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803739, "uuid": "02777c78-7a95-4490-914c-1d5f4f970393", "comment": "Malware payload (Loki)", "value": "c4ed4f4b195fcaad63817483c4215eaf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803739, "uuid": "5867f910-b33c-4bb6-9a35-307b6956c7af", "comment": "Malware payload (Loki)", "value": "38927392a0357044d7dc6c89718c9bf319afc2db17bb9228e5d08f55fd75460c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803739, "uuid": "8c13de39-7d23-4010-8caf-7d5d343548fd", "comment": "Malware payload (Loki)", "value": "af90c074bdf4a9275643252a5611bb0d55ac9ad3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803739, "uuid": "a4f7f49b-3b24-424d-bbd6-485cf8fb3d73", "comment": "Malware payload (Loki)", "value": "9c14c022f8767e7ff1298e0b728f39d7427ba4f321b2de0e38444804a7e4187b912d43e81bf64cafa4c9e5d05c7dbcc9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803739, "uuid": "6ce3b63f-4729-4b65-9e88-ba0c5017c4a1", "value": "T18063D02C92F1D12CF1856B370167C541923AEE2B98E5C8CB9300353D79F6AA2327D69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803739, "uuid": "36dcbda1-1cdb-4dd4-b9ab-c568ee129be4", "value": "1536:cP/t0ZgRHTClyJJlHMq3Br+3la13q+SEEf:c36wHTCIflsqxQc6PZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803739, "uuid": "37c0a386-945f-401d-877b-9423a7db668e", "value": 73320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803739, "uuid": "322123ca-c16d-42dd-a191-a6fef534e366", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803739, "uuid": "c1682b94-aca2-4190-aa89-590c1840da7c", "value": "MV OCEAN TRADER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1153862-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806847, "uuid": "bae79f5f-c104-40eb-8ff4-81af0cf701f7", "comment": "Malware payload (Formbook)", "value": "c5774a8d9357ea518800e4804e80da32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806847, "uuid": "9f0d2b19-2a48-468a-9073-b980789abde8", "comment": "Malware payload (Formbook)", "value": "39044c1333c949f09743b804c270b66e7bbad0e2a09b3bfd42e4f25b59f9f176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806847, "uuid": "ca145390-64b5-4424-b09a-f4ed4deb16c6", "comment": "Malware payload (Formbook)", "value": "c2462c2a9eb7044b8cc3ec8a30acc48d6732dc4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806847, "uuid": "3aaac009-8347-4032-81ae-7d1882df4b01", "comment": "Malware payload (Formbook)", "value": "bef742d2f2a2471beee4778fa764a825c6f552bfdde720a93fb6b3f51474f0daa3a4f50ddb254bf74d50e65426dfe8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806847, "uuid": "e200259d-cbb0-45c6-9805-dc8fb84afb42", "value": "T11625180367C91BD7E2BDB2352D64B21C43F6F9D62240DE8A3D45A5C814F6B405BB3A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806847, "uuid": "097771db-d229-43f9-89d9-58890c2884bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806847, "uuid": "f6771cef-71ce-4042-94c7-645fe6bd43a1", "value": "12288:4YWUiWiaGaTuOsd0wj3fM1r46ZRMAJlcJimtPU/JTKGfF6xNq8H0CqExK:IWiWIjurhz+im2TKIcxNFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806847, "uuid": "de37d1ef-b0dc-4ef0-a21e-895b86e0261e", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806847, "uuid": "a2283b62-e9af-44cf-9814-dd1462ac5326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806847, "uuid": "dcb98ad6-d25b-44de-b92e-021cfb248a32", "value": "vbc (9).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea1d29e-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655809715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809715, "uuid": "f9e1218f-f1cb-4f3b-975f-575b644afaf4", "comment": "Malware payload (RedLineStealer)", "value": "9bd1a439054eb7cf0191f9950b2f1136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809715, "uuid": "c31d69db-deee-4225-835e-874bda1730fa", "comment": "Malware payload (RedLineStealer)", "value": "3b088dbdfd0f215862a3a2d5f3095e781b7a31b74deb25e2226c5e467766f32c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809715, "uuid": "4e32a22e-5525-44f4-85d0-d3c15c5e86d8", "comment": "Malware payload (RedLineStealer)", "value": "7b16133dbcc4161f70563b72558a9d94b3db6414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809715, "uuid": "2aab6a1a-b545-469d-b84d-73a1c4abf088", "comment": "Malware payload (RedLineStealer)", "value": "916a2e08ac4e6436fdcdeea032eb3c8a78346abab9caa8834a227ac32cfb5301b3fc32c1e01f52ddec9fceb05d5aa715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809715, "uuid": "951f4f56-ec07-41d2-90d9-bb52d3fb14c0", "value": "T136C3828163D44067F8A7A7744EE38347EB35FC816B34768F1214B29E0A37AD26B78716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809715, "uuid": "9bdf6306-94df-42ea-a65d-1d784fe7b492", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809715, "uuid": "406f1a12-caa6-4956-b378-acaa82880ab1", "value": "1536:qI47GyTGCwiSnmQUt0LB10qs5gP5ERTJ8lgloVVRCs4tF:qvGyYiSDnt10D5s5EZJXbsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809715, "uuid": "8a193eda-fa00-4bbc-9bfd-301ec296f48b", "value": 123104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809715, "uuid": "7970183c-24ea-4a47-ab2b-e672875e7797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809715, "uuid": "eda9108c-ac79-4a5e-88f5-e7cf7b6bd255", "value": "9bd1a439054eb7cf0191f9950b2f1136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6854c7db-f170-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655822563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822563, "uuid": "187b1c64-2d27-4d28-840e-8623532cdd46", "comment": "Malware payload (AgentTesla)", "value": "e0274af3f404f022a55f97b237ec142b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822563, "uuid": "0de9512c-9fa9-4293-9642-2a6a69f75947", "comment": "Malware payload (AgentTesla)", "value": "3ba6296d39146d95fce56b0cba606b954bc753107315b54eeb9e2c7cc44cf774", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822563, "uuid": "d2b655d0-56e5-4742-9781-ae3f8ee3716a", "comment": "Malware payload (AgentTesla)", "value": "c8e8a166118f0f462309d34fde10df31b9fdc457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822563, "uuid": "41c775df-fc33-41b3-b61d-5b510eb8988c", "comment": "Malware payload (AgentTesla)", "value": "d4b8655a737b0d858e7d920ee08197c39df48100d01c3c783a3b79d4c10b0e1a5013e4f8ccc89bb2b08b2bf9e3c48168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822563, "uuid": "b0ea3de0-c618-4b2b-9e1d-ba0c30dfc760", "value": "T19F730404B2458D6BFF50B63A2EA0A0ACD1EE9C3D2D67FD46D5217F8826391D01EF516C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822563, "uuid": "cd63c144-a671-4ec4-a5ae-0534e2cf6eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822563, "uuid": "43675b4d-1368-433c-ac4a-4e97496374da", "value": "384:sEp4xaXmA/UIkyk0enFxyu+nwxhYgjF4:VR2ui+noCaF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655822563, "uuid": "e4586c8b-18a1-4a0a-9ed6-daf237fc65a8", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655822563, "uuid": "82bb9dc5-6a48-431e-8762-7a5891555bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822563, "uuid": "d7d5b373-2f6e-435f-bf4d-0a4393d1fda8", "value": "SecuriteInfo.com.Trojan.GenericKD.49212172.28387.28507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2085f2-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807864, "uuid": "45bc08a2-614b-495c-832b-cddf5f61340c", "comment": "Malware payload (BlackCat)", "value": "91625f7f5d590534949ebe08cc728380", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807864, "uuid": "c053b74a-2476-46b5-8f7c-714411e4c87f", "comment": "Malware payload (BlackCat)", "value": "3c300726a6cdd8a39230f0775ea726c2d42838ac7ff53bfdd7c58d28df4182d5", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807864, "uuid": "8118b585-3bb8-40a0-8f22-5b940b2b5c1f", "comment": "Malware payload (BlackCat)", "value": "bf1b0ab5a2c49bde5b5dbe828df3e69af5d724c2", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807864, "uuid": "a0451392-8d48-48fc-9823-cccd85e43bce", "comment": "Malware payload (BlackCat)", "value": "2e4efdc176d07d31401a6a7683a519abd56ccb8727735e4696888115cb97afedc06df344ab7d76ed17a58868f6c0b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807864, "uuid": "bcbcf550-4d7c-456f-84bc-b910698ff5b5", "value": "T115563361BCA988E3D7720C354AF3C075567DFE234F110993A66833AB1935B942A3EE5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807864, "uuid": "55327536-58c6-485e-b7ef-48780a0c098d", "value": "fc40519af20116c903e3ff836e366e39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807864, "uuid": "cd0dd2b5-ac98-47eb-a149-9bd631263f3d", "value": "98304:gP9cCRyyVyGHAeBSut+aFNnLlPLeqNZ8hY/1KbxabdDkfduupRGQgWseBIfbkeRU:C9HlX+aFFLlPKQ8hY/DkQWsC4ge+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807864, "uuid": "93c7e055-b42b-4d74-b03e-98ea6f6aaa09", "value": 6074964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807864, "uuid": "83308a8b-7ab7-4bf3-b5cc-47a644bbc8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807864, "uuid": "1cb974be-a515-4a94-af9e-899d7d5302bb", "value": "3c300726a6cdd8a39230f0775ea726c2d42838ac7ff53bfdd7c58d28df4182d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b371243-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655831936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831936, "uuid": "27ac2ac1-1e48-4f4e-a363-289d0864510a", "comment": "Malware payload (Heodo)", "value": "fe7d7f264388dec0dd0a2c30383a4192", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831936, "uuid": "134a52f1-c8f2-4e37-bb93-2c7d8b477912", "comment": "Malware payload (Heodo)", "value": "3c65aa247d9d8d29848999fce1a9e6e59592ae32ef9b9434625237e8b7d38810", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831936, "uuid": "91f5b637-db6b-47f4-b879-f708e808937d", "comment": "Malware payload (Heodo)", "value": "1b24d6932a107f9ed7d9c3b7d7b31844050e494f", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831936, "uuid": "861db69d-2587-4c24-a667-60aa89800982", "comment": "Malware payload (Heodo)", "value": "06b16125d08772d622e9ded9a33db1b60f41fdda8ef644d5a938eb4025ae4a46f669ef52fb0a019e3b874aabc065f138", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831936, "uuid": "4bcc3060-9a99-4ecc-ab18-e6d95908e899", "value": "T117648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831936, "uuid": "cf663a90-f547-4929-8a57-8d917e5b576d", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831936, "uuid": "e6b910df-42e0-4c24-a621-c1b438e829ac", "value": "6144:JqdSTDcHe3kjHfNsQn3XYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf33IyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831936, "uuid": "af725f7a-9097-47bb-b89d-15a1a8136b01", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831936, "uuid": "24b18566-2d8f-47c4-bf86-f381cc70ec18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831936, "uuid": "a52ed42f-90e1-4357-9062-a3471a9ab37f", "value": "NwPlgX8qnw8qa9ng06kFdiNjj.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb748e6-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807885, "uuid": "67a65f1d-8eec-4423-b647-71ac91fc0f4b", "comment": "Malware payload (BlackCat)", "value": "dd60770d18cd6eb32d12ff9a71445450", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807885, "uuid": "3b2c992f-b079-4c45-b465-88e3a63e31fc", "comment": "Malware payload (BlackCat)", "value": "3de2a56cc13e85bc214d583dbd101857a129b796dae0c499fb5045a1508231ef", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807885, "uuid": "78725474-ff3c-4652-8acf-56e8bb011a24", "comment": "Malware payload (BlackCat)", "value": "2148bb96b65a1dd2bdb7f3311e783b18513fbcc1", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807885, "uuid": "82463308-a9f1-48a6-bd60-9b7a30342e37", "comment": "Malware payload (BlackCat)", "value": "742ed6745724d71f09e8a249601790f0c25aa3cbbb8fb7d05fc931c3ea1f8a34a6a840aa18805a3b412c7a118108de3c", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807885, "uuid": "e3eb973d-e20f-4e26-9138-c0ed6229265f", "value": "T198E58E4BFA8393ADCEA71571305EB33AD5304919401B8E63F7F49E74BD2E7212948A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807885, "uuid": "8916340e-bf68-4bf4-b6d1-26cdc2a2fb64", "value": "5cfa80280c095d8ac5899898ce966027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807885, "uuid": "5aa9310c-6fd7-4814-aadb-8e91aad17982", "value": "49152:DVDbK9+ABJE75tJxUqQkYuBQBw2NwMKwDlzuq4S:ZbK9+ABJKbUq1OSFwDlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807885, "uuid": "e9e133d3-1179-435c-b2d6-db4fd55dab7f", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807885, "uuid": "b98a5764-fabd-48fc-aec6-2a91f62eb96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807885, "uuid": "f4961c91-0559-4b0c-b2c5-378dc7aa23a2", "value": "3de2a56cc13e85bc214d583dbd101857a129b796dae0c499fb5045a1508231ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45afd082-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655808761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808761, "uuid": "0c53d452-42ee-400f-a643-afb290d4279e", "comment": "Malware payload", "value": "bd64d8b6e9782a349d28a4457ca3655a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808761, "uuid": "17c32f66-00fc-46c7-825b-e541c0303aff", "comment": "Malware payload", "value": "3edd515c8fe082b44a5b6889252a0880c0b62e44a6945a18e2a1e233fcd86feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808761, "uuid": "a2773432-05cf-4aa8-96f9-cd97825b84b6", "comment": "Malware payload", "value": "8c2bdb1880cece4be04c0b7e8b9561bdcc89286c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808761, "uuid": "8504dc7c-13cb-44fa-976a-1717e6dcf936", "comment": "Malware payload", "value": "f92e72235e13cfbd54cfa60934ab43203f739adabcb46750a9cb77ae736c12b87ce4979538390c4e64ad13efbcd3d0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808761, "uuid": "0019f3fd-60f8-4167-b130-fe1e2f1b6c57", "value": "T12E63E762BB408A55E93B1B78482ADB900536AFBA7835D50945F47C633B33EC70C99CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808761, "uuid": "c6df7bf4-9189-4807-9907-0c7fd99b914b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808761, "uuid": "b9ce4a1c-7c99-4cf0-8762-fffba30b6757", "value": "768:pcPvvtbOz7pi/1uFIZMYIIIIIIXllllllWvfIIQIWR1gRkg8Zg0kNK2Rpg3tNp12:qflkpCzHgeGUvDgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808761, "uuid": "d2e17129-06bd-4e7e-90a6-be4320d600b6", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808761, "uuid": "04f8521b-4a0a-4476-8e8e-41e7524d4967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808761, "uuid": "29d038b1-7d47-4de2-96fd-53b763be1af4", "value": "TNT INVOICE TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db1dd3a-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655799647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799647, "uuid": "7539deae-4788-4187-a48a-1a513bdc9c7d", "comment": "Malware payload (AgentTesla)", "value": "227e8f4b3889c3c8c5b752bb53de456e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799647, "uuid": "24292370-4318-4f4e-9339-b499df2160c3", "comment": "Malware payload (AgentTesla)", "value": "3efa859091d8e7994ad47304244de9b0d14d4cfb5dca3df2a13aa7c0a62a021d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799647, "uuid": "786b89ee-8bab-4954-bcc5-18f28dd0bd3d", "comment": "Malware payload (AgentTesla)", "value": "cb0fc97976185ef1452fe6b0279e0e85de03447d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799647, "uuid": "1cc2900e-81ff-46fe-80e5-fe40d49640ec", "comment": "Malware payload (AgentTesla)", "value": "7c93a1cafe22fa6353a477ae2d418f5ba2ec154c4bc8c0fc00fb51671fbca3cbac068c65606271e9c59956fc9d25dca4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799647, "uuid": "3269df44-f985-4c52-9e49-eb273557138a", "value": "T16FD34BD2A744CAABE5AD4970C6A6E49C3719AE6E84C04F8EF4C035EE0D77558712FC0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799647, "uuid": "faeb4bcb-62d4-4c60-a193-18c91804abab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799647, "uuid": "de7745cd-48d7-4d03-b43f-7aa944507021", "value": "3072:fQEAxkONvX5n4AdI7IcIclIyfT5ztihCDo08F:4EAxvNvX5n4eI7IcIclIyfT5ohCDo08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799647, "uuid": "20fb6527-4f75-433e-a365-9c542f6a83e1", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799647, "uuid": "18377db7-9db3-40ea-9325-6f1dae9e4291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799647, "uuid": "16bf45bc-922e-47bc-8cf8-af6555aea965", "value": "lista de pedidos y productos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5530e-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854581, "uuid": "7bd52c7c-ba32-4319-b651-17a9fad809f1", "comment": "Malware payload (Mirai)", "value": "efa1a0dca21e16b3eeb108459da9ce06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854581, "uuid": "19b1b12e-0769-4537-917f-b6069872d176", "comment": "Malware payload (Mirai)", "value": "3f14cbbdfd72dff69ed925db25d1353fc4cbff025ac6cb6b93968fac8563b77a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854581, "uuid": "91d929a4-36ce-4c18-b56e-fcb8e8a55caa", "comment": "Malware payload (Mirai)", "value": "d77bda2a515096393d95a0755120d4e1d0ecf44b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854581, "uuid": "b86fdc72-0c92-48a3-b87a-ebef0b881c65", "comment": "Malware payload (Mirai)", "value": "fa0bfa0c8dbcd9e5518b86ae77de82b15bc74bbf33b2aebb27eaf81f33005eedac82903f8db99421edc5755b3a57fd8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854581, "uuid": "dae8e7ca-35e0-4508-9b31-b4e0f312e5e9", "value": "T15F53AE35E4BA9E58C5124134B918CE356B23A0C4B2937EFBDA9183B5A0479FDB508FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854581, "uuid": "a340fc56-0c93-4c8c-8888-265160df00e5", "value": "1536:6ae8pxbgz0spl10UgfbI3NSv89NBH7UxCClE6:6V8ph4l10Dfe8SNBH7Ux5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854581, "uuid": "1834bd8b-5bbb-4dca-afbd-afa5e9f611aa", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854581, "uuid": "a965b418-c079-41b3-a4bc-0a4519112192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854581, "uuid": "f8007eae-cfdf-43c0-aace-ff5ddca58016", "value": "efa1a0dca21e16b3eeb108459da9ce06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a146723f-f153-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655810203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810203, "uuid": "fd99a90f-7221-4323-aad6-7907e905c013", "comment": "Malware payload (GuLoader)", "value": "53e5d6f7bdafd2b82d863011ca299cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810203, "uuid": "692150c4-b4f9-4597-abd2-2f77af8d780a", "comment": "Malware payload (GuLoader)", "value": "3f17791af296b2f4ca3b39c38cefc84b6e995e02b7bbd470ca6f372e8ce325d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810203, "uuid": "3deb1e63-d825-4893-b55f-817fd3119af2", "comment": "Malware payload (GuLoader)", "value": "11c33710f00ee489c0f6137f3abc661aa4f16d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810203, "uuid": "fd337d4a-3fb7-4257-a8e6-49a92f2f757b", "comment": "Malware payload (GuLoader)", "value": "29b4d2a71712b9752ea5a26b2970bdbef6be5d60af02ce070c96760d71eeafbf9fdc0db8f268373068402864e1e18f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810203, "uuid": "bc700cb4-bdd5-43c2-b88f-1ef317c516ac", "value": "T194D401392200CD56CA63CEF46C13CACB1AA1BE3225957F4A2645B74B6B737FC4D7A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810203, "uuid": "39acd32e-591a-44e9-9539-c0ba24922be3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810203, "uuid": "d21d8777-3de8-4ad9-b034-0056e9aadeed", "value": "12288:rNO7W10iTRA26lAjfe3nmxtgEZdjXKRm1DuCb1GqOP:rNQW+itA2LfInQnZdjX91DumGtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655810203, "uuid": "368e1357-2c64-44e4-9e92-1368ce9720eb", "value": 601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655810203, "uuid": "b307cf0e-520f-4584-9e1f-d6989f8a99ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810203, "uuid": "916ea2a1-5971-4781-8aaf-26bd95d27f31", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38ec219-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655831816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831816, "uuid": "9b128d93-0518-4f6a-bf3c-0d6e5e1df521", "comment": "Malware payload (njrat)", "value": "0814d014e3fa22e280792cb2c7a53785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831816, "uuid": "29c8031a-f4b2-419c-92e5-b97468b35fe1", "comment": "Malware payload (njrat)", "value": "3fd9736f67e91c375d23f4f40f22b37889b3d5c7ade212f37a688779864e7b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831816, "uuid": "853d7fb6-7ebc-43a0-8522-45a989b1862d", "comment": "Malware payload (njrat)", "value": "4e9d0695fe3137bd64c5727043012e8dc4b85970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831816, "uuid": "d1c34ba8-7785-4e0e-a9d0-5cf1b3ecfeac", "comment": "Malware payload (njrat)", "value": "9d10b55d7ae2630214d29355200e58749c2f2e7bc82cbc0e248bc89ab5256c1ed907667dbd0e1d611bb843eeb6c5950e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831816, "uuid": "7bc4c08a-bab4-46d2-8c87-0192063c4ec9", "value": "T15FF32B07B6948B51DB6838B5C0EF643403E2ADCB2733E78A7F08569E1D52333AE55B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831816, "uuid": "2b75019c-1041-43d0-87d8-e20c725773b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831816, "uuid": "c261b6af-cc20-411e-ad97-339d10031411", "value": "3072:XbZffwqv6VjRbzl/bJDDLViOctyZLNle9NYML39uSB1HK86RmU:XbJfwqvgRzlTlXi73YMzkwHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831816, "uuid": "e92183c2-3ef3-415f-a7c7-49a0acab2b38", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831816, "uuid": "7447881a-c75b-4579-bd76-fb7a7f85bfff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831816, "uuid": "a46cb3da-4dcd-4d01-89e8-3b6e751ef3db", "value": "3FD9736F67E91C375D23F4F40F22B37889B3D5C7ADE21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409ace2b-f1a6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655845689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845689, "uuid": "4893cb40-53d9-44ef-a653-d93e64a88b44", "comment": "Malware payload", "value": "51d2e8df7187423dfca46fe84e3cc462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845689, "uuid": "26a337e1-f6d6-4f1a-bb57-23cda250955c", "comment": "Malware payload", "value": "4019f44c75d03ae8db72ae64101f8f144125e8748ba1d8310898834fd706c494", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845689, "uuid": "1623ac8b-cce7-40d7-b8ae-0a54058dba09", "comment": "Malware payload", "value": "270dc8d73db02a4321c4b88a215d04f1412989a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845689, "uuid": "747e12ee-f145-4649-8406-7ba41dcc3c06", "comment": "Malware payload", "value": "b3b61b4e883ed11e312fb6c28573957574fae9a1f8197e61f53519224121868cb18d4ca79b953adb92d345754dd5c4cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845689, "uuid": "7d211d1c-eb14-467c-bcc3-8e19d493731d", "value": "T108B4121C71B663DBCAB36538CA58D2DABC339629F342E6674C4500D63941F801F5BBAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845689, "uuid": "11dd0e0e-5b96-417e-9d6e-37b0dfdbe0b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845689, "uuid": "3620232e-98d6-49ad-9fab-97881ce25a50", "value": "12288:BXnvBWTtba9hjZPzk9e4JMkuDNvdWMyMr:BXnZc0VZLKJgDHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655845689, "uuid": "69d8ae12-8649-4998-a175-987b121dedc0", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655845689, "uuid": "621e6792-58f1-477e-8e2c-cf3d8f189013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845689, "uuid": "4623b3c4-8b99-4093-bbc1-3d728a65765f", "value": "51d2e8df7187423dfca46fe84e3cc462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efae011-f169-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655819406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819406, "uuid": "982df0a3-139b-4354-b55a-ee2026de5d12", "comment": "Malware payload (Mirai)", "value": "931e3863a7b60d714a92c6d918ac2e79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819406, "uuid": "887cb0f0-8b9a-48d1-9cc9-a15d1225fe82", "comment": "Malware payload (Mirai)", "value": "401a73116ad0d655487adcffac9fb2b2279255a2df5a1c01f07224b38bb0521a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819406, "uuid": "a7d807f3-279f-454b-9fc0-3eab1cc90724", "comment": "Malware payload (Mirai)", "value": "afbe4cc2a1ebc56c75a8cd92a3ffb4f3846c4be8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819406, "uuid": "dafb14ce-c96f-4f89-b98e-3bec2e401f47", "comment": "Malware payload (Mirai)", "value": "db4ab561fb997044dce42438b042e240aa2a9ffaeef813568c3e437d0b977273d859a591e8721c0a547bd11200a32110", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819406, "uuid": "e6e54e86-dcf7-47a0-bc45-6ff39f4c70ff", "value": "T1EEC2D17096BA2CB2C6600532E7B85ACABE530F7DE5FD3C90220057BB7941D4529DA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819406, "uuid": "5c266157-d214-4323-b7c9-b07556e0ccb0", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE6PRchymdGUop5hP:ERsoTAZ3alkXLvFh8nNE6PRcs3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655819406, "uuid": "a8d54e84-8439-4174-b532-7a37949a9309", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655819406, "uuid": "fa18d08f-460f-4c9d-bd1f-c243633b4f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819406, "uuid": "90f6383c-c3a3-4a95-839c-9ac729747e86", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a169c6b9-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655851864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851864, "uuid": "ef687a51-9555-4e70-abbd-e8f2e8bcec52", "comment": "Malware payload (Loki)", "value": "d6a3bb1d7bcc81bfc4aa31181ef729d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851864, "uuid": "6635a33c-9270-4e95-90e7-cf8cf26e3de4", "comment": "Malware payload (Loki)", "value": "40712dd5bdd8f584212e0723db57749324d647992f8f7869aae3a1667598b9dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851864, "uuid": "7f91e118-91e8-46fd-8360-b81f7b59870b", "comment": "Malware payload (Loki)", "value": "29f63d740ef0fef1d8c8a5d032681eec509d1452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851864, "uuid": "cf182ab4-cd59-40de-b82a-35633bdab9b3", "comment": "Malware payload (Loki)", "value": "68565e70b103f39316f2019421022fa27d767cddfdaff720533c7ac122ac41d5c1769ad8ca100904ee19a6814967410a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851864, "uuid": "a9247590-11bd-41f8-bd26-0f1a39cd9d50", "value": "T19784DFF58FF4B965E425617370A4A07C3BD34D1DDCA1E93AC697F44A34A2AC260E4E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851864, "uuid": "f8a7a2a3-59a2-4b42-b0bd-ec53a04f15ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851864, "uuid": "e6cbb53d-6900-4eed-987c-3b952d410764", "value": "6144:WTAWP4w6j6+q3BtAGo3UaKGrtSu6H19bRK0x6RYVBRMA+ZI:yXvQ0rTcyGrNax6S5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851864, "uuid": "7bae4831-7f06-486e-a6a9-a1c5f3355b33", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851864, "uuid": "02a74271-18b2-4495-920e-2ddae0dcb9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851864, "uuid": "7aa036f2-889c-43b4-a16f-500bc1e9e2f1", "value": "DHL-2020.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9875bab5-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803745, "uuid": "6eed3f48-7116-4ed6-85d1-be8317e599de", "comment": "Malware payload (Formbook)", "value": "a90eae9f69a5e10443eeafb3d1115198", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803745, "uuid": "f9a8cda2-00e4-4b7c-8228-5e834441049b", "comment": "Malware payload (Formbook)", "value": "4086fd14880ad2a6a3d44523a604bcd46b208278062fcfe61a6e7fc6473b6725", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803745, "uuid": "e7c3bf67-78f7-4bbf-9389-7b50aee37e31", "comment": "Malware payload (Formbook)", "value": "0b73225a70582510fda2019f3fa35131bfad5e63", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803745, "uuid": "e8e5a52c-5ef1-447a-9ed8-9ee54060af12", "comment": "Malware payload (Formbook)", "value": "b7b85faa5a2ba3e7dd20d6634b01f5cba9f0ea21d908c1896a79216ca3fe48abf7a1a3efa1183b6fcf847a225b818f5d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803745, "uuid": "c7af7e35-f1b1-4f24-b05b-43385f4f3e82", "value": "T1CC83E0136358404FD6504671029AD59B30293F0EAC516E8D06BEB3DF6AF9BB40FBB26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803745, "uuid": "f881146b-f054-43b4-a320-e145512e66fb", "value": "1536:+a7WvKbst4j3UQeH4UKdgX8Yv0E5yexVAdgZR03HTKxF94Q:+aOuj3UQeH4UsAcuxVWgf0XTY94Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803745, "uuid": "dcaa0a5b-d14a-4351-a3bd-ab92d8735d4c", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803745, "uuid": "cd50d9cf-1b28-4940-8af2-76999e431498", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803745, "uuid": "c53e7e3e-e8dc-430c-b64b-97cec6bd4cbe", "value": "DOCUMENT HAWB R958300.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733f8f88-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655835895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835895, "uuid": "5c87f1f9-85b6-4fdc-a164-7d6e8d6538fc", "comment": "Malware payload (Quakbot)", "value": "955bba82da675d1e00b736b6aa71010a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835895, "uuid": "81260c28-7e89-4526-a4ae-ba4452810fdb", "comment": "Malware payload (Quakbot)", "value": "414b150d1512e748414e70c380278d819616a4c4c0c0f8a1679f0264685f3cd3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835895, "uuid": "b1c9b5bf-1c90-4608-b8e8-b271a654b055", "comment": "Malware payload (Quakbot)", "value": "01a8b5d39a173801064d35b131dfc00c6a5fc91a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835895, "uuid": "00723211-453f-4ce6-aa28-85a66665dcd2", "comment": "Malware payload (Quakbot)", "value": "5dacd58acc408310f1444d473280305b50059434ee39ab420150d27ce1dc7e157f5f6331a9816ba3a70fc766bba660e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835895, "uuid": "952d5115-080f-4c9c-90a9-1f721419de35", "value": "T1DDF49F36B3E04837C1771A7C8D1BB66898297D113E3C988A7BE41D4C5F3A781376A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835895, "uuid": "d78a0045-262e-4914-974a-b85a86867a79", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835895, "uuid": "fb21cde5-9fff-4eb3-bdd0-b23925f5abc5", "value": "12288:pSHEVZKP1O+hamzhv1fm3F7SxZF0WGNY:eSi7NvEhseY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835895, "uuid": "1ec55e22-fcd0-4b2c-96f0-c0bd096c1a5d", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835895, "uuid": "97dafed5-41e1-45ff-be06-165b4d930bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835895, "uuid": "8e773f47-a364-4a25-8fb0-8c9f92be44ee", "value": "190.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d2ccc4-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655841772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841772, "uuid": "550870b0-8e68-4581-9499-9b82227ceef9", "comment": "Malware payload (Mirai)", "value": "bed6805f2f4df9496f0fc4707b3480cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841772, "uuid": "5d7ae189-afc2-4f0d-9242-8b68b6fdc59b", "comment": "Malware payload (Mirai)", "value": "4189bf206252eb88115bdbb0274169d0378e834ea267b34d16bc4f4e2194e063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841772, "uuid": "0e6df850-26a1-445d-8184-b36476eaa5af", "comment": "Malware payload (Mirai)", "value": "cbd281e453a793914b8d9e3ed742f628152386a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841772, "uuid": "2a2614e1-8b45-4bca-9b17-82659083441e", "comment": "Malware payload (Mirai)", "value": "ed216b3162027f5a9f6e1f2330900b0f7ee2b222441c2b4de427d32f7f7c33ab387560cd088be0cc2aab1a0d7263fe9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841772, "uuid": "7deb86c8-9dc3-4ad0-91b9-e0b0be91a863", "value": "T183230882ACD29A5ACAD46376F62E108E3311B3E9D1CF3257CD105F107AC9A2F0D67B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841772, "uuid": "a4595f95-d38b-420f-a8dd-c92936388767", "value": "768:pXZ7jmqV+O4QX2f+4dOBnpEYj3CBoqvvnDBVSdYgDon5XPNBNIK:jnmqIGGf+4dOBnpEYWKqnnDXSyg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841772, "uuid": "86cd0d86-efef-4720-a79e-6eb2a10203e2", "value": 46316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841772, "uuid": "3df2bdf7-bf4e-4db0-8063-2b5b3a13a78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841772, "uuid": "9347a8ae-6d45-4272-9ba5-d45137905cc5", "value": "bed6805f2f4df9496f0fc4707b3480cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae7a49c-f17c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655827909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827909, "uuid": "4e7394bc-c079-4ccd-8d55-dedc50451d05", "comment": "Malware payload", "value": "49559cb514257f07f24ff7db6d05de8f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827909, "uuid": "d4ba0a10-4312-4225-b737-c7061d62c17d", "comment": "Malware payload", "value": "41ca5b314431de127b9a9674d8c092e5f8bdb4106d48954db818617523c2bc67", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827909, "uuid": "1bb0a4f7-25b8-49ea-8211-f48e6175da23", "comment": "Malware payload", "value": "63f1090925219e57f689e5d77fd4e1d4e4999b2c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827909, "uuid": "7016144a-66b2-43d5-bb29-2d0928cfd69b", "comment": "Malware payload", "value": "386e31df46edd812eae24ebc6df7eb1beeaa27fb046acce552515883c87fe0eb5350b06918706e9ff3ab61e111a3abf1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827909, "uuid": "72a5f8ae-1acc-4736-ada5-c4bd2749bc4a", "value": "T1AAE4983C2F7B67A0B145AC0CBD9ACDA815625710709429B1CD71E392CDF1CEAE92E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827909, "uuid": "e7775e8f-b4f2-4648-9ecc-66c576956a60", "value": "6144:N2NuzTTdbbeFgCqrv1XZ7+Wuas5DxQ9KH+SwISV9OSk/RlseNrqO0FjwDu6B0/aR:N2N8dbv1T1eaome/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655827909, "uuid": "ad75459f-4007-431b-9a0d-606581fdd5c2", "value": 713385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655827909, "uuid": "961e3323-c2ec-4bad-a932-fc18ec203374", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827909, "uuid": "6b8b3103-fdc0-4e59-96c0-4f3dacc3024f", "value": "stanstart.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5441cd3f-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655835843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835843, "uuid": "9d0e3069-8155-4e3d-a766-b6eeeeae0ebd", "comment": "Malware payload (Quakbot)", "value": "b90b369f209b72a26a409629e4bd686d", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835843, "uuid": "83ed1558-0da2-4e38-b633-752726735e65", "comment": "Malware payload (Quakbot)", "value": "42205187b8e92c567826f6a00c3ab3159c11ffc7a4487cd4367963ee18569482", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835843, "uuid": "9543bcfb-3209-4bef-b84c-d0626646b162", "comment": "Malware payload (Quakbot)", "value": "febaaee3b4cff4d784fa0e82fe5c8d2210ac601f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835843, "uuid": "d19b003a-a3e2-405e-a17a-f16968c059ae", "comment": "Malware payload (Quakbot)", "value": "764b9d88289764b447880ac5f9deabf18335794793bb3487f44a449a4e5b3d0aa40143e9d0d2f281c440cc81e28c86a1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835843, "uuid": "57929b2a-b1e4-4eab-b529-d17912c95791", "value": "T10861E9FD59868DD883316618823BA280EC64C863AB04D30B728DE2593FD45C2D8CB5DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835843, "uuid": "a0766e37-7691-4fd7-852d-7bdb87ac1602", "value": "96:zCxbbBKTwTyLJ5/bDLfnXMNu1gg/oitcYX:wtBm5zHMNu1g0tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835843, "uuid": "3dcbf128-a91b-4da5-aaf2-db671a28b273", "value": 3195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835843, "uuid": "3cba4e12-e12f-4732-a06d-944e056cb937", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835843, "uuid": "f96ccc8b-05e6-494a-9bf2-8bbc92003629", "value": "Scanned_75678968.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bdc4a5-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655793186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793186, "uuid": "39f8e981-ef6c-4e19-b5b5-246612bd7a32", "comment": "Malware payload (Loki)", "value": "b6af2df161521f04e9faad76b23492f5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793186, "uuid": "e24a6cf3-bf08-4bc2-b35b-e9114663c83f", "comment": "Malware payload (Loki)", "value": "42217b4e40567409993424ddc9beeae7a006952c31dda90d85b3a7cd67c6fa7a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793186, "uuid": "8ca3bd2a-4645-479a-b9e7-80f9646090de", "comment": "Malware payload (Loki)", "value": "6a861a95c6c9479a597201d537422be8bdb5e7d0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793186, "uuid": "86023b7e-e362-4780-947c-f078b00cde0b", "comment": "Malware payload (Loki)", "value": "d788ec47fa0e37c5b6217eb5378d2c08d34a54f48392852b9280c1435e941639dd858fcbb7657814521d4ff39686c8a7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793186, "uuid": "b051ba98-8726-451e-aa3f-d76c02729920", "value": "T10EC4239B1A50CD6ABA4225C0094ACF90D2E45D392CF2FECC315CD5BA3E86F7D81D5A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793186, "uuid": "77b8a015-4dbf-4db8-b535-ed7f29fd0c21", "value": "12288:KqTGB6mayUhqKwwAJJoZAnui4trh0mP2cnqnqgzbPgc0MHc0/bcGxptFRe0K:R/wKwUZAnurh/22BgzTn0S3b5ZFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793186, "uuid": "d74e526d-acd1-4720-971a-0b4b46bd3217", "value": 562318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793186, "uuid": "d49d8ef5-b775-420f-9909-2d21a4bc8a5e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793186, "uuid": "8997cdde-94af-4850-bcf4-a14d498879a9", "value": "New Quotes.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02366aa-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802040, "uuid": "86339326-2a61-47f8-a9aa-80f82b549d25", "comment": "Malware payload", "value": "23573990e3dbf8aeb64e17d874cf0822", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802040, "uuid": "8d23e1ee-a77b-45ef-bdee-3f54b2e35f0c", "comment": "Malware payload", "value": "42da24c3276ae9bd05d0c8642f8241ca6fd14430fceb73e554016a8d743eeb4c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802040, "uuid": "8d6df20f-0d3b-423f-8e6a-12de6ed86e63", "comment": "Malware payload", "value": "05f659858f9400a814629b6ad8bec7922f89b3be", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802040, "uuid": "f334c8cf-aa5d-45b3-b319-da55bf15bec5", "comment": "Malware payload", "value": "d6eee37bbfd814c83255cfce19f896235050020a7564b85655a575ab9b7fa1c1473483b3ee1971180c3a011d54ee312e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802040, "uuid": "9d5e58d5-bce6-4901-a878-36442b54c3c2", "value": "T1A5467D23B2C4A13EC06B1A3A493BD758993B7AB17A12CC5B17F4488C4F396417A3F657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802040, "uuid": "2305d84b-c43c-4502-87f9-7d9ea3dde8a2", "value": "98304:fOmJwqQitl7dKP+L78cgz8Ukt29krd+6zdVtXOYAA:f1J5tlxK2L78x8UktBzdLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802040, "uuid": "5f1842e6-acdd-4a2e-8f96-108e94bb78e8", "value": 5809152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802040, "uuid": "adfbbdd3-2ab3-44c1-b7ef-137ab7f357d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802040, "uuid": "5b214581-c2ce-4ef1-abfb-564a41f799bd", "value": "IDfac-t.165.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5c7e7c-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793260, "uuid": "c1aca723-0cfc-43ed-ba26-97a4e2b6b16b", "comment": "Malware payload", "value": "f24269da9a86865e7fe2d1f84b8161d7", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793260, "uuid": "5519a091-0e69-4906-bfde-4de7d46272c0", "comment": "Malware payload", "value": "432bae48edf446539cae5e20623c39507ad65e21cb757fb514aba635d3ae67d6", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793260, "uuid": "c8c1577f-0e68-4d76-9013-1d6bd22d2fad", "comment": "Malware payload", "value": "caf0e0aa27c12b3b5dcd8f5cde5685c0511b0ec7", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793260, "uuid": "74b3680f-e979-4530-87ec-bab001d15218", "comment": "Malware payload", "value": "380f7b546fef42be37682305d7f83ce92811ed46a99e9f8b7f6a7a8d31994de86a64638fc9a49da846b696fda8bbb8b6", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793260, "uuid": "807b281a-55ba-4117-966e-375fcaebe132", "value": "T16A428D38EB0B9829EA6B637A666A0DDBF7ED510FC110E15B4A6947D44CE14E01B33B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793260, "uuid": "2f89fee6-9ad5-47ba-bfa5-71b9cdedde86", "value": "192:0v4Jv0j+OaJGpZutUeSGL6LxvJswga6pgM1x/WBvVqpFsgSGs8Enf7:0v4Jsj+GqeeSZgPpjL/WD43Sbnf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793260, "uuid": "0aa2db3a-1820-4503-9b7f-9a83e9ecf168", "value": 12193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793260, "uuid": "cefeb017-885d-4d72-b83a-8d68d31df8de", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793260, "uuid": "a17de101-e89e-4cde-9323-9b02cbe53884", "value": "432bae48edf446539cae5e20623c39507ad65e21cb757fb514aba635d3ae67d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4a10fd-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655802489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802489, "uuid": "04efb3f8-2e8e-4b49-8c19-a2970bbd6d91", "comment": "Malware payload (RemcosRAT)", "value": "36f3c42c50d9d8a441ead788c959db74", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802489, "uuid": "2d237b0c-dd2c-4c6e-94af-fc9fe55c6b08", "comment": "Malware payload (RemcosRAT)", "value": "43bfd4550a8a452e704c906e441be1c2a215056096a8202fe5b9f63175f27a36", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802489, "uuid": "c70d6c41-869b-435b-a2cd-5f636cbd54e1", "comment": "Malware payload (RemcosRAT)", "value": "5acb690d9a11d5b3ee03c34672b74d98911b3a42", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802489, "uuid": "7f62fff9-b474-4293-90bc-c36ab974f4d2", "comment": "Malware payload (RemcosRAT)", "value": "9327e7432992ed5cc8fde8323ace2b081cdb67ee0fe79e5d027f3cf9af4c984e2827eaba287acad7466e472f260eeb15", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802489, "uuid": "1cc0e85d-8d55-4bcf-8946-270f7d3c216d", "value": "T15C73E027AF8F0754D86A86F4071FF419A6992C43DF810FFA218D7288BA7DDA0711E257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802489, "uuid": "ec5748bc-ecf5-4435-ab73-06029c94f6be", "value": "1536:60f6kWHzsH5fY/5q2IihgW0FfGPoEZq4rEMAdlNaX:6sWHzsH5A/5q5i2W0FfyZqyEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802489, "uuid": "2b41c93b-f637-4814-aa3c-98696071efb6", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802489, "uuid": "302310b4-c332-40fd-a707-a506161e8f49", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802489, "uuid": "fa5f054f-254c-4b79-b55d-51184f4ea538", "value": "UPS TRACKING NUMBER-OPD7298273974 -PACKING LIST INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbce8228-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655825763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825763, "uuid": "ef82720d-e4c2-4989-9e07-ec2b9bd72a96", "comment": "Malware payload (Formbook)", "value": "8e5764617194a54afd7c5cc130fbeff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825763, "uuid": "3ce5ad1f-d2d5-49d6-a716-317c92614b6e", "comment": "Malware payload (Formbook)", "value": "4413a2e6e778cdc5dd839816a62d25e68095be325a28036b45f85716405a2d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825763, "uuid": "465a8eaa-5824-4521-afeb-9822a8c6193d", "comment": "Malware payload (Formbook)", "value": "fc38d173b4f2421cbdf0547f498bf2658c09a6f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825763, "uuid": "2bf38695-d7b1-4e92-88f6-60ac4aee9283", "comment": "Malware payload (Formbook)", "value": "012702059b6a7c4adfdec58971c85a65888e0b232363d4181da3ac10531809cc712d97100c207e4451290112e0c7fb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825763, "uuid": "582368b4-10de-4455-a414-7b0c5213004c", "value": "T16AE401F19FF4BC6AD12560B274A1A07C37E34E1DDC51AA35CADBF04A34A66C520E2E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825763, "uuid": "21397985-f5ee-45cc-b5bc-121b9003b5e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825763, "uuid": "05fbbbe9-8cda-4fec-ac56-d9403e1e39f7", "value": "12288:7SPa/sOOa7dC8eJ7nALT4BU4x7vQ2m9E8F2lGKMzI7r/D4CpQ5rM3NJsGVBMs+yd:mPqlOaxRyDB9x7vQ2GldKMzIP74Chasy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825763, "uuid": "4f61226c-cc79-4b21-96e2-524d79dd63be", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825763, "uuid": "d9f3a1fc-f4f4-48a6-832b-96f82c8b89c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825763, "uuid": "fe77284f-45f4-4f40-95a6-1b6f02072347", "value": "SecuriteInfo.com.Trojan.DownLoader27.59888.18732.548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ca2a3f-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832977, "uuid": "9aff0d53-f7ef-4ae0-b3f0-18419abfdf99", "comment": "Malware payload (Heodo)", "value": "3d6ccd2e2581f70b95453d1ddaa5250f", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832977, "uuid": "711d37ef-7950-4243-844b-dc762d10d13d", "comment": "Malware payload (Heodo)", "value": "448b698c2ae8a0e644737c583d5f9d7eaffb08fa5ce171fea08df26e1b4e2168", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832977, "uuid": "ce618dfc-cc67-451d-bf46-026ec2e66e96", "comment": "Malware payload (Heodo)", "value": "e8b41492a57d0c6f3f248aaf5ea2e07e46335ca8", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832977, "uuid": "d35826b5-0bae-4a18-a636-44ef5fb2c9d7", "comment": "Malware payload (Heodo)", "value": "726c7d3bbcd9ce8344bcad531cebd51303b567935c7f9fdbd6b555fa08fa4889e4250160a56c3b2fe4ad90654171f577", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832977, "uuid": "4de9a377-5426-4c5b-99aa-b43811a1f9ca", "value": "T17C64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832977, "uuid": "9e7708bc-561b-4c43-aa2e-7d333040efa3", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832977, "uuid": "bb0261f3-8191-4f1c-8eb7-541af1466bec", "value": "6144:3MiSTD2He3kjHfNsQnZzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3+NmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832977, "uuid": "27091978-efd1-4237-9d87-d0e3b4ce75f0", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832977, "uuid": "6d234f19-7c0a-4905-8c8f-d39b5106a0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832977, "uuid": "37f05cd5-8fe0-42a0-a483-32ec25ec3b83", "value": "0jpfaTuRcJgom.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739f74b3-f187-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832460, "uuid": "abc4ad52-0db2-4247-b3bd-3dfef13bace8", "comment": "Malware payload (Heodo)", "value": "dc7ba7981bdcd8cb30008c2cfe4ac706", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832460, "uuid": "2c479e24-780f-466f-ae97-7b14eb76c109", "comment": "Malware payload (Heodo)", "value": "44d0c4b538c2840cda8d06c3f6e3ac2f772826e3f39ec94ec8208482e41056a6", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832460, "uuid": "432e72d6-93ae-494c-923a-65efd078c200", "comment": "Malware payload (Heodo)", "value": "fef09c6390b384d5803648afba337999a0ffc2b2", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832460, "uuid": "8e175a6d-e9c7-485b-b892-a858ce54b2f6", "comment": "Malware payload (Heodo)", "value": "a33ee3f2c42543e41e2aa232a78e1f4aea0898474bb8ea7935e2f94c6bc6ed8455c6eaa74b7b13345d4dc7da7ddcb682", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832460, "uuid": "50d398bc-0c06-4914-8c0c-acb9e61d2803", "value": "T17564AC062240446AF74A4B708A17F9D687667C7950E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832460, "uuid": "5a3b37f6-b915-4a54-aaff-67238e204b24", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832460, "uuid": "f4f17f86-c17b-4930-80e0-8b8650e3c3b1", "value": "6144:3MiSTD2He3kjHfNsQn8zsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3LNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832460, "uuid": "d56d9596-20dc-4c11-b07c-67942e397866", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832460, "uuid": "91ef467c-c157-4fe4-ab03-8c807519b099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832460, "uuid": "23c200cf-383a-4f51-abc5-b17e1bebaee2", "value": "MUIDqt0DbXRppDS.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d691c03-f1b0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655849925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849925, "uuid": "a1948aee-802b-4c47-aa16-0b2e4d5ebbe3", "comment": "Malware payload", "value": "e709b8a20818cadf971e2d4627d887a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849925, "uuid": "7db60777-ed7d-4dad-b3ff-0df888ce61a6", "comment": "Malware payload", "value": "465cce2c51821bdd1bc8f99c1acfa98267c38aaef1aa81b996d5dbbfe996cebd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849925, "uuid": "43ea0514-302d-41b8-b149-4e73ac9413fc", "comment": "Malware payload", "value": "6b01128f1b2c2ffbf36ccecc78765928d18d36f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849925, "uuid": "162695f2-410a-43ca-b961-98289f1855a8", "comment": "Malware payload", "value": "faa97cfc5a4bc213f245b51423504c5e50da4a37274935b784e6da136a8afeaa42fe80aa76bb3774ddc317302b2f595c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849925, "uuid": "1c1971df-c2f8-46cb-93e5-7144c89001e1", "value": "T1F5F4D0653A4CAF90EA7EC3791161401053F0A89FF723E61A7EF718DD5861FC96372A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849925, "uuid": "255a93f0-c103-4e1c-a7fb-568dbc97ece5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849925, "uuid": "c1d0e92d-0dad-40de-b0be-e923bbcd5b89", "value": "12288:WCqBrC+EeXcP0xIV9k5FO8GCnWbILW+kauU4IrohdbOR1O2iNPf+B85FrSkgLfuy:CO1B+B85FpYnOmR74pj/w2uwYIkuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655849925, "uuid": "31d9d265-1840-487b-a930-b0a05aecc606", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655849925, "uuid": "66cf965f-8213-4a59-b4eb-73cb90842e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849925, "uuid": "e14c9ada-b484-4c22-9978-9c3b0d3c68d9", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ecbb81-f100-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655774292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774292, "uuid": "655cc6c1-e52f-435b-84f4-ef30ef4bda6c", "comment": "Malware payload (RemcosRAT)", "value": "d51e728c158584699e77a5006871f903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774292, "uuid": "22654419-8abc-4be7-8f6f-fb1a5f4e6802", "comment": "Malware payload (RemcosRAT)", "value": "46f2b31dbf957a1cf7ddfc286b89d6388c8fa930b56bdeda2a75879a56a7fe8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774292, "uuid": "e19571ba-4854-473a-b87d-5df4dec3792b", "comment": "Malware payload (RemcosRAT)", "value": "fd7d71416257c1741623ab0e98eb136312c57c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774292, "uuid": "8f605fac-6f42-446e-85e5-8524640c8880", "comment": "Malware payload (RemcosRAT)", "value": "5d49c3d836446c6ff42c8a55b84e58801536bc54e5c5aa0332c216e5cba64e1b805875c7be2d8e53ec73e3bb7a3faad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774292, "uuid": "ad49fd07-71ac-433e-b103-2cd327ebae10", "value": "T1E615021297ACCE1EDF9C067C82A45D260A708E87181DFF99F4F594EA3313748A1B7639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774292, "uuid": "635ade5e-1a5e-464d-93c6-163c2fcc90b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774292, "uuid": "04d84ef5-1aa5-4c85-9ba3-f6d05ba5164d", "value": "12288:S1g0VGK+JyOCkIQL8fgJYfe6hD1uDTj983BAOVyiQrDB2acx:aHVTkIQLxYfe6h2ZyarDEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655774292, "uuid": "52f6b4e0-4bab-484d-9547-1168c862723c", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655774292, "uuid": "6cc0cd97-f79d-4a66-b275-680424c86813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774292, "uuid": "5089b406-8845-4a88-9dc8-0911a1e7781b", "value": "7013482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a9a5f2-f1bd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655855602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855602, "uuid": "ae6c6c33-04c7-46dc-b8ad-831758bee723", "comment": "Malware payload (RedLineStealer)", "value": "abb81430f55b4560bf6c157e8d2efb80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855602, "uuid": "01751359-1999-4e14-b168-5f5b0ab8f544", "comment": "Malware payload (RedLineStealer)", "value": "46fe25c0c49c6a710fc861e6cd0d5ca49cc145223210373b3ed3d1981b822f92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855602, "uuid": "179cb365-40d1-49cd-ad7b-ad98b8eec2df", "comment": "Malware payload (RedLineStealer)", "value": "0ae2b2dd651bb1d50c1a9167535eeda249e0e708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855602, "uuid": "a8b93f51-863a-499c-801f-d44770211790", "comment": "Malware payload (RedLineStealer)", "value": "5c1ea0250805f2a63c763c5c942dc0b4d774bf7ba8b05e2d3c3216fcb5bdd26e14b4d649c87642d31e3f68b83363193a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855602, "uuid": "1986fed0-223f-4e61-a3a6-eafddaaaab95", "value": "T156D209C932A4BE76F14A0F339862E3701634AF4D5426C73D67E85F4FBD221E10B94A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855602, "uuid": "e7a3f1a8-4cca-4409-8de6-8a29c1c546e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855602, "uuid": "5414493b-fa1e-47e2-bbd5-c8ebf3c7df54", "value": "384:21nlOcf89l7TnTg23Et3y83Gj6Bg9afgeCtuX:WlOlZE3E19a2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655855602, "uuid": "3579f34b-8df8-4b6e-aa5a-47559900c068", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655855602, "uuid": "a4d20019-c52b-4873-b8f8-49e6d5168031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855602, "uuid": "d870edc1-440a-44dd-bd42-fa6fa3ea8488", "value": "abb81430f55b4560bf6c157e8d2efb80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba234a86-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803802, "uuid": "88e1498b-9e0f-4da4-9ccf-fc2afa15b534", "comment": "Malware payload", "value": "0cdb29ddc64df2bcce439009258b5793", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803802, "uuid": "d53fb71d-0a68-434c-99f5-720b3dd748ff", "comment": "Malware payload", "value": "4756801203243db65820ae473cc9fe90f87a2a15e4ab6f8d15df42f7c9cfe365", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803802, "uuid": "e1176a0b-95be-47bc-8c7c-57d2a4554bbd", "comment": "Malware payload", "value": "32d851234808ee1412d8623b15378c51b723393e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803802, "uuid": "a191b87d-e329-42fa-9292-921a2416efd2", "comment": "Malware payload", "value": "5f2f3b51a53c5ab97912a9e0d2a6d02e8a30252ea6ce5a7fdaa2ab3a6413d1de604d68a9377abd48264d142dc47ac8be", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803802, "uuid": "7cb7247b-cdcd-434f-9441-791197586c57", "value": "T11834EDA0685F49B2E708DD1E25A4F6506EBAFEEB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803802, "uuid": "caf68e3d-2ca2-41f9-ad0e-516b9c2b8d54", "value": "1536:iwwtKJuTB//vnwBw6VA1oahablyQvZVzFz76mAg5eeVhMDw5wfLc:iGNBaCJVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803802, "uuid": "d49bb06c-a5ae-4a74-8b1f-4562cfd7e7b9", "value": 239114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803802, "uuid": "93d14f5f-92db-4686-9ed5-c77d4b6ed5ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803802, "uuid": "269766a4-594b-4c38-90c7-eedec0b54f7e", "value": "PU-23646 Invoice order number.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12677b73-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655799655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799655, "uuid": "5fdb3619-2a19-4691-8790-1d71bbf2419d", "comment": "Malware payload (Heodo)", "value": "8b42d0f91b72067278208b3439f5927f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799655, "uuid": "babc65db-c743-49d6-b1be-fea4baf58841", "comment": "Malware payload (Heodo)", "value": "481ba4576aab966a7e8b0259439fa8eb05258f5782cf1cbeaba06d4262c2d958", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799655, "uuid": "1f21a2a8-b593-4ded-9def-8c39ed9812be", "comment": "Malware payload (Heodo)", "value": "502c0f8f531d81a2f80dd671e25ae66094bd2dcc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799655, "uuid": "1e8da38b-8517-4be4-b90f-8e2155c796bb", "comment": "Malware payload (Heodo)", "value": "7ac1c88bae2ba3da08572a8919bb62f21b1f467e8b3445ce0ee407d4dd38e7f924396703396fba178ccaf0cf75d5a003", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799655, "uuid": "01f29121-e538-4adb-9033-902a84b4110f", "value": "T1F333D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799655, "uuid": "0862b841-f50e-40ca-9a79-3030f555a5a1", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKP:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799655, "uuid": "db7ec9ef-f26e-4884-89b2-0ddd3c922926", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799655, "uuid": "4fd7e235-0ed5-42cb-adf1-39c9aa60d6c9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799655, "uuid": "7bb74cf7-28c1-48b2-b1f8-f12cd833d2a4", "value": "Pack_1906.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f892f07-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655799677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799677, "uuid": "792a1373-0bdb-4a48-8457-983202bf2bfa", "comment": "Malware payload (AgentTesla)", "value": "254ae670f99d27e5c9945e7f2a687db2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799677, "uuid": "b0bad66e-3a8b-4281-bcaf-25e872d2e0da", "comment": "Malware payload (AgentTesla)", "value": "48435dc71f163d0a7a52a2141a58465f0ed24e6a1e7fa60e5c1d84d70cf646f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799677, "uuid": "aa1f3c62-2757-4755-8912-5a32c26b5640", "comment": "Malware payload (AgentTesla)", "value": "6137f2b5fde0fc324088a0a72745bc2b859b2276", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799677, "uuid": "a1708fff-6710-4275-ba7a-bb3f0c67a9e5", "comment": "Malware payload (AgentTesla)", "value": "577ad1dedfae4c1387134b9d792774c751748d212fc4c950575bcce5665d6a8a25669bd08042a8c442441e61272b1dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799677, "uuid": "cfb52ce7-fc50-4edb-897c-1f25a1751b5c", "value": "T102B4010272B86F4BD9BE9BF55662619847F539AFB1A1E11C4CC620FD2871F108E91F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799677, "uuid": "4a9b7a0e-7e32-48cc-b34a-240bb3e5189f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799677, "uuid": "b44f7b54-f281-4191-9869-9e9d1e1e0f12", "value": "12288:DTtMaV9sYt7TX5yWmn3ivSYrHTxTUkwuVg8sx2KadH1GT9w:pic79Qn3ivrHTxTPy8c5adHoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799677, "uuid": "6a2edd54-7cc6-46a4-bd24-a28d3f8acb95", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799677, "uuid": "dfe03b3d-f58c-4974-9a67-b9748d9d93a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799677, "uuid": "ce710772-b92d-4387-b7e6-7abde979f034", "value": "zPR4N8YcE0LJP1M.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3bd8a7-f18a-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655833652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833652, "uuid": "30ddf43b-7ca1-4715-a43f-34c3494199e3", "comment": "Malware payload (njrat)", "value": "b97eb55380d970a7fcde6c7c8fc3250c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833652, "uuid": "94efd102-9dbc-4d02-9ff6-421ec85e67c1", "comment": "Malware payload (njrat)", "value": "487c283ea0fcadf762570d959b92489faed22914e6d468d04e3231512e96572c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833652, "uuid": "837e400c-5284-440b-800d-03aaa1769d31", "comment": "Malware payload (njrat)", "value": "0d1e06be7ddc08318f7b40eb6be5af3c8ff01e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833652, "uuid": "33b27760-069f-4edc-adaf-d624dceffed2", "comment": "Malware payload (njrat)", "value": "68366911d51ab0f8db4ddb364dd8bcc40d1c3478f5a5c4771f2bbb9955f6f63af31353fc2abfab0f55a91611ccd73e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833652, "uuid": "3522c1a3-907d-4331-af1d-d3be537b600d", "value": "T16903294D7FE181A8C5FD157B06B2D422077AE04B6E23D90E8EF1649A37636C08F54EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833652, "uuid": "4b42290c-ee06-4175-b4b2-8af1da81ca64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833652, "uuid": "b7b514e8-34e0-4ba8-ae0e-26a1e6cca54d", "value": "384:+SfFREic4vYqWNc2/y8fiC6rVADwSprAF+rMRTyN/0L+EcoinblneHQM3epzXuNu:LNIqT2q8fiCOkwqrM+rMRa8Nusgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833652, "uuid": "8eaae3aa-4b8c-4a89-93a6-fb462239cd96", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833652, "uuid": "e95232a9-0d2c-48c1-bdd8-c2bc89527069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833652, "uuid": "6e96f974-0ccd-447a-9fcf-1044c9fde394", "value": "nup.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9516e669-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802022, "uuid": "70a6e687-104b-48e4-903e-76020317d983", "comment": "Malware payload", "value": "daf2deb171f245c3ab3811dbe2efaea3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802022, "uuid": "19e5e94c-d004-49a3-9a54-168327627719", "comment": "Malware payload", "value": "4933c1fbf537988e4eac7ce520d372f592cd5f26731b14349d703f7c642e3e74", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802022, "uuid": "540a8625-d4ce-4b12-bf2a-d737492a4840", "comment": "Malware payload", "value": "f708b4c6d6d07215c83fb9fd7004da1d67976cf7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802022, "uuid": "08741659-dbf7-4288-8a7b-42a294dbd946", "comment": "Malware payload", "value": "6041f79cb5b4d1b0fc985d90917948f24583fff21c472f9621e79f26aefc8a6d26323f872db424b9f72eae6dd54fca4e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802022, "uuid": "fa9bd463-6f96-4c99-8a1e-4db974ec9a91", "value": "T1E45723A7E389D85FC0776035DE661A2313450D94DA92662B192CB77D38FB3D08B8DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802022, "uuid": "9767c929-c369-4769-9762-5420f9f182c7", "value": "393216:yMPkNV+pNcpTLvsa3NNMO6Zd0jaPO0AZeDdeS4DE7Uzw7Uqx07U1EUvQTyFwj:yMPcpTLvrdy+WPjAIDdKz/c1EUoThj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802022, "uuid": "76afb846-cff6-4de4-ae7d-816dbdfe5bcb", "value": 29234831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802022, "uuid": "8be4e37f-07be-40dc-8f04-37b83251e7fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802022, "uuid": "d866df45-8e18-47c7-bcbb-e6533e44d88d", "value": "CamHipro_v3.0.26.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7366833-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655802079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802079, "uuid": "e3c46a64-e181-448f-9c32-609922a69787", "comment": "Malware payload (Heodo)", "value": "8796dcd64cd323c6620e2a75d2af0245", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802079, "uuid": "90b608dc-858b-4995-a35b-00908a445b06", "comment": "Malware payload (Heodo)", "value": "495f2fe0790126a2ca79ddfce6c172d0c8bbf0c2c2c16760a8df8743c12b03a8", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802079, "uuid": "7fcfb76a-ff57-42b2-b598-7d68e8f8b49f", "comment": "Malware payload (Heodo)", "value": "42c6cec1ed7f98978ff9034a0f028ad8ddfc2896", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802079, "uuid": "e11a8b48-40ba-4eba-8bba-9e67f7664483", "comment": "Malware payload (Heodo)", "value": "b244ae2c4d58a420d934924fd974c455bcee31b1d5490d76376c95452aa191bce4078c988a990d564fec1b2764b4a1e9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802079, "uuid": "77f0edc1-6953-464d-9e6b-6f564fac39e7", "value": "T146948CCD33D343A8F96FC934C9234A72F971FC454370960E029B26A9DE2F354962966B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802079, "uuid": "9cd8ffd6-e7a9-43a1-8624-648cbeb1a8d1", "value": "5cae15fda9b6e32354785b7e615dd904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802079, "uuid": "116a0e1f-e9f1-47d7-9432-cb460ce62e7d", "value": "6144:HRNTd2x9WN4bAFWRFNC8x6SQEDM3AD2lUpDi6uGGYiyUH7zZHTzy:xGbvvVLpryFXdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802079, "uuid": "9c9d4da1-932a-44cb-a901-b2f79fe747b0", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802079, "uuid": "ba6c0564-ce75-4066-8bd0-f1bbeb2b2f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802079, "uuid": "f12eb9e9-0ee2-45ee-908c-d127bc1ce934", "value": "DEtde9.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a8330f-f1a4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655844899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844899, "uuid": "17cbfc63-501b-4902-b075-e4803452c5d8", "comment": "Malware payload", "value": "e7e2f80bb3d14a8f6d3bf427406e85a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844899, "uuid": "03dc56e3-ee59-43c7-adbb-658a8688d8fb", "comment": "Malware payload", "value": "4a1096ff69db88fd83c9ad89c8d0af3dfaa1ee8a9f5c6e5a5e02647739534e94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844899, "uuid": "44b9e5a4-9808-4c9c-bd1f-88b347fb9052", "comment": "Malware payload", "value": "56664dbca662e900748042d97e615f7eb0a531ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844899, "uuid": "9758c370-e404-4c62-ae1d-b8fbc169034b", "comment": "Malware payload", "value": "5a28027af809a82c33a117dd39d55188336ce7abbe77d80b634ab405b53334ce62d7d48075b66a1553cca8085b7d7578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844899, "uuid": "48867f17-a68a-47ae-9cfb-f0c4889b2ebd", "value": "T19A84BE00BA50D835F5F712F84AB6A26CB93E7AA0572450CF62D52AEE57346E4FC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844899, "uuid": "ebdcfea9-5e23-4ffe-b990-44e674b31fd6", "value": "dbe7c866442b2c90ddc4d147097c4eb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844899, "uuid": "f9fe9edf-1c34-4697-ad64-34f829d1762d", "value": "6144:wEFe0KuFRe9/gjE8VhKIM5DuL29VRbH9zoXHqyVjFVXtME4Asa/NW:wEFBKcedgjEehKIuDuqFH9QjFVdMpGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655844899, "uuid": "10ddba2c-4761-49d7-b5d4-1bf7bf6ee155", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655844899, "uuid": "aac53085-b333-4479-94ef-f08a14c8ef99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844899, "uuid": "8ba8ad74-7d4a-4105-a50b-0e992fd9bd51", "value": "e7e2f80bb3d14a8f6d3bf427406e85a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240c082a-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655802262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802262, "uuid": "3f175f63-e4bb-45d4-87ff-d1fca997c675", "comment": "Malware payload (Formbook)", "value": "1d82383a97676c0119586294847d72c4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802262, "uuid": "98cf6c71-5933-477a-9e4f-06d21b6344c6", "comment": "Malware payload (Formbook)", "value": "4a484a5d70b16a279ea706a537405a9163c26fb4fdb73ffe894ba0f424e57277", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802262, "uuid": "3406044c-d4e2-4077-a389-52658be16589", "comment": "Malware payload (Formbook)", "value": "e235ee979b771fc57a1591c3937964e8737e6522", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802262, "uuid": "07a516c1-ade1-41e4-881c-425a7ac45ece", "comment": "Malware payload (Formbook)", "value": "a805377f9f061b91fa0886a937da7a421b6b18a991cfefa09a837e2c6088025bf3984214820766a06e2eeafb7d34a577", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802262, "uuid": "6cad287b-8605-4715-bd59-1ea038c35254", "value": "T13A63CEA637EFB116E3A127B2CE2C1E956402DC1F5A21D14144A8F268B3B6E47247369F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802262, "uuid": "95394b90-47da-4ade-826d-bc424bc240f7", "value": "1536:mHzAEi5SnMBlbrJEYg2a4S9MxrodDSxnb4SeTdpZjo+l:mHzAZ4nqlbrJEYRa5WokxTeppZjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802262, "uuid": "a37b9a5f-ae5f-4bfc-9dbb-8ebb5bc6de65", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802262, "uuid": "9cf873e7-0304-4130-9801-00b1daf1c66c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802262, "uuid": "95167d8e-872f-4954-b484-f0b4b78a920f", "value": "Doc202206201627.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bfbc5b-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655802129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802129, "uuid": "791e5bf5-c425-41c5-b6db-0fbfc02179c7", "comment": "Malware payload (Mekotio)", "value": "1a515d2f5cadf1adf6ef13625777f9cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802129, "uuid": "e739d65b-6961-40ff-a9d1-f903960c53d1", "comment": "Malware payload (Mekotio)", "value": "4a68f0ad3c0758aeae9675c4b62260922a0f09cdfd5721bfd25fbf12b00db614", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802129, "uuid": "c7a2821e-fe82-437d-b11f-02f31bae7ea8", "comment": "Malware payload (Mekotio)", "value": "5633963055415e954fda91653d172084cc32af19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802129, "uuid": "431ab40a-ca53-412f-8a4f-d2ab489b77ec", "comment": "Malware payload (Mekotio)", "value": "92adf6c167ae98573d55721e3f3dfbf7f769af71e50975e44671505e3cfd70ecee9b57b062668d61567743f7e31ea2c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802129, "uuid": "ca3608f5-376d-4480-8971-9fcb9b49f77a", "value": "T167A623B710807EC7C26593B7AC2788098C19F976CF06262AF46F9AF5819614DCFF4B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802129, "uuid": "87fa44e6-e687-48b5-90cc-95b5924c09f5", "value": "c43bbfdd888d4c0ed147073829f52e8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802129, "uuid": "1f142117-5ef4-4f3e-bc43-90c907c38389", "value": "196608:7SjsMW7PdrNJq0CpPvQUNgBkBVTeUGM/5fpdX:7+sMIhq0UoiPGMBfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802129, "uuid": "a5e140d4-bc8a-484d-953c-94e649e5de35", "value": 9607168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802129, "uuid": "c0f68d82-15ee-4046-a985-c7453abcbcf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802129, "uuid": "fa8aec1b-4ebf-4fbd-94f0-278351e7e039", "value": "4a68f0ad3c0758aeae9675c4b62260922a0f09cdfd5721bfd25fbf12b00db614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bae17b-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655840569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "58700338-015a-4ff1-8bb0-3a30a2f7ba22", "comment": "Malware payload (AgentTesla)", "value": "34775859e5a79f6010b59f5ce13a2067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "61a2ecf3-ca2c-4698-89bf-5e7964a977cd", "comment": "Malware payload (AgentTesla)", "value": "4b3c5e1e79edecf82cb6b460f37a5eefcc6aa209a6419ab3a7a4766e14f4c43e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "6891f68f-d2fd-4ea8-a879-371807ba00e9", "comment": "Malware payload (AgentTesla)", "value": "d05e0d302a54e8a3d6ed85d5b57657959cbc5350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840569, "uuid": "e783cabd-bf38-4f96-91c2-98b53652f684", "comment": "Malware payload (AgentTesla)", "value": "74344f7c0c89b4f9311a29fe99914d5cc4abb98f3bed84dc7e0a55a4bbf6f674ccb1f95f06317417a45d6fa11ecf9190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "b4c83bfd-2ba5-4a1a-b3a9-adda40c42280", "value": "T1C715DF03AB849FA0C57937BE8166E71053F6EEC69640C70F3EE8A5DA95732C26E1C345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "1e9c32df-926a-4b8d-8a11-32dfccb76c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "d8404d7d-93de-42db-92c0-9e32f3ebcfc8", "value": "12288:G4lPS+GPjV9nG2lEEPZ7bAq2HmsWQUdUuSZMdleGVw76b4O:GIPSDVJGyhPZvAq2HmGVuSqdluO4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840569, "uuid": "73869dc7-3c31-41df-9f76-51675340ef20", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840569, "uuid": "6a024cbb-b7ff-4151-9bd4-f508e400c322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840569, "uuid": "0d063636-bfba-426b-a159-b1de0ed7c36e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.20873.5973.3559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a4d04-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655782331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782331, "uuid": "544e744b-f303-451c-b8b8-bd5f309393eb", "comment": "Malware payload (FormBook)", "value": "cd6b78a456e3f72a4a48c866602bc617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782331, "uuid": "569d6d91-30b2-4707-aae2-e1572ee42c56", "comment": "Malware payload (FormBook)", "value": "4b8c3b49cc5ceaea396ffc0444d625d7cc3c231b973f2775a23ab3cafece504d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782331, "uuid": "cc2db470-fbdf-49c8-85de-f2ca20f2b687", "comment": "Malware payload (FormBook)", "value": "8e56e555ba4a208f038730c1d89a8fc1b93b77f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782331, "uuid": "2e06158e-2675-41de-9af9-1e338b60dcaa", "comment": "Malware payload (FormBook)", "value": "a720fe288777fd3742bb4290004eba6d6717a926bd5e1ce77044034d549500b867a712ee89f67263c3fcc1c3683829d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782331, "uuid": "2f4d66c4-7ac0-459a-833d-2c6fdb607f7b", "value": "T194A4E0F18FF8BA59E528317774A0A07C77E31D1DCC91A43AD69BF04A74A26C025E1E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782331, "uuid": "7796b932-aa2b-49ba-a8b1-7d45eba84249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782331, "uuid": "7585df18-615c-4f9e-a0a2-907eedfaca0f", "value": "12288:l7KvwR22rmFBbB80bWCp0LfJnhff9Aq1v:AvI22y95WCmlAq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782331, "uuid": "c215f181-cf50-41c8-af68-358aa58f39d0", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782331, "uuid": "e0d2c022-1ee5-4478-b2ae-121713b3acfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782331, "uuid": "bb1a3fd9-3139-4404-a2c5-3b2d22938562", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29221.12172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a3933-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789592, "uuid": "0e019300-c265-4e65-8c6a-dfc6c989d9b0", "comment": "Malware payload (AgentTesla)", "value": "343731d5d284caf32f88cdbd3a132cf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789592, "uuid": "24eea5ab-13b4-4f54-b4f6-8d2875867970", "comment": "Malware payload (AgentTesla)", "value": "4c1df54f64725f9ba42f0224dfa6acd30c88b8d65358a25b28f02cfac08cc9df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789592, "uuid": "fa7cb3e9-bfd0-45b3-a6b8-1f010804e34e", "comment": "Malware payload (AgentTesla)", "value": "301015ff10e329da8c90a438e6a4b6a7906ccf5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789592, "uuid": "2467e401-8652-4e44-a844-c409814ed325", "comment": "Malware payload (AgentTesla)", "value": "3dbaa4382028fc8fe3fa93c3a4e6d67c71eb66f443bd1d060d4ad7570a06c5cb753f992afd082e8e3dabe991476298ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789592, "uuid": "1b904cf1-7a95-4b06-9c4d-825a4c20bd2a", "value": "T10505F0E3BABCBBADE11865B274B4117C23D14F1BD990A425F5CBFD1E20726CC2491AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789592, "uuid": "ce8aa35e-1066-4ee6-817f-c4cb27327d5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789592, "uuid": "4154a605-961c-473d-8a56-7aba41c65bc3", "value": "12288:uB6UvGiUbt6V7LtnN7klOy5/I6Ea/mTZkjW8bUOv9UEfqK8x3L26O:uVv4QV7NVk4MzrmTGXaEfPyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789592, "uuid": "042261a8-e041-4940-bb08-fda2e8d70ea8", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789592, "uuid": "cf481562-7fd8-4ca9-a8d3-9246922d4955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789592, "uuid": "7b6f686c-d720-4aba-a5ad-b68243ccadbf", "value": "SecuriteInfo.com.W32.AIDetectNet.01.30603.30522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a738d7a3-f174-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655824386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824386, "uuid": "6800d330-9cf1-484a-808e-dfa28c1cd039", "comment": "Malware payload", "value": "3ef723ac72377cea9087524c67cabee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824386, "uuid": "d8dbed09-2cba-46a1-949a-6a1130c715a7", "comment": "Malware payload", "value": "4c25b76dbe83a3b020175c5b623b30dc3ce29403a2afc3fc5613d22cee3d7f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824386, "uuid": "86f32486-2486-4612-8177-8af3500e0d2e", "comment": "Malware payload", "value": "534bd5e970daff3b0627a6175acb36e27e1eff9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824386, "uuid": "728df4cb-7f0d-4043-8b48-8608aed8eca3", "comment": "Malware payload", "value": "87563aedda6db0f67b86a74ce6c938957b59b44f796326f19b59922bd5004e652318353783bc8415f330f7133bd385b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824386, "uuid": "4095d5c0-ebf2-4016-9f9c-0970251e17e7", "value": "T1D7E4BFBC76087CD6A66F467BD996ACDC13B627729AC7A8CD4064BBC30563371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824386, "uuid": "d753da80-43bb-47a0-8a1f-6aff92ad4f01", "value": "12288:/E9rd0ARo28q245owcDnq1rlqQwCRwbymGAAl95uI6hrwk+wB0Ix:/E9rd0ARR8qdowcDnq3R1/AAl9h0wkLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655824386, "uuid": "fbbd3a1d-4dea-48c7-b26d-92666fd5066a", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655824386, "uuid": "c7b09b65-f5b3-4180-81fd-94229b75e85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824386, "uuid": "6a12eddb-c51c-4b15-b835-e146727ad87a", "value": "mu7en.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0da4c7-f161-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655815989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815989, "uuid": "c7eb9717-65fb-42aa-9685-c35a4511fb8d", "comment": "Malware payload (AgentTesla)", "value": "5d4d5bf525c3b1bb357b93337de696c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815989, "uuid": "eb40c3ce-7e7b-4036-98e8-037ebb544745", "comment": "Malware payload (AgentTesla)", "value": "4c621365f8ce1b27d309a68a5a73000b5c5d75269f00df6852dbcff0718bedc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815989, "uuid": "a2048d69-8c0f-4bb9-a849-ef76d1eda855", "comment": "Malware payload (AgentTesla)", "value": "13862396bfd19ffbb3473b3a997cfab7f2825e9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815989, "uuid": "6dfea327-f870-420e-8577-553091429708", "comment": "Malware payload (AgentTesla)", "value": "d9fc628eba191effadb67a816bf62173543c2e673648fcd2894106b87cd284e8c25fe0ee7a3332626b027996ba18705a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815989, "uuid": "685075fd-a47d-4e28-b84d-bfa6a329a906", "value": "T19E045C5FED00AC8CCA7509FB2B35D3006D687E52AE1F46DD238CF68B8272545662C6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815989, "uuid": "30341017-385f-49a5-b6a9-6e9d91605e03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815989, "uuid": "5e54256e-01fc-4282-983c-4a1e87de41f7", "value": "384:CULMg9lvTxrg2PEo3y83Gj6hUCiXzNXNoqjrooAz4oxXZbenu:fLvblEUUNXNoq/ooAz4oVZbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655815989, "uuid": "04476449-f5f0-4f5a-b7bf-81075e1137f5", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655815989, "uuid": "f802c745-5dec-48fc-893c-d4a4c1abf2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815989, "uuid": "e35f9962-15b4-4661-af37-707d236867f3", "value": "Order12600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d74ffb-f1a7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655846266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655846266, "uuid": "d1a1fd84-5ba6-4172-b1f1-ac25d59f67cd", "comment": "Malware payload (Formbook)", "value": "b3e3fb43e334ac32e489fc24c2611880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655846266, "uuid": "29bc846a-cb1c-4885-8514-6fcd08841304", "comment": "Malware payload (Formbook)", "value": "4c6b6a0d8fe65e6ebc0ed7dc517d539fa5702162fcf3b15fcbfc1c2c74a5fb0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655846266, "uuid": "c078a273-6dee-49be-bdf2-472c11048c83", "comment": "Malware payload (Formbook)", "value": "e46377033e60a8c14898db88a48990b745977d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655846266, "uuid": "f2820c29-f350-4d65-ac56-6f5ad344d11a", "comment": "Malware payload (Formbook)", "value": "3b803b608e4bc1ff11b3c59433b0af1907c95a012bb131eb42890e450d8719c274e32eceb3bd55d38618991c3b17a0e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655846266, "uuid": "20a17f26-cfbe-4f0f-94f5-cb9823425f2d", "value": "T148C4E061EEEECDAEC436147C143041400AB2DF8B5643F7CA999DBC799C35B02AAD593B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655846266, "uuid": "2da0a602-08d8-48a9-83e5-8215b3d2b676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655846266, "uuid": "81b1c6f8-20a3-431e-a6f4-a65a6b2ce791", "value": "6144:2rl8pQcQMw2ZYt8Yg4GcHnzB6UdYIji+mBXjdX7api2c91HTfOZ2qP8NnUjWxHE+:2rl810I4DlLdYbtXO3c91zWZ/PCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655846266, "uuid": "eb1bebea-7c91-41c7-9c66-76cbb76e517b", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655846266, "uuid": "fbbaf702-9c21-4d24-bc1c-cd2e847def7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655846266, "uuid": "4c071650-9d4f-4f21-9d59-ffa95d4a9daf", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ef15ab-f10b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655779037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779037, "uuid": "a8390351-ed5d-4a3d-a983-d23b926c2901", "comment": "Malware payload (AgentTesla)", "value": "b0155b0cc54388512232563fe9b9e5e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779037, "uuid": "f2ac0767-a215-40b9-affc-8ece8066dbc8", "comment": "Malware payload (AgentTesla)", "value": "4cb7c0c7bcc5e7bdaa04224e589f14907593178e541e9bae9bd7c9e5f6cfb4b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779037, "uuid": "2c620e54-88eb-43b9-86ea-0c7563f7c2d8", "comment": "Malware payload (AgentTesla)", "value": "b826fed3fa1e4236590194a314d1ab3910659d0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779037, "uuid": "a3ac2154-50d2-4059-9a76-a6b9035bd05d", "comment": "Malware payload (AgentTesla)", "value": "faf04ad90e0a8f01de1be74ac959f6015b696fc52b358bf31482ae5c73d79737bc6d0c5537956cf7249a83fc943a67a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779037, "uuid": "31d6b31c-0aa5-41f8-9ce6-3aadc73745d6", "value": "T12A55BE1137ED0A17E2BF0279A8B146058B71F6A22652C75E775C811E1FE2B8489733FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779037, "uuid": "a1f666ed-e31b-4f1f-a2d7-02cd2af8226d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779037, "uuid": "ca99508f-36f6-4908-ada9-bb0a5169f465", "value": "12288:SfRzDzZf9uIsRaMDfMjQqyTsgy/QqYddOztbM/6TJC1ga9bY7gDHr1OoIpvwTjLD:SfR2PhDsQDBq2KM/6TJCZ87gD4vwTjLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655779037, "uuid": "b12bb8af-e7f0-4e2e-a936-c22153f7d66a", "value": 1328976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655779037, "uuid": "78630e43-242b-4add-873c-20f4e1f659b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779037, "uuid": "d4831f6a-a1f3-4098-9988-7bb09f8874fa", "value": "SecuriteInfo.com.Variant.Tedy.125787.24718.20339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2cfa90-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854515, "uuid": "a1293038-9cc1-466e-86dc-961f4d253b09", "comment": "Malware payload (Mirai)", "value": "2c6970a005cffecf0a463fc9d08ea845", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854515, "uuid": "62d12208-23a9-44ae-ba98-16e80f9a2715", "comment": "Malware payload (Mirai)", "value": "4cd0133d5964ce06f7c1f25703553157584fa154b0d5b698ce8d95cef9e57f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854515, "uuid": "c490fae6-9432-4920-a98b-a876e604c05c", "comment": "Malware payload (Mirai)", "value": "3879865318d77491ba7535913cf521a7a4f551f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854515, "uuid": "e74cfdfa-8bc4-4c37-87b7-980347cdc605", "comment": "Malware payload (Mirai)", "value": "3b23ab516a24b06d55f147bd49aecad00d3cb6797ba9045fd4759839c2e8b11b5de8d189ccb1f56c185e5798f69ae8f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854515, "uuid": "ea4ac1be-5cd9-4a50-be0d-b6eb328d345d", "value": "T18A6329AAB8015D7CFD4BE1B940560F09B82033A05BA35F27A697FDB3BD721D5AC19D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854515, "uuid": "aa7e962c-fa3d-4c67-a513-41c905317566", "value": "768:lesyfYhu1zZ1JWHh0sb7QA5O+f1pryXthnp8dPp78LswZPP7UQa2CbHGvJym:l1oty7QA4g1pmddp8dPwswZPjUQa2vRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854515, "uuid": "aae07167-b2de-4198-9454-9148828f7333", "value": 68740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854515, "uuid": "f005a298-ef82-4cf8-ad31-5205b6184ac7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854515, "uuid": "fa3d2d71-c3be-4097-80cd-8bdc247adb3e", "value": "2c6970a005cffecf0a463fc9d08ea845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d75f792-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655799674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799674, "uuid": "f89fa879-a1eb-4721-b84a-d95cbcaec8f0", "comment": "Malware payload (GuLoader)", "value": "9d4e00cf356d74b47ddb0c9247ae2d69", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799674, "uuid": "e34b319d-2ef7-4666-ab1d-f961cba1e692", "comment": "Malware payload (GuLoader)", "value": "4ddc3f359ac87cbfd3141e6eef4ff231633444e9e865b66e3a8e91702eba39d7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799674, "uuid": "e5d398d5-c4a4-4f57-ba59-04af218bead6", "comment": "Malware payload (GuLoader)", "value": "7b4e230a8d10fd8aea8d9c4f12ae8402be4260e7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799674, "uuid": "22a57d90-4bc4-4198-9d06-0882d9eb148c", "comment": "Malware payload (GuLoader)", "value": "3d532e1d26bd407d515912d1c85974a5ce5e3aea89badbb67b47fa87fb0fbb27e1d25ac61bafea0b463ac8a2f822288c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799674, "uuid": "3025a898-e082-450a-b948-8250f21cd3ef", "value": "T12C65339E5AD0BF1D53F04D4AECFA10EC425FB4A13ACADD811B075E7315369C706886BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799674, "uuid": "97917636-8086-4cd8-ae25-63bce1bfdd33", "value": "24576:Q1hh+u7cLWcXel24Zbu/67LxRdOy5xtTF97UbLL7ImbEfPtt0u6Yk9uzkzdAf:w+NNXgj0/mLPdp5x5F97avunRDYef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799674, "uuid": "b3459741-c673-4396-a009-31c1fb2dcbb1", "value": 1535259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799674, "uuid": "c62a3dd1-e3ed-4ec2-b4bb-c3396f8ebdfd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799674, "uuid": "0aaa8246-8956-4872-bcbc-eb21a9a5aa8b", "value": "SWIFTCOPY_INV50004879_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e591267-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655851805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851805, "uuid": "3f88128e-b29a-44f3-bcac-e0934fde0b3a", "comment": "Malware payload (Mirai)", "value": "a0db15d6c795c50067d0d6668d7800a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851805, "uuid": "a211f213-bdfe-4dcc-b6c8-8e981cdb8349", "comment": "Malware payload (Mirai)", "value": "4e4571dd28228fa790885286c2b4b806ed4c510104fb902f51625ac355ca8cc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851805, "uuid": "2be5abb3-36cb-4665-8ff7-779f8b51c794", "comment": "Malware payload (Mirai)", "value": "eb6c25705cb631a626ac9caffd45c07ad086d557", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851805, "uuid": "090fc50c-a6eb-459e-a0d2-fe8f89e5317d", "comment": "Malware payload (Mirai)", "value": "12740c527397af4a6c421b525c3ce1059878390ac54b12c13083b59b534b238b5ae93cbed018abbf17c0689d7ce0b521", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851805, "uuid": "d6635921-6c79-41ce-8ce0-1513b4440965", "value": "T1D0733BC8A493E8F4DC1406792176BB735E73F13AB139ED9BD3E99567A801B02D00A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851805, "uuid": "da7e5933-f855-4c7e-92af-52b47ab9237d", "value": "1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLugvSWy/ReAwJt8A73ely:s39HJ2f4ol+QLk+ltLugvSWy/oAm8iu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851805, "uuid": "a87ed4bf-3a09-4618-bfaf-4114caea1892", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851805, "uuid": "6ee408d2-d5cd-4d67-9f50-c7bce59b3ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851805, "uuid": "45099d2b-b23a-44d0-8398-07535e859b97", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fbaa8b-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655825453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825453, "uuid": "6eca0f8c-0003-4a81-aa8b-c8cf97f5c615", "comment": "Malware payload (Heodo)", "value": "8d170e00a7ce614ae7b06d8b84c16d33", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825453, "uuid": "ccb71c3b-3293-4bad-8187-690e0274c343", "comment": "Malware payload (Heodo)", "value": "4e74eae21b7d5830b494b55f2b35718c126bcac46c384f856fe7f90a20f17eba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825453, "uuid": "9cce0d9a-2662-4a41-916f-c3131af8a5cc", "comment": "Malware payload (Heodo)", "value": "1bf217fff6c15c6420626eb41d85d33b199b0b77", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825453, "uuid": "e214d3e7-ecae-4690-9319-dffac86e5d8b", "comment": "Malware payload (Heodo)", "value": "de1bfb52cee5cb0c628a3ac8a4a19f2eb89bc6208f7476a362a2fc94c73b24c28c51e0bd5e810185a09e73a1b1cc2dc5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825453, "uuid": "4c83faf7-b0e8-4fc5-b3f0-53f426b85ecf", "value": "T1B9648C0236A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825453, "uuid": "c333e84e-810a-4abb-b259-037e91d932ab", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825453, "uuid": "60582476-cf79-4d6e-afb0-7add52cf4b84", "value": "6144:JqdSTDcHe3kjHfNsQnxXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3xIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825453, "uuid": "abe32e97-db25-4f13-a4b5-134890ce810d", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825453, "uuid": "81a609b6-7e6a-43a2-ad65-9b1a7b113eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825453, "uuid": "cb814d2c-3418-4c28-afc2-1a128652f079", "value": "0PPPoJ9xqWGcgGdP0jkvymlIq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012a5a9a-f196-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655838710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838710, "uuid": "1531b35a-599c-4009-88fb-6e60bce36c60", "comment": "Malware payload (Mirai)", "value": "dbf6037d83f9ea8d6f2d4d214cf6e5b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838710, "uuid": "1fefce90-ba89-42d9-9b71-6d7db5102794", "comment": "Malware payload (Mirai)", "value": "4f4c490a7b530e191545dc70316bb062eed4efb46585eb16b324b2da8eef7d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838710, "uuid": "bb0900c2-1e17-4e4c-99d4-e04769dead15", "comment": "Malware payload (Mirai)", "value": "ea6081f9ac5967ae59cf57a3fc57d858cdad484a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838710, "uuid": "579dad11-2f1c-43f3-81b8-5544a121173c", "comment": "Malware payload (Mirai)", "value": "bb9d1054dd440fae9f3505dcab3e6d16c2cc6a8068a01a7eaef32f407969c7e4788c396c366c47375c241905b06368fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838710, "uuid": "12af7ac5-5551-49da-9c10-9d93d0a04062", "value": "T166934BD6F8009D7DFC0EE6BF44530A09B631B3212A930F3A66ABFD536D320A53916E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838710, "uuid": "eb8cb1b8-f96c-4668-b335-7ab633d9a17d", "value": "1536:YV30rJeRhVzPU/WCXONjfOOyVUq88/oyAQEfJMqf7rY/E/TPViPPehEA:YRiJeRHz8ORxfO5VUqyyAQELfHYsQ34l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838710, "uuid": "62664410-ee0a-43ee-be1c-745d673d3011", "value": 96764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838710, "uuid": "e97a369f-f23c-45e6-9471-1186458c057a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838710, "uuid": "f53d2ca9-75ee-4275-8ae1-81e28e26c015", "value": "dbf6037d83f9ea8d6f2d4d214cf6e5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcbcf00-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803030, "uuid": "992ec9f3-f9bd-48e3-b638-20ba83d1e2df", "comment": "Malware payload", "value": "e3281f0f5840038135e319419e3d5338", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803030, "uuid": "9dd4bb98-18eb-4b70-8318-5a430339f663", "comment": "Malware payload", "value": "4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803030, "uuid": "e63094e6-fdfd-4ed0-bd5c-e08b76978e11", "comment": "Malware payload", "value": "56e7318683cb591051805d6018f619ca2937eda3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803030, "uuid": "83513a80-d1c8-452c-b430-1813cda8a3a6", "comment": "Malware payload", "value": "3fe59bdab457aa8c733d1e90e0992438bb873c93b33da4c26518bfb717b6a9d3c1fe22ed3cc89d0f8370178ec1a12737", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803030, "uuid": "26f6b70f-b79e-4572-b669-1141f2450350", "value": "T1C0460141FA95BE53C8F28336453ADB76E40A4D249F43C287690837BD34BBBF44A416DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803030, "uuid": "db1ce04a-556a-4d0b-9756-7d6743a0c734", "value": "98304:vuRK4SpHgGnExGDtQuh9t2bJP5fkBMx2XEx3+N0jzMGoKShot/ujTc/:GzSpAhInQbNNOExOkMG3aotWX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803030, "uuid": "8ce8fa80-49b4-4dde-8382-1325c75e6036", "value": 5466209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803030, "uuid": "e58e54a8-c881-4e12-83d8-e2c491a4da89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803030, "uuid": "3f4e1b79-d913-4ae8-9279-69670165a048", "value": "4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38812d83-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807879, "uuid": "471eeb21-4bcd-4d04-b1de-11b6f6e8ccd6", "comment": "Malware payload (BlackCat)", "value": "64995a7eacf88100bc7eaab123ae5a30", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807879, "uuid": "29f9fb33-9d9d-44e0-84bc-093639ebf1b1", "comment": "Malware payload (BlackCat)", "value": "4fea41b61b2bd700fc6613c18c05aeb4df37bcbe777868081b0ed1076ee7aacb", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807879, "uuid": "35bd8af5-8631-4b83-8ba4-eb3e035db918", "comment": "Malware payload (BlackCat)", "value": "b0b67aaa5d3d843fa0dab87a33a86f0cb9eda744", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807879, "uuid": "b4e707cf-ac42-49e6-a108-dfd052a555bc", "comment": "Malware payload (BlackCat)", "value": "0303c14bd73bfe3d019927f7b5304c25550b5f72633cd8ff43b245a04a5e6229e7176db0aa3e1ab21ba3a3a900b2e4d3", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807879, "uuid": "9873b908-2eb4-4e40-9b8b-fcce28419c6b", "value": "T194E58E4BFA8353ADCE971571305EB33AE6314919011F8EA3F7F49E60BD2E7106948A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807879, "uuid": "557e3e4e-96a7-47d7-9eed-f2e9155260b8", "value": "5cfa80280c095d8ac5899898ce966027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807879, "uuid": "857dfe5c-e305-4104-956a-f74adbeb59e7", "value": "49152:eq+aZMrOQa/RhuhxYoe1JMRPasM8q8ZNy2gJq+jyUTVtgY5:PBMrOQa/RhungJMRu1fJ3jyUTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807879, "uuid": "a5c38507-519b-4132-a592-53de882346ed", "value": 3110912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807879, "uuid": "1d287dff-b74e-4fc5-8f4f-02351edebf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807879, "uuid": "51428e38-95e3-4c6c-8eb6-b146e08334df", "value": "4fea41b61b2bd700fc6613c18c05aeb4df37bcbe777868081b0ed1076ee7aacb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ef11a-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655836059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836059, "uuid": "6fa559a3-3c55-45d8-b20d-e1f8a40d5530", "comment": "Malware payload (Formbook)", "value": "fae4f16aaab45c3783748c0acffbaed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836059, "uuid": "3fa9ca42-7b08-4f1f-a5e3-84ddbbc1ef0b", "comment": "Malware payload (Formbook)", "value": "50398d4e32037d5b75501a7b6046e13bc46438cfb520ee5bef494a0f29cbb2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836059, "uuid": "fbd33bd3-732f-4db1-b446-2408b90856b3", "comment": "Malware payload (Formbook)", "value": "bad48ce864c7068a7aabecc1991220ba70c2741a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836059, "uuid": "9e3ad61e-53c5-4f6b-8467-d6f7eeb1c05a", "comment": "Malware payload (Formbook)", "value": "c075c28a4479203d358c6cd203900174dfeaafe10bb080c6cb159f44c4e9f00e2ededcbf387bb2cfed2ce29cc15abf22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836059, "uuid": "7566e608-d103-4b57-8cb3-60b8289006de", "value": "T1E625E89C321871DFD417D675C9681D68E6A0387FA34BC287B027255EAE4CB97EF210B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836059, "uuid": "220bf5fd-a0bf-4b7b-abd1-e4cb44fb7de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836059, "uuid": "32d386e2-baaa-4787-a056-8d7d53971a20", "value": "12288:hN52iNPf+B85FrMq1zGjOxtR0CyAdgUmjERDtGJkNxwN/7UogQ9jT2oiokF1OK6j:l1B+B85FYq1GOEEj1i4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655836059, "uuid": "d0e25151-18ac-40fe-a8e4-bec7af25cf6c", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655836059, "uuid": "7ac5e2ed-901f-489a-9330-00af5cc60975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836059, "uuid": "a7242f6c-9a03-40cf-a5a1-8bb49683869c", "value": "Booking Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fb81d8-f164-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655817242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817242, "uuid": "c7d59814-ed80-449c-b5cb-2ef03deccd67", "comment": "Malware payload (GuLoader)", "value": "a2f6c10fbc69acf34dd67e4daa976181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817242, "uuid": "41960f97-a312-4b5b-8d99-d8c66699d42d", "comment": "Malware payload (GuLoader)", "value": "50afa60744f9cbe3cf51531b732085aa03f8ef1f8dc4bfb3f21595fdfb82bf1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817242, "uuid": "dc2b69d7-1e32-46ff-a295-441380f6e770", "comment": "Malware payload (GuLoader)", "value": "4c602d67c87b6cb7420181b454051b2bfd34e983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817242, "uuid": "014684ba-a634-4630-9c9a-295825f010bf", "comment": "Malware payload (GuLoader)", "value": "af20238d7a33bdc4dc5b44d1f980138b9c5ab55cbdda455a659bfa364e98ce4bbfaefe28200907698a49438e33837a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817242, "uuid": "13b7df17-3ccd-48b0-b36e-fefcb0199561", "value": "T14CD412423BB6D053C8A545B5A9634A76BFB17D000AD51B837326BB2EDD32253E90F72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817242, "uuid": "640a3bfb-9db9-481b-8e75-edc86eec258b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817242, "uuid": "47868ddf-6559-4946-97ca-d259a2eb8a38", "value": "12288:ZbjnMwJlRcPqfX2H4UHiEaoPDJ3cCQrWOtM9IKTQWfsmuYUk:ZbouXcieYKaoP6fttM9IKTQWkmuZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817242, "uuid": "4ffa06bb-03a8-4836-a904-602460524a63", "value": 649608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817242, "uuid": "dc0dba0c-113a-4e98-a28a-b42725edad01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817242, "uuid": "59dd00d4-3046-4f6f-b8a2-bd025de31b8e", "value": "PO 4507596885 CC 4410 LLC GC Auris.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3479f3a-f107-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655777645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777645, "uuid": "8226f9f8-4add-4fb0-980f-977e2fe2c8fc", "comment": "Malware payload (Vjw0rm)", "value": "45ed25eaa020cbb7cc9dc25b8a657e4f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777645, "uuid": "05656b8d-e56c-4c76-915f-2aeb2820671f", "comment": "Malware payload (Vjw0rm)", "value": "50e4af1a3329295449f1d94adc7a6e1e3ae47cf0021a5767adb9e689ace290c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777645, "uuid": "d949b22e-9c7c-42c5-96ac-01c9f02cee7c", "comment": "Malware payload (Vjw0rm)", "value": "10f9b2dd8b4fb03858ac6e557c3f3b969573448a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777645, "uuid": "dbb43e37-e431-4e95-9051-519d6d9dcf1e", "comment": "Malware payload (Vjw0rm)", "value": "2c60dc3f5610b785a0bb256ac9dfaecd46ead4cd6e0c674cd8284a87ae4ea85befdd2d0754ef1c6a79dfb30cb024d638", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777645, "uuid": "f7fb4f25-8abe-4121-980c-7440b832446b", "value": "T172838E80F99025B9B6A124B32CFF390E13F82503A915540AF529F5751BF6BC4E627F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777645, "uuid": "fe21e135-b107-49dd-a547-7e1880c793fb", "value": "1536:RMG77U1dvR4dIkXjdM8UfXqZP4jMpyPrTQ+it1OyjqxLwOtZrKrnO+UssP4t:TiAW2G8Xp5volcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655777645, "uuid": "3c3fb4cf-b504-4b1f-a539-8530786680b8", "value": 86636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655777645, "uuid": "94089c99-2013-420f-bc72-556dfd307e5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777645, "uuid": "1d641900-6189-49ac-b317-15833710520a", "value": "Orders #062122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f81408-f1b0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655849971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849971, "uuid": "7e19d94d-17b1-47ae-9e2a-31c25ecc3b7e", "comment": "Malware payload", "value": "6b30061dc516d9c8537abd504b0321a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849971, "uuid": "58f6a711-865d-429d-8e52-82732c2f1e66", "comment": "Malware payload", "value": "5264fb4ba5dac27b8b5d0602963d7401b58f93509b10686302f345691c55797e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849971, "uuid": "13785e44-a650-45c2-867d-1b9cabc461fc", "comment": "Malware payload", "value": "8845f0ef36d4e72d107e6b2484dad4f71b9ed994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655849971, "uuid": "45d756ed-2528-4612-aaa3-916414683369", "comment": "Malware payload", "value": "8d2ac73f11a2e16a5c058f2144049216f5f1051ed6432f8db1fc181417304ddcc17cfef34346f095c8b70d32be9daec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849971, "uuid": "21e57e4c-6642-4b14-b8f1-d8dcafcc4a99", "value": "T1E9F46B8E4384298BDEE947B982F73BA09611D734D41F97074794ADBF532B2C9BE40286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849971, "uuid": "7e537f49-9961-4b81-a297-00bea416f520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849971, "uuid": "498e83a1-8d9d-4301-a7d4-a2635ccfbb93", "value": "12288:a6xHdSE0rMH22qla5w/yXbxmt6hIsUnhCdJAYhSRA9avINBwStMQ3Ry:au9ErMH0MW/IbxUpn8N1tMQ3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655849971, "uuid": "5018ec59-fd64-4ba2-9763-f3267b02e5a4", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655849971, "uuid": "20f56fd5-7610-4b71-b497-864c9137ab88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655849971, "uuid": "11b2d846-48f0-4fcc-ad6d-2b136377290b", "value": "6b30061dc516d9c8537abd504b0321a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6f768a-f187-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832445, "uuid": "209fef10-ccc7-4628-85a1-0b747cd585e4", "comment": "Malware payload (Heodo)", "value": "7d3d334dc836a8fd3027c98ea4d4e372", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832445, "uuid": "d664576e-6442-4d8a-9d13-084946a2b358", "comment": "Malware payload (Heodo)", "value": "526d57e1a8ca91984b809dae65921ba2b9a6a92cbb2f5c9992ed17b6db64d931", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832445, "uuid": "ef4801d6-4437-4564-b668-76b762358978", "comment": "Malware payload (Heodo)", "value": "a54d88c56878abda122c80607e52233c0908a0c9", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832445, "uuid": "b9782bf5-6826-4404-8c62-a8d8f949a611", "comment": "Malware payload (Heodo)", "value": "db48425ee41cf10689d1fad5d23c58a413e8c5fd1c53b1e730ed1ebb3a6117e2a78ea3a288a41a0cceec0d30906949c0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832445, "uuid": "d63a51cf-49eb-49ce-a1eb-0d71c5a60ad1", "value": "T17864AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832445, "uuid": "2984098b-62ec-4047-999b-03e695421df4", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832445, "uuid": "2c7d0546-cd55-4fb0-8616-6112f5f0829c", "value": "6144:3MiSTD2He3kjHfNsQnrzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3kNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832445, "uuid": "67a6395b-edd3-4dd5-ad5d-a4757baa2132", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832445, "uuid": "2ccac27a-fc68-4f5f-981f-07a65a529373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832445, "uuid": "ba9d22fe-6dfc-4c48-a921-45be55d2d886", "value": "LoiTfzm62q0XCCPK.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddff3a86-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655831779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831779, "uuid": "4dfdce6a-e23d-49e1-a5cb-48adf599b6ac", "comment": "Malware payload (Heodo)", "value": "87aff8abea17083f37c000b2fb4c6794", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831779, "uuid": "681f4faf-6487-4611-9b6b-fb7d61131f23", "comment": "Malware payload (Heodo)", "value": "529d70448ed5cdc0e6bb89432214e880bd53f3fc2ea9117f5a9f9262d5bdd852", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831779, "uuid": "2f5f4223-1e1c-4ac9-8f23-1e67a00e676c", "comment": "Malware payload (Heodo)", "value": "2a1fba1a38841180e3bffd30390db9df6d33c3f7", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831779, "uuid": "9b10091f-3f23-4de7-91b0-f496e28198d9", "comment": "Malware payload (Heodo)", "value": "05b5d42170fdd0a58a6defb3bc9591c458464d32025be29bbd005b387af44121cbffa5caca7061b6af8f9258f4f405dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831779, "uuid": "5a33b6f2-0d37-4922-a1f0-03ed71c339a5", "value": "T1B7B43811A399B49AF4738B7288572A158E27AB0D5F2D87CA1F4397D8683F38C7837741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831779, "uuid": "77e072ab-3a26-4fc2-9409-d4e0c69efe52", "value": "cabb7545764ab18f67f98001a09568e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831779, "uuid": "2f01785b-f01d-4245-9030-be79f1bcba4e", "value": "12288:8oMoWNAHPMyd7XQnAvQj3jBl+NKftx+MpUN:8z2763jmwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831779, "uuid": "65a82c6e-2538-4db0-bfd4-682ca7c0251a", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831779, "uuid": "6eb9b777-a8bc-4089-98b1-fc2fcdc495e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831779, "uuid": "ad815766-7510-4667-9777-836e4b3d740e", "value": "7PmU5TR2yOZ.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb59135-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Metamorfo)", "timestamp": 1655808209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808209, "uuid": "3e869307-eed7-4583-a59a-f48728bd9a61", "comment": "Malware payload (Metamorfo)", "value": "22106c1e26e9e9f7df3461d70339f970", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808209, "uuid": "0bdc844b-4979-4d89-b8a3-fafa5b1f7757", "comment": "Malware payload (Metamorfo)", "value": "52b5dfef18f8d33b23f49435084aade5146a8e7096801ad9526b731d374a6c6f", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808209, "uuid": "15c0ecf0-c5ca-47dc-a949-280a1e8c7581", "comment": "Malware payload (Metamorfo)", "value": "37d50c37a5583fcb6c0459a8709c1f417d1232c4", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808209, "uuid": "c6d088c9-fa95-4e2b-a6b5-3ce863a26ade", "comment": "Malware payload (Metamorfo)", "value": "d5be37e97c7696770519f1cb41bbc402aacb5b55fcc66c34332ae6864605b13627422cc9daea2fbd3e3d8991f025526f", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808209, "uuid": "78b4ecbf-7147-41b8-bfdf-f19c56e18509", "value": "T146D52303B7C48BB1E5DB02315A4FC32986765CA04662C917635E6B2D2DF3AB0A7B33D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808209, "uuid": "3e87addf-44b5-448a-b047-114480ffe065", "value": "49152:gkqbsANmYFMSaM+jwvU/PbOp4yvbfAZJH4crC+xjGuJc4Y6v4seZxe4q1/gqF:8bsA8Yv2wvU/PbOp4yzf0H1rMiVp4tez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808209, "uuid": "73f81f37-020f-4407-8823-c74a7de79b06", "value": 2863616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808209, "uuid": "3f0f2225-dca8-405a-b749-94406b7b75de", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808209, "uuid": "9cfdbc94-3b17-4890-bcc9-2f7305ceec90", "value": "BL.373769.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64130b3f-f126-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655790773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790773, "uuid": "ba1519ec-b48b-40bf-bc3a-821ca4a5c0c9", "comment": "Malware payload (AgentTesla)", "value": "ac352f549e99d1a5a07158e47570d2d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790773, "uuid": "3a4c2e3b-7fcc-4c5a-95ad-3ebf34391b8d", "comment": "Malware payload (AgentTesla)", "value": "53e0b900ccba80c6f78ae7f50acf9d91096db97e1a034335be4db1ee1bcc8ee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790773, "uuid": "8d239758-862c-4fc0-9c80-f44eecf283a4", "comment": "Malware payload (AgentTesla)", "value": "26dce2c2ebeb969f3cdcb34edb7445e1b75bfa34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790773, "uuid": "743ac717-8d49-42a8-976a-96f88358ac2a", "comment": "Malware payload (AgentTesla)", "value": "1b2217d09296b997e736691665405c4575374b426b7ff5dfaf4e94d22e5c226e1960f2eb3a7c46ccccc36f2eef1c03a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790773, "uuid": "af3f6f06-e20d-41e1-a69f-c80f73288a16", "value": "T16405D0E87AB0B4DEC427D432B9942C3CBBD1692ACB0BD113D157A09C690DAD7DF605A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790773, "uuid": "3291770d-a210-4c98-a4c2-a80ef6042e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790773, "uuid": "1a4b8c6f-9041-4bbd-b320-23890a0522e6", "value": "12288:4ZvC9D6TKWPqXeHrOCJK1VWF7UND6J24GJ4v/TWIMDIvSMSkI730HbWqanWZlo:4ZvgmTnPbLOJ3xypvSIKMSf73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655790773, "uuid": "63590ce4-82af-404b-b781-817f61872ae5", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655790773, "uuid": "0894d37c-e44b-4f6b-ae99-62528fb63a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790773, "uuid": "7bdeb2f7-ed70-4643-ab40-31076d6fec83", "value": "SWIFT,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a03a98f-f1ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655848416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848416, "uuid": "663e54c8-73ba-4b8d-afd2-10185dd60985", "comment": "Malware payload (Mirai)", "value": "dd1fa3721da0ec9c12eec66f631a4638", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848416, "uuid": "96f9c20b-7d4f-4d78-9c6e-10f2809010c8", "comment": "Malware payload (Mirai)", "value": "53e96f239ef89c5e9cc4f901637eefa9bb3a1863d85249660066364c16770360", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848416, "uuid": "685a1c79-a260-413a-92c8-c2448baf8d84", "comment": "Malware payload (Mirai)", "value": "cd5b691878f52ac0049446bc2ef5567f5e647b1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848416, "uuid": "42d12069-87cd-4ca8-bc6e-224e895bb22b", "comment": "Malware payload (Mirai)", "value": "5a1eb02af4312be22c588efd6fe753a3921cf0d70daff79ef8ad1a9f585bc57f75619d2a7a784224018c58309e495081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848416, "uuid": "a9ced9c1-5cc2-452f-93ff-d182431e6504", "value": "T189D2D0FC4B2101CCDA4CDC7896F447611F140EF3C482E82B6BA6EE82C8565A57CB6ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848416, "uuid": "47c40004-ca46-4c24-9208-7090db82769f", "value": "768:fRqGDPj5KGWFmKTPrKDVXcdbEH92fHdLRkt3/CJgGlzDpbuR1J/:8GbFvbKjrpgvGVJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655848416, "uuid": "3a7a5a7d-c7e8-4484-8449-337d3c440ef7", "value": 29880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655848416, "uuid": "9c1b9de9-2d0e-45cb-b22b-34f9825d0c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848416, "uuid": "3f580c87-8665-466c-9568-c9f89412f78e", "value": "dd1fa3721da0ec9c12eec66f631a4638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793d87fe-f104-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655776205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776205, "uuid": "940894bd-2427-4dc3-a623-ddc86b4733c4", "comment": "Malware payload (Mirai)", "value": "8a87cf19bda8d289736fe2811d342032", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776205, "uuid": "7646ce7c-0c5d-4ab3-8ca2-7ab5bfa83515", "comment": "Malware payload (Mirai)", "value": "5462d98e22f4dc31d18a8ab653cdd711160b2a3a8e6710e7db33cc7698d92aa8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776205, "uuid": "52c4d4f2-dab4-4ead-900d-b8305063ebda", "comment": "Malware payload (Mirai)", "value": "0919483ba3432e280714b79ac465d976316e93d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776205, "uuid": "fd2b08b9-929d-4a56-8967-aa049be82038", "comment": "Malware payload (Mirai)", "value": "2bdc273e951cd9d9ae8081a43d05e44829b2d68178aefa910c9110ea509976e29992e2661fec1bb18904c6e4c954030f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776205, "uuid": "18286151-e8d1-4460-9ae3-d62b541c7684", "value": "T108A2E165268EB910C6A0193ADEAC09D3B59F1378B2ED772C4720B29CBF8164395F41C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776205, "uuid": "a2a250cd-2ead-4ee5-8940-e586c5aa3510", "value": "384:UMTXxFn2W8cuADu97MNAR5reJerec7hX7PW4mhYfiOXQm7pGmonkhymdGUop5hH:7TXxMJ4DuRMNAXe1AhXK4mheiWxIm9sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776205, "uuid": "4bbe2d1b-48cb-4899-9c0e-19b7c64f875b", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776205, "uuid": "93975b62-06be-447a-8944-9bbbc2fb1b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776205, "uuid": "0d1c681c-1c97-4831-b9c4-4609b5d982e9", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fbb99b-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655799633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799633, "uuid": "e0823bda-21a8-40bc-b250-3e3263705053", "comment": "Malware payload (SilentBuilder)", "value": "c868887795d71313185169ed7f7a6ba5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799633, "uuid": "3fd3725c-4775-4b0c-8e24-a52f416578e5", "comment": "Malware payload (SilentBuilder)", "value": "5553171d17e4edc74b4863d3ca638a60242302daec3c744dc887d64f35557227", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799633, "uuid": "7acf250d-2486-43ea-8473-182082738702", "comment": "Malware payload (SilentBuilder)", "value": "8dc05a7bad05a0247c80b1aa17dfab394b89c54a", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799633, "uuid": "e68783cd-fb98-499d-b936-1715ff7119d6", "comment": "Malware payload (SilentBuilder)", "value": "8e7f2707a9d875f50ac863fe365d207e46f207f5191db05f6544b3a895dd6f6133be0fddbef6b477d1937f8bb19e19df", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799633, "uuid": "1f31b61a-a9f2-4fb7-97e0-047487667329", "value": "T1BC33D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799633, "uuid": "dee311a6-1595-4894-9aa1-cb9da9f421aa", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKb:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799633, "uuid": "dca42c30-5689-4bc0-8432-c321384b2516", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799633, "uuid": "78bfeb2c-784b-48bd-9222-1831c5aa2222", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799633, "uuid": "70d75fe6-6851-4f60-b75e-7ce3c75f4d0a", "value": "46265N_608.doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed76119c-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655823215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823215, "uuid": "c808950b-9746-4b46-9a54-bc6b9d2c2d6d", "comment": "Malware payload", "value": "fe5103c17da176f4f9db6e91d295f9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823215, "uuid": "0c1ccb7e-ea3c-4fea-afb7-84d4e7342eda", "comment": "Malware payload", "value": "57882374bf128a75da03b6b740e6fe5e9b95e88b2252ddb8ab4bd26567e80a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823215, "uuid": "5b23645c-1308-4cd5-a22a-c2898ec6ff65", "comment": "Malware payload", "value": "6f6a965dbe533c3ec7b28a1666a83d10e807ae84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823215, "uuid": "3f600fff-abb8-43e1-b7a5-88df9fc49c88", "comment": "Malware payload", "value": "4ace17a52749e2f078b85393fee9801655aed50f8b1cf03fe0b75757449d76296e6d3b47dc568a62e87f34ffcffb40e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823215, "uuid": "7cf85912-074f-4ba6-8bca-5762da5f5b2b", "value": "T17B052350E388AC27F9520AF429969B5CC7EADED4613235D707193C45AAFB6334F1B3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823215, "uuid": "f39d2ef7-392a-4864-828d-396a7f017c4c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823215, "uuid": "bfac6878-6bef-4073-ba62-b05ca9c2fa05", "value": "12288:EbtXkfkJiJFSwR1AMfSnYvGJFXNF/0AOuVpdWKiBwqEt300JggNkZH:Ebt0sM2YWJFX4yBilgkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823215, "uuid": "1a6b6eed-a0cd-4eb9-97a7-118c2a628d46", "value": 868160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823215, "uuid": "beeb6980-e6f4-49f5-bc0d-fc2dcfe0010e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823215, "uuid": "019e8429-ebf5-4213-ac12-e527e06b7621", "value": "ABS List of Items to Purchase.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a44d761-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802702, "uuid": "4b8ea040-978a-4d2c-b665-af9b5a7abc25", "comment": "Malware payload", "value": "678b0232dcc2eeb23ede8de6b29a06dd", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802702, "uuid": "7f9fe27c-d897-491e-9679-fdd26f3af378", "comment": "Malware payload", "value": "57f8a6dbf30cfe4debcf7ccb970aa064c05e37ba7ee3241a10eda6699909289b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802702, "uuid": "bae63779-289d-4b43-b508-f2d91a066be6", "comment": "Malware payload", "value": "95786b2d397d8c97e9951c45df4cd0c0c4747e96", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802702, "uuid": "987aeac9-cb87-4ac9-87eb-57810947a9c2", "comment": "Malware payload", "value": "afbbe0c95b225bd26a091c27bf53c86d7350b53c53bcb4033825260f654ae0a605c69ee15037d695b4f8d85df9eb6d85", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802702, "uuid": "60e13e54-40c6-4e39-9a71-9fc46eebe8aa", "value": "T17392BE4EC268BC0DD66AD03E41450075A28D72862826EF4F3090EB2A16D31E787CEEDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802702, "uuid": "59769dab-8e4b-44fd-8424-dc2b5dea507d", "value": "384:Dfvh3hi0dYETENwIPixl+dcYlarQ4BmmDdbE3zsitlnninBHr:Dh3h/dBoNwIPix8dcYlarQYozpninVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802702, "uuid": "ec9372d1-0219-4aa0-98f0-488af45a906a", "value": 19356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802702, "uuid": "495dce6c-3e5c-4154-9667-54456822dbc4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802702, "uuid": "8d70413c-ad2a-40cd-a6ea-a079a01a702e", "value": "\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0438_\u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u0432\u043e\u0433\u043e_\u043e\u0446\u0456\u043d\u044e\u0432\u0430\u043d\u043d\u044f.xlsm.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2768c32e-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655809569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809569, "uuid": "8cfd4119-9ebc-4798-aa68-1fe14c9a4772", "comment": "Malware payload (Loki)", "value": "0f80638a0dded8762a55c8c34010b91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809569, "uuid": "677d24ab-b2f7-481d-aec0-8d35f2866bc1", "comment": "Malware payload (Loki)", "value": "58bcc4edf2e14afd8bf7040cd8e184806e9a930cc44f56dec6573dbfdcc578cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809569, "uuid": "14cdbefa-60c4-45aa-ae1b-2a32240eef0f", "comment": "Malware payload (Loki)", "value": "6a8b9995bf37ac59fe22745e4a87d7cf55a1f242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809569, "uuid": "ae69cdb0-63c7-4f12-91da-c80ebaa5960c", "comment": "Malware payload (Loki)", "value": "4eab6ab0ea763bc4621a1a44a1f94563cb75f3094baaa9e3348e4f8388a3baeea1bde36a84ac2fcd34452ebba139b31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809569, "uuid": "41d742f0-469e-44f2-b4d0-f2792f7988ea", "value": "T1C784E003B6F96B1AD9BBA7F656BA10840BB135BE7521F11C8DC660EE1832F044D94F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809569, "uuid": "163a88f2-61dc-458b-bbad-9cba5fe5f94e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809569, "uuid": "117a910a-eee6-445f-b1bc-1705538f7912", "value": "6144:Lcilo/Ewz3c1XDIo98VkjWL4CCeEJV4SOtI/K8pEALOc0VIjNT1qvM9PH:gilo/7z3cGo9I1L4ynSgQKaEALOc/NTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809569, "uuid": "cc0d4922-87d4-480e-8811-4af478a4f36b", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809569, "uuid": "2185e57c-bdc7-461e-82c3-058d1a589430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809569, "uuid": "a4ec6b76-82a5-410f-8230-a15e7f0d4e4a", "value": "0f80638a0dded8762a55c8c34010b91a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b43d708-f190-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655836311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836311, "uuid": "e3281e8e-85fa-486e-8a40-be9ae3890f26", "comment": "Malware payload (Loki)", "value": "24b8ec8a65d36f7b29c0e4d47bb709b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836311, "uuid": "629b3358-632e-42d9-8436-d42850f91faf", "comment": "Malware payload (Loki)", "value": "5a7bcb0edbc90b4899177bbf4f7b582e6713291ec2733beddc8a3b45dd5111e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836311, "uuid": "21967f81-1427-4931-ad2a-0659a3c32008", "comment": "Malware payload (Loki)", "value": "c2e0901e9c7f2d32902fb4cbbeb4e3e4a9475769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836311, "uuid": "e030b1fc-0a0a-46b5-aa06-e1123a7b716b", "comment": "Malware payload (Loki)", "value": "ea417a63c11f2423b6c09df0a98976475188bbce915f9205cc684910a9b452709a7d4938b63d1b91bbfba31b76a19782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836311, "uuid": "0d8336be-a1c1-4d07-83d3-f5191512bbd3", "value": "T1F922D616A3E8C631D9760A355C7353002334FA466C26AB6F35AC620F6DB378086F2B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836311, "uuid": "9bebd260-97cf-4da8-b68a-043aec69bc84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836311, "uuid": "810c5a7a-3e12-4252-9e36-b104c44f696d", "value": "192:s62dsqphk/gGD5JKT9s08AGICjUWE8hWJ:GBpy/gGD5JK+AGIUUWE8hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655836311, "uuid": "bdaa26d6-c150-4b8e-965e-9f18a157ef26", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655836311, "uuid": "8422103c-ca93-48f1-ac08-8c0c4cb821d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836311, "uuid": "4726c652-f4e2-47ec-a25d-412bebd52298", "value": "RE Nueva orden de compra PO-(SAM115903) PEDID.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac90a013-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803779, "uuid": "0adb7529-37b9-4193-bfe0-9bdb3a306b7a", "comment": "Malware payload", "value": "a25726edc4590997aae37ff3a7d68aef", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803779, "uuid": "c83e5c43-d1f6-4bad-bba4-ef852f996533", "comment": "Malware payload", "value": "5b27f1ae22ad6d79a64e12bbd199bd30c4799a39578583a805754134311cd97a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803779, "uuid": "41bb9364-1a2f-4955-80e3-e69f151da096", "comment": "Malware payload", "value": "d226411864e3ea6afbd0d9b63a6a9a76072389cd", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803779, "uuid": "74cdbbe1-97b8-4af9-93b9-2da694c9f712", "comment": "Malware payload", "value": "dc6ac101994f5a79b55301205e4402f552b448cd6d51d067e8e9676ecbc30ac399a3d7e4d284cfc1488b2af6283b7c24", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803779, "uuid": "39d84a62-c91b-4182-a898-f8388f10372b", "value": "T15E73E0DB77F7F6EADEAA833E543C4212556F8CA2CE0CD825692BB31DC474A1894850C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803779, "uuid": "ecda2172-2a79-4e4e-863d-ea07ba4aca10", "value": "1536:2L5zE/dOkOpwMq/vLHXyBmr8E3PD2jHjKDjijzOSKzQLFLQ:2LBE/hOpMr3amr8E3L2HKvijKQpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803779, "uuid": "f3e4d8fa-3b1f-429d-99a9-f116ff30cf58", "value": 73448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803779, "uuid": "1fdf542b-e545-43db-b59a-bd2db13a79d7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803779, "uuid": "6b30ea02-d6b7-4736-91b8-b2b1599cc2ef", "value": "BL draft no753799574.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082ad8b7-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655799638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799638, "uuid": "9688ced9-1c82-4688-a378-d77acf03bd9d", "comment": "Malware payload (Heodo)", "value": "6771a40e7b4addeecd32194743cede91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799638, "uuid": "a05bca10-5bb1-48a5-adeb-e836ada13ef3", "comment": "Malware payload (Heodo)", "value": "5c8321df5e8c8999c79c585a870fa8dd0206a9075e87af3b06b2b95eb097824f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799638, "uuid": "07fb9ef4-1942-4b3b-957f-c2845cb52f02", "comment": "Malware payload (Heodo)", "value": "cd278bcea726ff200c0030fbfd41fe9313c03baa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799638, "uuid": "cd1f731a-ae22-4013-a3a8-811510ddde4b", "comment": "Malware payload (Heodo)", "value": "80d8d32aeb43cbcf2519cce0b67e6343d1edcc02a2ed741420886e15698e468bd27005207525a970c76b300e85e02f74", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799638, "uuid": "991ffa8d-eb87-45e6-a571-799eeab4a16b", "value": "T1AE33D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799638, "uuid": "cd9cfa19-f0e5-4b07-8d6f-010e13a4ff7a", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKf:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799638, "uuid": "fe754f1c-09e0-4a2e-8f81-50405d27bbd8", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799638, "uuid": "6aa78093-a5fb-4e5f-8488-0c6589a1c980", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799638, "uuid": "cc254a87-ac99-4b27-b055-5bccc3ba0d6d", "value": "doc-20062022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac835c0-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655799642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799642, "uuid": "b1c997eb-2cce-4d4f-84a7-7f7ccb371b5e", "comment": "Malware payload (SilentBuilder)", "value": "3aecf5eac9cc2e4434aa95baf588b546", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799642, "uuid": "063329ee-2a3a-4f66-baed-c78ec4147455", "comment": "Malware payload (SilentBuilder)", "value": "5c933020b72e8841dc0e0a0a7636e9dae86218b2c1904cbab277514507e7dd6b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799642, "uuid": "4b9058b7-9b81-4872-8569-21ecafdfccf6", "comment": "Malware payload (SilentBuilder)", "value": "61b2e395e680ed1f3f522b4eef7096f65c784773", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799642, "uuid": "1554a7fc-0083-41a2-be06-30bc8c5281df", "comment": "Malware payload (SilentBuilder)", "value": "429ad6819db7f930791d970d83beeb3972e88418184b724e0653f1511ef53b23e0d79fe1eae8861fcc388de7e1f9ee20", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799642, "uuid": "4390d53c-5fb6-40f5-8aab-e858df068013", "value": "T1CC733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799642, "uuid": "9e5fb3e5-2c38-4ddb-b476-86fad424b211", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJB8:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799642, "uuid": "5b45451f-8cbb-4a8b-a96d-b954f8a1da20", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799642, "uuid": "6c357b18-627e-4cdf-a4b2-f415a635f48a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799642, "uuid": "8bfa4615-81f6-4543-82b8-008c6c943b46", "value": "form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1603ea0f-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655851630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851630, "uuid": "8c955a89-b985-4fe9-9a22-e8fc1dc58362", "comment": "Malware payload", "value": "52cfb8aace75a0b1c967c4e6a11ee40a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851630, "uuid": "d580a433-3f33-4df8-8dda-917ab6452880", "comment": "Malware payload", "value": "5cc2846fe19961fc64c373ce84252a8b742bc6660f4b5b2bda6350cf1d0b0299", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851630, "uuid": "ab0647b7-19d6-4b58-81eb-db7ff00068a0", "comment": "Malware payload", "value": "463ea0133d4d18fa2fdc864718a560b85511a47d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851630, "uuid": "b7148b3e-1364-4027-87c6-5e9079823210", "comment": "Malware payload", "value": "da855ce2a6f91ffff1140eb0cad6413fdbe0f51da04d424714d72717c12dfa60290d06b0204e807decdbed476ebaa8f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851630, "uuid": "c322bcfb-2d9d-48bb-9788-1da8abf55e5e", "value": "T18A648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851630, "uuid": "034f58a8-fc20-46bd-93aa-c18e9acb4354", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851630, "uuid": "7af0c0e2-74f6-4525-88db-512f6abbcd1b", "value": "6144:JqdSTDcHe3kjHfNsQnOXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3OIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851630, "uuid": "4118182d-58b2-47cf-aa3f-dc3be6130f70", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851630, "uuid": "ec9b2a7a-4e66-403b-844f-25e3b6908f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851630, "uuid": "8dacfd9a-801b-4d82-a5d3-74fdcf63bcd6", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648a0b84-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655832005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832005, "uuid": "1691b2dd-e67a-4063-974e-15720cfa07dc", "comment": "Malware payload (AsyncRAT)", "value": "3a3e915d4318c8c68ccd1911d950d786", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832005, "uuid": "48fe3f4a-7372-43f8-8f90-e3ab354fb0e0", "comment": "Malware payload (AsyncRAT)", "value": "5cdc6ad4ef4e82c8926e74345d5feb5e6bc509917531c8f1a4e9846742d429bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832005, "uuid": "bd1bd638-bd94-432e-bab7-62e54c11c40a", "comment": "Malware payload (AsyncRAT)", "value": "a94439273887221da31075662da863cc33341ec2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832005, "uuid": "9d5554a7-5ed2-4f64-a42c-28d141adb577", "comment": "Malware payload (AsyncRAT)", "value": "3dc7e23278f0984566ba60e05bef0c1a6547f9229cb357ce2f257ab0aa7517a648156da5b3abfa734207786491b104c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832005, "uuid": "4eedfef0-4d85-478c-b2ea-5741ab840ab2", "value": "T1A7C3D0002BED8167F3BF4F7059F360624279B6632E06D61E2CC4519B1A63FC59A41EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832005, "uuid": "894f9673-2bae-456c-a802-ffc8f579090a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832005, "uuid": "7fb14cbb-e4c0-4d0c-97b5-cc6f2708257a", "value": "3072:2u4sTx72vGR2fFzbMxVIuUzIhFkvAFA0gjiTySnMQW2c:2u4g2vG09zbaVIDzEFgAPgamQW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832005, "uuid": "1e508594-55c7-49ca-ba05-f0df4570cfc2", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832005, "uuid": "50c85976-cd7c-4548-b61c-b7421fb94134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832005, "uuid": "f2b57394-49c2-43ca-8339-37302b9ddc7b", "value": "Valorant FN.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce9f939-f101-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655774869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774869, "uuid": "86c61ab9-bea1-4ba3-ac1e-d99f1db41003", "comment": "Malware payload (AveMariaRAT)", "value": "f2127142a6e2e507fa331d9560989ce9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774869, "uuid": "b4dda996-11f7-4f38-ab65-f27abc4418c6", "comment": "Malware payload (AveMariaRAT)", "value": "5d15a2d6d7f9c56a819b405667a7ccad55273de55a6ff007d78f6e7a28ebd734", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774869, "uuid": "7019bed2-4135-4909-a9fe-6ce35effe502", "comment": "Malware payload (AveMariaRAT)", "value": "8f33f63ea0bcbcd8623e8fd3b203e5ec4e46523b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655774869, "uuid": "19a1a488-1732-495b-b221-168526c828b1", "comment": "Malware payload (AveMariaRAT)", "value": "2c34fcb5f0603f36f2aec8a4ebae5de0987b6011ef30f314982532cfebc506eb6737c0f76b6df768265e725ceafd80b6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774869, "uuid": "aca4385f-157f-4b7a-8414-94e97117d7a9", "value": "T1FFF4F12A673ABF3CCB9D41ED8D6D4F690D687E4D8261D7F59CAF70D41812738A632060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774869, "uuid": "8f4d36bb-57c6-4bce-8f14-92686ee8df41", "value": "12288:5elqM5LAIe5u5U43ob/QE1e5l6BqJhCO080tCFzvx2rSb57WLq/X7XlISSYAupPo:5elqMJAIe5GU43oLQEsl6Bqhv08ICxSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655774869, "uuid": "5f6ef363-2fc1-4ab1-b016-287031098f6b", "value": 737777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655774869, "uuid": "568233a9-9edd-41de-bba7-fb59ef6c43b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655774869, "uuid": "eabafb82-062e-4da7-8c10-eedabdf8b9b2", "value": "Scan doc651564651176slip PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9f4a6c-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1655802917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802917, "uuid": "88d108f0-0de6-4505-9443-963607e5279c", "comment": "Malware payload (STRRAT)", "value": "d7b9dd8c8988e35424c930b6f14a8472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802917, "uuid": "06458817-52e4-424b-ba28-6a203e8635f9", "comment": "Malware payload (STRRAT)", "value": "5d5080676044d6feec7830dfa7d1cfa28edd7f9948d8489018f040a65416b7b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802917, "uuid": "a9c9bcf1-8cfa-49c7-9f42-1dec19530d74", "comment": "Malware payload (STRRAT)", "value": "8ef48daf0ae415b98a947793462cbb4b9440314e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802917, "uuid": "6de23cdf-af61-49b0-a254-659595cca8cc", "comment": "Malware payload (STRRAT)", "value": "737a41b1d0f3407b754b50b89b1bf3d7d5ddafcb1d302e17ae01c2392d6a3b78c838c36efea452336b3261327a613cb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802917, "uuid": "1cbc7086-3dee-400e-bb35-452e205d3c7c", "value": "T1A5A4259CAA44B5EDD924E23AB17A3DC993E0230BC05153CD7A6D77024B7AB40D3DDA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802917, "uuid": "3e880db7-99ae-409a-99d1-b97fcbdf59d7", "value": "6144:Qou9lTR4JZZL+ocWLab1Ed5UXlU99XQQe5NVLl9N7GALHHHhbwts2ptT+j9F8:Nu9lTqJZHcWLauTbfepN77LHHBMtlTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802917, "uuid": "3bd087a7-198f-44bb-a2d0-c998669d73fe", "value": 467450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802917, "uuid": "42a37c71-5676-460f-9736-dab1a3022a15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802917, "uuid": "b4e56781-5aa5-48a1-9d68-6ad344c16158", "value": "Purchase Inquiry #210620220947.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7a388f-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655801878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801878, "uuid": "343de664-3cc7-44e8-b5dc-a830d4cee934", "comment": "Malware payload (Loki)", "value": "8e972bb9ada1580ae5eca1276480a88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801878, "uuid": "06a8f624-4755-4a5d-ab34-970cd60fec14", "comment": "Malware payload (Loki)", "value": "5d57b0e75708e05cae858f23341dc6abcf30ec48bb6cb21d8fed2483a3f496fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801878, "uuid": "60c7f709-6b2d-4483-91f5-3e32906c2960", "comment": "Malware payload (Loki)", "value": "2c07ba6f7bdba0f6a081cb78c5fd61c97599c777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801878, "uuid": "ee5dad03-2ad9-4da4-992f-d7f6c8667ccb", "comment": "Malware payload (Loki)", "value": "7188e8e43fa524fec0de98b93b4c253ad94591533e42e4c13fe0890091c501438ede2d7174992100529238d72d1063ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801878, "uuid": "92545577-6c82-4402-90bf-07cf2e36e2c3", "value": "T1ECD4F1F49EF4B964E46461B774A0607C77E34D0EDC92E57ACA8BF48A34626C061E1F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801878, "uuid": "560e0825-8da4-439e-bf96-ab149b924ebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801878, "uuid": "682a823d-0107-463a-8edc-46414076b574", "value": "12288:pFv+4YpjcvHDhNqfv8RhG8IyurTyZ9LfSEeQ22fXiacoNRj:Pvt6jcf3C8RhkyurTeReVcSadj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801878, "uuid": "022a0d9f-fe45-4bc0-84db-fc4f7a5fc345", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801878, "uuid": "4432f29a-a959-421f-8881-9df4c41d5837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801878, "uuid": "75a7a88f-f772-4b26-bdba-7c6cdd122300", "value": "8e972bb9ada1580ae5eca1276480a88a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bd223e-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655806507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806507, "uuid": "7e87678e-1d99-4447-90ae-ec851d7a3774", "comment": "Malware payload", "value": "845f37a267db2a70e449a6dce945f154", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806507, "uuid": "11ddcde3-138d-4cc7-8fe4-8a1c08fd7b12", "comment": "Malware payload", "value": "5eb46791149d25af5b5740913d8f2095c6cf5aa4db38598bcf764575f555ee9d", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806507, "uuid": "88024e6d-6470-4b9a-84d2-219c131059ca", "comment": "Malware payload", "value": "437847df78c7d59c003ce31141e52e8f7416b09d", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806507, "uuid": "4ccf3bab-a946-4ed6-ab27-c4a965c17d5f", "comment": "Malware payload", "value": "15322a4c925a48c41c02bddd1bd15ad323e08a15bd5142b51c4ff4338fa7dc291f33ccfc46970876626ab14b63bf9ed4", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806507, "uuid": "1e5384b3-82ab-44d7-8a34-c2e9905e7b59", "value": "T139029C998C10F765CB703A3CB4AE49EFB821E4587C1276832281BB5C07C7B676AD7320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806507, "uuid": "ae3a5eb5-8703-474b-9a59-8bcf9532c203", "value": "192:xrXP/R0g7IOW1tofBxa8toU4axGV/QLdP99mn:dXPXVgSO8SVc0/yjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806507, "uuid": "2736fdbc-c156-4610-bd29-1108c5727836", "value": 8788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806507, "uuid": "e060ae53-edad-4535-ab08-391ce54434c8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806507, "uuid": "2ad8ce0e-9c51-46ed-b55e-24e11c471df2", "value": "AWB#98764PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e0d074-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832994, "uuid": "8c2caef2-a356-4f8c-8211-8e86f91f5796", "comment": "Malware payload (Heodo)", "value": "0781231ed0d9ef20bdeb031ee4aa372c", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832994, "uuid": "2ab5ca62-a54d-451d-aef8-26a2af406005", "comment": "Malware payload (Heodo)", "value": "5f1a46afbeb33f0199e13f843a649f09c0abdf5d6d347510742560ceaf87d5fb", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832994, "uuid": "5e9125ec-4588-47fc-b996-f05604b610bf", "comment": "Malware payload (Heodo)", "value": "1a89f7ac025bed31459b9967f7b1523f28d97e5c", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832994, "uuid": "a933a30e-ed29-47ef-b863-d2132e595fa7", "comment": "Malware payload (Heodo)", "value": "258addd932fd3f7e512509b970a2ec4d0776507f20dc85d69f53d53146b7587e32ece3e1e8986f40cedae89d4ab8da2c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832994, "uuid": "ce5f4430-6540-4e54-bb96-a98dd5a30eff", "value": "T129648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832994, "uuid": "d05261e3-11e8-4a39-a842-ad9f912e7ac8", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832994, "uuid": "98db8eeb-7826-49f9-bab0-a6b6487e6954", "value": "6144:JqdSTDcHe3kjHfNsQniXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3iIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832994, "uuid": "0a9600c0-2519-4ee3-ab00-4fac825e2c97", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832994, "uuid": "bdeb7aa0-be3f-4f00-9649-793d8a7b37ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832994, "uuid": "d06a756c-b2a1-404f-b9d3-f8a4cd0f58a5", "value": "Cob8cQfffR2tYj.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69827e55-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655802378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802378, "uuid": "b4e6be01-3bcd-4186-92e2-37280c471c1e", "comment": "Malware payload (Vjw0rm)", "value": "553ae64ec92c74a02701ca3881915b7b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802378, "uuid": "ae5967c5-aeed-4533-ae8e-6fdd8ba5fc0f", "comment": "Malware payload (Vjw0rm)", "value": "5f8233b2a9235541fd9e1b526c546c911dd69e9ee5e917c2540e2123748a6eba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802378, "uuid": "165de17b-8d50-41c9-8806-3d9e06aa9722", "comment": "Malware payload (Vjw0rm)", "value": "a6c4676312e2bb96226fbcddbed738b30d15ec1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802378, "uuid": "604132a0-e5ec-40b1-acf1-38da3ae62ba6", "comment": "Malware payload (Vjw0rm)", "value": "90daedfd38f5e8ba0f69b7319cf6a90c667df525a61c8702cb39892ce140314290b642132e2b0545ce2f5474e028b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802378, "uuid": "c4b40149-b9f0-4d40-9259-d5ce4b99ca06", "value": "T17FD3A0DCA914F4DED921E2B9767A3CD997E8221BD44143CDB85D72014BB2B80C3EDA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802378, "uuid": "41abdbe7-ede8-4373-aa06-721d19fb09d7", "value": "1536:t7JO1scwDGfC0tt9hd0HEW6S9uvjXe4JXyjy7pS:tF4scGGqqXhSHkEf4JC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802378, "uuid": "dcdac9ad-5fc1-4fba-bd14-0da847c4eec2", "value": 142500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802378, "uuid": "7e23e987-7e98-4bdf-83b5-872b86952d27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802378, "uuid": "67dee7b8-066e-42af-b2c6-38e13d0a2703", "value": "receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3b40c7-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809681, "uuid": "04094363-3977-46fe-b1ef-53f102b33cb5", "comment": "Malware payload (AgentTesla)", "value": "a0c5e51137a752f6f35a11b4f9a4f465", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809681, "uuid": "6f906f51-568f-4459-92aa-6551169655f4", "comment": "Malware payload (AgentTesla)", "value": "5f873f7b1fe694bb316f1353da0f549632f047d131b303aeec2487afc1c8ed5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809681, "uuid": "8582a0fb-db0a-4b46-93fa-07424a14d5dc", "comment": "Malware payload (AgentTesla)", "value": "9ec2a9df346f5d83e41d2e481f65fcf134458854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809681, "uuid": "ab00a5cd-cb8d-4fe1-97d6-3a71b81c0b49", "comment": "Malware payload (AgentTesla)", "value": "702b8e9e4863ae4c391527a48b5b10be581e15d957c9fdf2c1116a20323a3ccf28a3f863097180a09155254878a9ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809681, "uuid": "239537fc-87ef-484e-a3af-bd92ada00579", "value": "T1A9E4982C2F7B67B1B145AC0CBD9BC9A815625710709428B1CD71E392CDF1CEAE92E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809681, "uuid": "0cfe4aac-4975-4653-abf4-0b677385f4a7", "value": "6144:dlkw3OV8+/HtrIN1ZKs2In11BcxQ9KH+XQIS49OSk/Rz8ealZX/9mxJh6GX/N4eE:dTO+N1IWegW+e/Kw9GhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809681, "uuid": "c66210dd-a82b-4b1d-9271-fc2a177cefdc", "value": 713385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809681, "uuid": "1de57bd6-17bb-4ef6-a352-5f836ad71400", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809681, "uuid": "d0a3c17d-b135-4d98-8c3d-18929f16a359", "value": "charlesstart.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d224d2c-f15a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655813095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813095, "uuid": "a56ee8fe-20c6-438b-bbbc-22f4461bb328", "comment": "Malware payload (GuLoader)", "value": "a3a655abe1f730d14ebe7a0346e4bb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813095, "uuid": "b58b1bde-5ab6-41f0-ae89-985cc367ce4b", "comment": "Malware payload (GuLoader)", "value": "5f9bf0129bdf453323b2fa5c3ef6f0acf4be86ffaceaf524d8bb12d9edfc2deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813095, "uuid": "1834fbc7-3ca2-4b0a-be0c-592488ad60dd", "comment": "Malware payload (GuLoader)", "value": "671831c41193ed45e0e55a8163f2e6b84f10196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813095, "uuid": "508ce429-2bb2-46db-a6c9-8816db9d2cb9", "comment": "Malware payload (GuLoader)", "value": "5427aa3d30b0c09e8d8cabb4ff2799a39538702fd254b5a585b6a6bd3869785b4836a587f9bec27d93b7964997b81231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813095, "uuid": "970627fe-f85a-44ae-b568-c6497b003c5d", "value": "T15BE4C092F6A15842C42A1B749DBF4F043165ED989EF2635A29CC73293EF31CB015B98F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813095, "uuid": "06074962-d9d2-4f9c-9fb6-ecbc619ce04b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813095, "uuid": "86edd920-0a24-451c-b409-4bc941b07c9e", "value": "12288:uYqpoZBQTyo218/dJJJ6z61VC+38/n8Jo6:uYCxTyo2K/dJJYz6HCim8JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813095, "uuid": "528d14d2-35d2-4400-8e5f-a66340a447d1", "value": 663804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813095, "uuid": "a48413c2-b6c5-4374-80bc-ef441eabd6ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813095, "uuid": "a4cc6b22-4a6a-4052-b4b1-d400f667d9dd", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.8490.11040.19828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3bb7c7-f167-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655818601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818601, "uuid": "1c2d1495-c41f-4b75-8ad8-d7b9f7682dcb", "comment": "Malware payload (Formbook)", "value": "0e27675635ef7e5475326e19d137b6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818601, "uuid": "9caefbc4-d027-4198-857b-74c6dd85b158", "comment": "Malware payload (Formbook)", "value": "60e52790f183036e12c61a0f9eb0cec90e757f8e862a9a49144849b9ceffb1c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818601, "uuid": "03861c6c-5737-417e-bcc4-9611219c4ffa", "comment": "Malware payload (Formbook)", "value": "25c0dfa8e0039284cea4712acbb792fda42b2840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818601, "uuid": "0ed40363-fd45-4e60-813a-7ce9da1d4c18", "comment": "Malware payload (Formbook)", "value": "53bae09aac7116d4da7d0f885fd5b840907840b704cffb2b9d628e28cb28e96aa039e06d361f6b9ca356b0ebd53f2e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818601, "uuid": "1399bcd2-c0f2-4831-af4b-d8edcf47e409", "value": "T13564CE6776E84B40D5A958B5C4DF583017F6BED76E32F2C93F0866892E023639F80B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818601, "uuid": "76993169-2de2-4bed-aca4-d73d57303388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818601, "uuid": "2049b7f1-e99d-4acc-807a-a4f3bf20ce71", "value": "6144:67eiKcXtg1FHYky+jcCpjzXRVuJ6v4qW8YOBIxSsJohfIMrtUPqo:SSFPy+wCpf9RPUJoBIXSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655818601, "uuid": "892a83c8-c6b9-4654-a29e-21c19d51ea71", "value": 313368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655818601, "uuid": "4a084ffb-d332-4821-99e8-d4584404e26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818601, "uuid": "8963017b-06dd-48f6-87aa-e5814768edb2", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29790.29870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05a39c-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655813606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813606, "uuid": "7cc3c319-b3f0-46d6-beb6-dd108c3c2912", "comment": "Malware payload (Formbook)", "value": "aedfb52791a420327c6a8ce3faa662b3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813606, "uuid": "3c70fbb6-fb92-4e0d-9298-4980161a9d30", "comment": "Malware payload (Formbook)", "value": "6104f7a9a6b6aea3bbf732dba31520ed3be11e00126d350106dfdcf62cbc6f45", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813606, "uuid": "3834f7f2-728e-4f85-880a-d6f7ba06d279", "comment": "Malware payload (Formbook)", "value": "9a1815c8af55e41dc83a79c33f37b67048f0b49c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813606, "uuid": "82dc62e1-4c37-4d5e-a433-2cb1d7699098", "comment": "Malware payload (Formbook)", "value": "9920d1d584f39e39a78868c5e9ee16245f54c3972fc9b786ede49aba6c162be6707ebe680dd0d6f65ba3c392bcf7de84", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813606, "uuid": "01452d6b-4b53-46a9-8a0e-5fbba6f3aef4", "value": "T1EC63DFC022063724ED250A7D999928BD2D2B7C1DFA416149EDF6B76D01B0DDC0BE9EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813606, "uuid": "315f1c28-b8d0-4521-b282-ad00bd9f0e1a", "value": "1536:KtB/b1+SkaKr8xOOPLFYITQcv8h79b3F5ZfVbsccZNVJ9KVI1k4ri73lqj:KXb1tkaQrOPbTQcv8thVnfVFcjdX1k4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813606, "uuid": "5cbcf868-a150-4682-a74b-d1a817e262b4", "value": 73256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813606, "uuid": "01a448f5-d134-4e04-95f6-f223bdc457f4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813606, "uuid": "f1a32204-8ed4-4dda-8c55-1be0209b9452", "value": "LibertyInsuranceCustomerInvoice.doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4001b483-f129-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655792001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792001, "uuid": "b8d215f7-8ce2-4f96-b567-1ad9a033447c", "comment": "Malware payload (GuLoader)", "value": "705bcc94c26163702efe62388c086334", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792001, "uuid": "b598d49f-61d3-43cc-9861-46b195ccd4f4", "comment": "Malware payload (GuLoader)", "value": "612bb74f8fd73905b11134763ddca30277b3cdfb2887dd63fcf428ab7b796519", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792001, "uuid": "2ae7d9e1-8a7b-4848-a8e0-85930436abef", "comment": "Malware payload (GuLoader)", "value": "653ee91762b4311aee8875391ce2a2c7ddff2c2f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792001, "uuid": "d6466650-1014-444f-8471-130fdbd849bf", "comment": "Malware payload (GuLoader)", "value": "dabcccb1d5ce772f44fc9bded300e18f06a864f17ee5b933497e739bea429616e98441641478ccc8729069df5fdc71b4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792001, "uuid": "6ec6d1ea-2337-4c8e-b038-47a17efd0dcd", "value": "T1D45302C2BEF497EA61701FBF81FF9BB6A56251313A1C9437A4A2DBD41393E5013019AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792001, "uuid": "6244aa28-23d1-48f6-ad62-cc89332a4f3f", "value": "1536:6fH5FXoLHwBj3T+50RPVNYm8w4eEhmxrWvtm:6f/omZ4pwlEhmxK1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655792001, "uuid": "880037b1-8ad8-4135-ad6f-af49b74ea4a1", "value": 64394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655792001, "uuid": "fda11fcc-c181-4a1a-84ef-041cef854c34", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792001, "uuid": "3fc58e08-26c7-487f-83bd-c3612a4d7bee", "value": "SUPE.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2984fc90-f154-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655810431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810431, "uuid": "f099e6d5-c362-47a4-8908-d3bfb20ce56b", "comment": "Malware payload (SnakeKeylogger)", "value": "0d1130a53c3a47f7bfa198cd1a39e8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810431, "uuid": "1abe620f-9d88-48f3-96fb-9dce993b4716", "comment": "Malware payload (SnakeKeylogger)", "value": "61a5a7c75af64b616ee9db1f6baa01a4e2d85c94b5cf2714d9919c70e32df9e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810431, "uuid": "52594775-744b-4f9f-9870-15da23ed0847", "comment": "Malware payload (SnakeKeylogger)", "value": "5a5fe6cb4076eee0651e7ef2948f361853d23d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810431, "uuid": "03ff326a-ef59-48e8-91f7-7eff4265eb8d", "comment": "Malware payload (SnakeKeylogger)", "value": "264a61e306168af1856025424e8ae3176adb554f74f3be6abceb21ab6e80645d95f4fee5812158b8314d041da2692be6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810431, "uuid": "23434f02-5b87-4c2f-91ef-30e897471cb5", "value": "T1C404BAD7F848985DF93750F90CB793599CDA29B28F014EDEAF463A8902B2DDD640C90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810431, "uuid": "89122dac-fec8-44c3-9119-a18c1a837845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810431, "uuid": "40a6128d-5c6c-492f-931f-f6b6d1bf267a", "value": "384:kXCtNdYqVkGakykhuFxywcxA5pZfK3f/8u4D5RbE8YfjfcUBKOzDulvqotqi91Ey:xdYd/NiApZsf/vt5UsLbgg58JgfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655810431, "uuid": "a00b66d4-7257-4cab-8855-9ababc9bab8e", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655810431, "uuid": "1589c0ff-5491-4c47-8010-8d028c3f9d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810431, "uuid": "2920251f-fae5-4997-97dd-0ee315cd6cee", "value": "Q88 MV ALBY HAPPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b824dfe9-f143-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803369, "uuid": "1fb929cd-7d81-4bd8-8fe9-1117dad1e125", "comment": "Malware payload (Formbook)", "value": "509edfdb29a62b6e704548051f8288d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803369, "uuid": "6daabb27-4670-4cbe-a95f-2e237553ab1e", "comment": "Malware payload (Formbook)", "value": "61f7409c356d9376b580f156b4b775fb91aa34a4687642bc9c7f4673cffca0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803369, "uuid": "1823eb01-b5bb-4736-9c6c-2761736e2811", "comment": "Malware payload (Formbook)", "value": "092709e1a4bdb9e154201f243faf7be0a6754806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803369, "uuid": "fe1b4b7d-cd61-470b-91de-8e4d1af24057", "comment": "Malware payload (Formbook)", "value": "f9e4d4a8cc1e48f078ebc7f6a8bdcbbf1504396676545a197e4814d95ed31a74998929f5c227484a50dac7137f518a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803369, "uuid": "1e107e42-ec04-43dd-a8a0-d1edd2c93a20", "value": "T1D8049E36E742C070E2B251F5B2791B7B883E1D34325460AAE7E11AE16EE05E6F52C71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803369, "uuid": "82b46763-cf02-483d-bc42-5ea1f276b583", "value": "3072:dlzBiEl8bwtqf91QSZ4sW/VbamSoSGXQxXvXWGn2GXhSm4hTZ/ZRWU5eazM:dV9lqP134WmfvXU/XWGn2GRSjtBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803369, "uuid": "2b6cc535-bf47-4325-a777-2cb6995d1dc7", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803369, "uuid": "d9618c3b-d244-404a-b85e-a3a9598551ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803369, "uuid": "8926017a-5614-4f58-994c-5ed7ac54e865", "value": "1.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4a5efe-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655806279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806279, "uuid": "bf2da082-e0cb-433f-ad32-6e3c09cad8f5", "comment": "Malware payload (AgentTesla)", "value": "2252c3924658e79ebf6b53aea902cf20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806279, "uuid": "dd2a42d3-bac3-47db-a376-46355481d47c", "comment": "Malware payload (AgentTesla)", "value": "61f96ea28d2752ba6b692f4320b65103ce85c90553b674bb2857142ff52e060a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806279, "uuid": "0681a2a7-dd7d-47d9-8836-fb418ce6d42c", "comment": "Malware payload (AgentTesla)", "value": "fdab52920b2731f697ece500124fc0b83d728471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806279, "uuid": "e62e44bf-d4aa-4d16-b1a5-b30055c270a8", "comment": "Malware payload (AgentTesla)", "value": "99136543d16980ba2ef192c9d1e03143ec802f79107988635f30f9abfe41f9e1258be58ed8446165b5f035a51d348495", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806279, "uuid": "228e2fb8-1320-42fd-b179-0135bff58b8c", "value": "T1CBF401F18FF8B962E0282173B0A4607C77E34D1EDC51D13AD697F04A34A6AD664E5E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806279, "uuid": "907b5465-36b2-4fbf-8c6a-6d51f63dfea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806279, "uuid": "d36995f2-3b57-4468-bc51-260763638467", "value": "12288:mkvvD47EycZz4IyVPyvBa2UyCyJBBF7q7W12BlLRoDA5sdFOx80Qmru2p:7vD47EBIQBa2UyCyn2S1UN902p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806279, "uuid": "1be8add4-862d-41b1-ab7d-4a79454b1aec", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806279, "uuid": "c3914865-a310-4b37-8ff9-e5fc6d567cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806279, "uuid": "96fca1fe-1375-477b-bd7b-d3555a868d1a", "value": "vbc (6).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d891b199-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803853, "uuid": "bbf0c605-febb-4532-b74c-2136e46d3aaa", "comment": "Malware payload (Formbook)", "value": "75d3dc878812e64612fb49afade33171", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803853, "uuid": "5e852831-64b5-43ec-becb-25d1af257162", "comment": "Malware payload (Formbook)", "value": "63436a8becb54240880cccc575d35446c73b60001452b8eb47d728ee58d9a601", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803853, "uuid": "e8155656-4fa3-4722-8ae2-13504bd34ce8", "comment": "Malware payload (Formbook)", "value": "f19faef10c49da68b6b17b132d19929dbdd8556f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803853, "uuid": "edfea098-92cc-43dc-a3dd-8be9d72eacfa", "comment": "Malware payload (Formbook)", "value": "f6b3852c3d5b06afef055496592ddb5a0c3bcedc8f4a959169124a5b180b46fb6282b7c43f177fa389ab892d900739e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803853, "uuid": "67334785-b52e-4dbf-b142-a6472e530f60", "value": "T19815F12A9B767F2DCA9E11EC9D3A4F4D2C987D4841E0DBB4ED9FB0D11846735A2370A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803853, "uuid": "64eafdd9-7d71-466f-a12a-ea0286a8f42d", "value": "24576:SPQga+XKuMrbhuzuv1VXFBEQTAdj6puB0+8jUCp7S23wtTLoC3:mQgxXKukuKvX1BjTOdQUCpG26TLoC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803853, "uuid": "0febfb26-34fe-4fa7-8739-c96f6befc366", "value": 897914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803853, "uuid": "82000341-60dd-49c2-967a-a00394e4f14a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803853, "uuid": "7c7ac7bd-f392-4b2e-849b-2831b2ecc5f4", "value": "Scan doc#51564651176slip PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd48d192-f165-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655818034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818034, "uuid": "1b85cf91-ca1a-4712-9b09-e894b98fb200", "comment": "Malware payload (Formbook)", "value": "7b704a5ee3ae82e0197f464ceaa10ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818034, "uuid": "b7e1dc24-c60d-4930-8c88-cfce7f6da267", "comment": "Malware payload (Formbook)", "value": "63a5b1a6036182a13f517780b33cf425430ff0eb614c85250ae192a82f89b772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818034, "uuid": "7cbdbc05-f0ac-448c-accb-f7b8e3119ebc", "comment": "Malware payload (Formbook)", "value": "2596ee991f4278a542896def9872bebe4f31156f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818034, "uuid": "b5fbb49f-bb7d-4a20-92d1-577e85e2abdc", "comment": "Malware payload (Formbook)", "value": "fb4f949e0c4569fad118c0f974d6b2901e9f96a5ea80386f724bcffac166d7ae38d489f606d6bc232af5d7006e7ef856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818034, "uuid": "638aa234-7be9-415b-b5c9-4b426597d4b8", "value": "T161F4E0E87AB0759EC0279473B9942C7CB7D12C2FCB0BD113D153A19DA85EAC78E905A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818034, "uuid": "b3429408-b0d5-4912-8772-c87de654f81a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818034, "uuid": "9ae2cc31-a695-4e1b-b04c-d6e88f0ee726", "value": "12288:UvKhO/PqaefLu4v85ErKqw7PGn4gD7jt1Xmo4lbaUVK09Pzwms9y2HkUepwC98g:UvKhy7ef/KdPZe/tWRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655818034, "uuid": "c4268894-74ca-4c65-8ac5-d4e25663afee", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655818034, "uuid": "899db856-aa7e-44cb-aa8d-35e1c0fafb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818034, "uuid": "8326f1e3-a6bf-4a05-a416-41e67585b54a", "value": "samizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16605b7-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655823195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823195, "uuid": "9e7f8526-0aef-4a3d-b748-4539fc0f498e", "comment": "Malware payload", "value": "bd567920c317d68f36061cf7ae0937a6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823195, "uuid": "24b8b7fa-cd5e-41f9-94ab-8bea834f0411", "comment": "Malware payload", "value": "64b1a8f8fca294e383f19fb9b1810b3e7c40a3c00cf37636a29348e950071ec5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823195, "uuid": "67ffa26f-424c-482d-8942-f54fc9e95664", "comment": "Malware payload", "value": "826fd135072950f669931f0e77448b0e5790e6b0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823195, "uuid": "b212dca1-62c4-441f-8178-9a5ed9deda52", "comment": "Malware payload", "value": "7cfb2f83d76d6169180495bf0d29f7c980d641cbcf910b11309edde60a5cc1dc60d4eade3e5e12a63ff89da0d6cb8dac", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823195, "uuid": "58c1dc98-b758-4517-8419-d17662241714", "value": "T12A63D0C80DE5B182E1D9B1F3B99882D00A86AF25190D3275359F7E1F153169B2B23F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823195, "uuid": "1b181782-685f-42bd-9f26-ceb0c664f6cb", "value": "1536:7rHP7pM4QXwq9zKJeMxS5y9vLklrION5Psh40HaS:7rp8wqwJeMEMFLklcOIhjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823195, "uuid": "9bdada05-c9e6-4e33-a40a-cce293e5a31e", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823195, "uuid": "ce1b3d87-81c4-4c62-8322-e6abbde3e101", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823195, "uuid": "2b0d1c8a-b25c-416a-9a2f-94782a9510e3", "value": "Payment445812.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d776711f-f15d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655814589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814589, "uuid": "b8cb99ea-bd02-4ba8-adf8-9ccd92b04d7b", "comment": "Malware payload (Formbook)", "value": "d8f1f54e0de0ecdfed698ae91eb9458f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814589, "uuid": "e226cc10-e966-457d-92fd-b9692f4f0456", "comment": "Malware payload (Formbook)", "value": "6501dfa13b27c5caa56594bac248e79358a67dfedb6515f120fe985a8c8391b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814589, "uuid": "ae56c40e-82d3-4f9a-b8ff-3eea4e9af29c", "comment": "Malware payload (Formbook)", "value": "2d508b3b135fd8cfc8757b07f45b6ffb43b7ef5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814589, "uuid": "ed7827b1-f858-46c9-868e-2a7ed86f00a5", "comment": "Malware payload (Formbook)", "value": "74725f23a38d534b27fefbedc67d6606b1adcf8f9163141dc8b21ef5e79dd0497e04a9ab2da02e89f2290d1ac5babd57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814589, "uuid": "46c44754-a8ed-46e9-abba-742f0b0a387f", "value": "T127E4021734D6C277CBC5C37D34BB222F9BB2662467059388363B496F07722021A2FB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814589, "uuid": "a199c298-3032-43af-96c1-dea4e2f0bdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814589, "uuid": "029acf74-b670-4a0f-a78e-8ebd7ca09c26", "value": "12288:sFJd7ezHyWszNYOa1rCsJ0W/1mstdEfJdluAXF6YoUZZDujBl:aezizxWdeO3Q7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655814589, "uuid": "02f5ef2e-1209-41d6-9dbd-91edf1a6b398", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655814589, "uuid": "9a24595d-a387-40ef-af3d-f9f3a0ad14fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814589, "uuid": "6cc5e2a4-874f-4d73-90d8-e9a9da2502b5", "value": "iceborn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51bd05b-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803767, "uuid": "e63083be-56cc-43c6-b475-1565e1d89ce6", "comment": "Malware payload (Formbook)", "value": "7ff57c6b554318947da945b939e4c00a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803767, "uuid": "3dd4f0ba-82d6-40ad-b350-68c158203a5d", "comment": "Malware payload (Formbook)", "value": "650bdc20e818072b08965058d3cfa3e3210178fd2b33ba94a7cb90a672335599", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803767, "uuid": "61a0fff4-ccb8-4019-9f3a-9d4f9357b198", "comment": "Malware payload (Formbook)", "value": "d2b8cba12d90eb4e2af4a57c28a77d720945561c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803767, "uuid": "0d70d021-3f38-4a91-a532-fcd99033105a", "comment": "Malware payload (Formbook)", "value": "5b0e32cb47c8330b59d6a9dcb2891f96245794e1a473292815164a63a48e7b2123c2be9e034a82f21f227c9363ed50fa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803767, "uuid": "7a202691-2a2d-4d00-bb95-e1cf2571d5ff", "value": "T1F563D0771679D58CFD5385F6C998B1115F20EC41F8C964205A08BEB7283EACA8CF1B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803767, "uuid": "5ac37592-9a21-47ad-8a7c-d454e7edeb40", "value": "1536:qGXu4lzrvfwm6jtsQlLbMUMaW+YCp8AOBqfUDPLsp6tS:qGX3rwm6+QBwUUmV8mUD4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803767, "uuid": "3878808b-03bb-47ce-9436-186bd3e8fa07", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803767, "uuid": "1e526bf7-7eab-4e84-9329-8714b96a14b7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803767, "uuid": "34ba0655-1926-4549-8dc0-494773eb96fd", "value": "DOCUMENT HAWB R958300.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864df365-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655835927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835927, "uuid": "5106136a-e698-4b4d-8b02-030efd3f348e", "comment": "Malware payload (AgentTesla)", "value": "dbafd94255644bedbdcae214cf5d122f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835927, "uuid": "876c1f45-1f90-49f7-9731-b3a82bd50e61", "comment": "Malware payload (AgentTesla)", "value": "65351926c8d004b98fd89e593f17cc87a6fdd18f54ad42a562037639d06196f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835927, "uuid": "04e5894e-3a2d-4bb6-8a6e-dac3dc1b9a39", "comment": "Malware payload (AgentTesla)", "value": "ba9e0cc2760760f706007ae698b353ea816d716f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835927, "uuid": "00037f1e-9339-4402-8787-32cd9ef43ea9", "comment": "Malware payload (AgentTesla)", "value": "38eee74563eee2be4f8498400294ddcdab58c5379b1956ce9e9355fa9ad301c4a114eb4a37b45a1f396a6d0d31c46b57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835927, "uuid": "1227983d-50ae-4b18-beeb-c02a0e07ad3d", "value": "T1F6A412309BB49782C0F6E3F8099301959BB411795517FA4C4FC0A0EE1CA7B689BE6F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835927, "uuid": "e44394f7-cd49-4383-b042-8fde83031e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835927, "uuid": "a0c2e274-c2d8-4690-b8dd-466ae675b4a3", "value": "12288:inCAO71BIRn2cymMgJ2i/yOLO2c8RT22Nx:inCA+BeymMgmOLLc8RT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835927, "uuid": "e05d55f8-299a-4cd3-8649-179aa233c724", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835927, "uuid": "64426443-95b3-4ff1-9c1b-5df3d4ddbc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835927, "uuid": "73e3b8a0-33d1-4b37-bf71-ac4f723780fd", "value": "RFQ No3756368_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040b3edf-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808221, "uuid": "2f4084ad-6481-4dc5-82e6-12e92d0dfefe", "comment": "Malware payload (BlackCat)", "value": "aac32c2f1c860af31c48a64a6af56ff1", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808221, "uuid": "d4a8a907-45a8-4cfb-85b5-eb4c07350156", "comment": "Malware payload (BlackCat)", "value": "655abd0b5067ec53b25ea387c9aebe0fbafd5209e53bc7447c7d7425cb76b175", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808221, "uuid": "34806c5f-885c-4ee7-8b8e-934ad9cc6ba9", "comment": "Malware payload (BlackCat)", "value": "baeed75757a24e90fa532586c922e6d3e6eba0a9", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808221, "uuid": "1012a02d-a8c1-40c9-a189-0d4bcbd2ca89", "comment": "Malware payload (BlackCat)", "value": "19cab067e87a293db7d6bacd9c8c2c3cf880066b418b917038f885d54b8017720bb66c685e70d4dcd1b145e4ed07e184", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808221, "uuid": "91145813-fdc2-46c6-8d1c-bbe87d2fc761", "value": "T14BE59E46FA4356ADCB971570305EB33AE63A491C602D9FA3E7E89D30FF2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808221, "uuid": "e42e5635-8c8e-4341-9eaf-e959bba12fd4", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808221, "uuid": "eadb9fd3-f479-4dd7-a4c7-92979acff692", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NE/RgaJ2w1Ms:rAnCs8pVblGyNM+l4UxUc1BhFyvww1Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808221, "uuid": "6f28b7b0-aa48-4c73-8e1e-3cce14531a82", "value": 3068931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808221, "uuid": "3cf2dc05-e948-4362-b561-47a896de509d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808221, "uuid": "e41cb9bf-4399-40c0-b58e-db50598fe22b", "value": "655abd0b5067ec53b25ea387c9aebe0fbafd5209e53bc7447c7d7425cb76b175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764c38d7-f105-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655776630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776630, "uuid": "43e0d421-1a5d-464f-86c6-33a67a093486", "comment": "Malware payload (GuLoader)", "value": "281c32d75a13f4d0ba7179dea23769ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776630, "uuid": "454c1ddf-bb20-4f21-901c-a9b2da7f08f5", "comment": "Malware payload (GuLoader)", "value": "6665141581fd0f86c8c55d2050dfe8c6fbe22f98ea36bd7f505b44f2df6b8372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776630, "uuid": "3a5571b3-70d1-44b8-a3a5-25f81b90902e", "comment": "Malware payload (GuLoader)", "value": "badfa01495fff67d0a2af3356254b67a6c4147a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776630, "uuid": "8555c255-f179-4644-ba2c-b2a795ce9109", "comment": "Malware payload (GuLoader)", "value": "15098393dc8b1006ddfc087bdbd9d7c1def871e965a080fae61dd2af72f3e3f27245d270a5e55396769f8b9146a03ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776630, "uuid": "5987132b-26be-4936-ad2d-36ed2d9350dc", "value": "T1B554BFE2D29484E5ECA51B391537AC3E11ABBE39B970A51E4A1C75713F333C22167E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776630, "uuid": "ca5eff11-1e4e-4df7-ab3f-0aa72a7f628e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776630, "uuid": "43848b25-b67e-4ed7-9ff8-cc4a2fc58cb9", "value": "6144:aNeZMmG6edb/q5a7Rod/Y0OWtNoxNNS8W8AekfIXOl5u:aNp6g/ca7QY0OWtWxi84evXOlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776630, "uuid": "cc047a36-e0eb-428a-95a2-14b4c3104715", "value": 293687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776630, "uuid": "b10bc9c6-3f51-4fe9-bab8-1ef129089849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776630, "uuid": "d59b784d-5a67-4f2c-a357-cca5bb33e621", "value": "two_months_salary_receipt_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2e9dbc-f1aa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655847508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847508, "uuid": "a201a74b-c9bf-4ada-b69a-17d9bd16ffc5", "comment": "Malware payload", "value": "4b5107477d52221c24bb805413d1810f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847508, "uuid": "d0602990-dd2b-4011-b725-e66bb2f53c07", "comment": "Malware payload", "value": "66657933d30fcae9d2dd67ac4155962aa6e0664fb012e8ae3f75f7f5020cc697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847508, "uuid": "96581342-7bed-40b0-9282-da479793609f", "comment": "Malware payload", "value": "12e7dc33ac65f55c9860c555211bcadc7cfc7c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847508, "uuid": "e8c034df-3716-4d6a-aa97-d2f143c33993", "comment": "Malware payload", "value": "7e4c373553c1338aec56fcca82cc33422e585ab7ef7ab949a4437f7b1aa7aa3169aa3b1d0630555d46ee47f3c9c631e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847508, "uuid": "edfcf41f-9dae-4132-8b1d-cf0efa8a2424", "value": "T1F0648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847508, "uuid": "e5f2e9ed-042a-4d70-a33c-d342a8fa2c6a", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847508, "uuid": "f50a496a-d10a-4145-b435-daf68d10dc5e", "value": "6144:JqdSTDcHe3kjHfNsQnWXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3WIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655847508, "uuid": "9bb8f0cd-1c1b-47dd-8593-674f2cdde926", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655847508, "uuid": "0736eae7-880e-4533-be3b-526cab1c5996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847508, "uuid": "26df1401-e9b1-4963-82ca-d534978f7b59", "value": "4b5107477d52221c24bb805413d1810f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d854f13d-f128-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655791827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791827, "uuid": "5bbfe35e-892b-440e-b21e-cf72b63ed9dc", "comment": "Malware payload (Formbook)", "value": "7d134d7411132c648a3e8c96b6512ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791827, "uuid": "36dc4100-6830-43ab-a47e-9ae199d48748", "comment": "Malware payload (Formbook)", "value": "6754c12fc6c245becc9c5104eb4c130ee31217a4a8cdee324f468c2c26b4e051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791827, "uuid": "47753391-857c-4a91-ac1f-01fe142ee776", "comment": "Malware payload (Formbook)", "value": "ac36a8371466aa2cc72dd8de3d82c8ee79223358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791827, "uuid": "10b1ff0c-b31f-40af-ad55-02dcc2a27f07", "comment": "Malware payload (Formbook)", "value": "138ece293cda57de61c5e36960e40a4d68e061ae3b29cc67e9f3969733c7c4fa83233e3b75f0543c6957ecf7bfa1070e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791827, "uuid": "cf92f92c-33fe-486b-97ac-9a1374439cb9", "value": "T1DCD4D010EAFEC9AAD83506BC0471524012F5AE565243F7D88EDD78FEEC31703AA9593B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791827, "uuid": "a02ae7b5-d0ee-4bbe-821e-af90c22b300f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791827, "uuid": "93017b75-8d9d-4ac1-9356-38f0addc7b83", "value": "6144:cNyhmOZI82NSIPCBi2GhN3hkmifJclTafanCRV5r1gslnhdzjBhNBSZzZchOf/9q:y2iNRRdl1k55v5/NBOZca9GtF/jk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655791827, "uuid": "cba427bd-054e-47aa-8eba-3a7d3b18949b", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655791827, "uuid": "0e801e9b-b4b9-4c93-bbd3-f1850235d1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791827, "uuid": "8a7794e2-c93f-4f55-b172-41ffe507bfae", "value": "NEW PO 87910219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ecb7cf-f192-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655837405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837405, "uuid": "ee829baa-6cc5-4c5a-b3e5-e0122b6499d4", "comment": "Malware payload (Mirai)", "value": "6411f91cb42bc45877058143a6bcb8f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837405, "uuid": "cfd97c67-4997-4de4-9a4a-95e484f92371", "comment": "Malware payload (Mirai)", "value": "68900d64c5b69cf06039c15e2aa0d5a6929708bb7d5325d15427adad22f182c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837405, "uuid": "dce046f4-9612-4b57-b5c8-2e085e9a602f", "comment": "Malware payload (Mirai)", "value": "d86c9e7b7230e82806814369ab29a462a3e28844", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837405, "uuid": "615671fd-a7e7-4306-bbd2-c8e18043b00d", "comment": "Malware payload (Mirai)", "value": "9c5d1a6ca79cb05b218a151cb516744b1016845653f3336f183837833d51c5332d255deb9c2df815d1255343a1e360e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837405, "uuid": "1a7912b8-3f1e-423f-877c-bb1585a7e8ab", "value": "T151A2C06621D22F57C115A2BEEA7E0FFF78736C54DE6B9C06778AE442D243014DA386A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837405, "uuid": "046e3fae-e0d0-421b-bd85-e9c98461f0a7", "value": "384:MIb2cu4xqCyzcZYeF2OVROMu96BVkeFAdYu8BA41x9CItKWB4v1Ra:5ScupJ4ZYeF1XOMu96YeFvA41b1t4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655837405, "uuid": "472e801b-7f69-412a-93a2-6e2b56a77623", "value": 22092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655837405, "uuid": "1d342c0c-b2af-4a03-a7f8-1145a81259a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837405, "uuid": "f26f6aec-e6a3-4367-9693-953ff98de0db", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b5f6d-f105-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655776650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776650, "uuid": "d3063e4c-17b4-41e8-bce2-e3dd8f5cd3ba", "comment": "Malware payload (AgentTesla)", "value": "f9168325c81f9e4df511b2a75b5b3fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776650, "uuid": "421aba66-0d83-4a78-842c-c1ec57c8dc8b", "comment": "Malware payload (AgentTesla)", "value": "69b85346ac98c0d0689406cd8a983c42f440600c6d57241c24b3e3b709f6406e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776650, "uuid": "60f8d9b7-3d3f-4c26-a49a-b28246254809", "comment": "Malware payload (AgentTesla)", "value": "e33b6cacfa4b1caa1bff4b6574acad6d9ee899a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776650, "uuid": "9ea6e7fb-df40-4fe3-8258-b8378140c6ad", "comment": "Malware payload (AgentTesla)", "value": "154de1313e44f7f90f31eb95fd05795935b9bb74531e6eec3d5aea0ecdd060108761513f2d19929cf5b852df73f24ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776650, "uuid": "a5d378e9-c14e-4a6c-b154-f6003412ad5c", "value": "T1BB34E08B37988F01C4986636A0DB40246BF8EF833BB2D7656F9D75680A427E76C445CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776650, "uuid": "f1d24813-c329-4752-b6ca-21bd58d96b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776650, "uuid": "135e1cb8-926d-47c9-bf23-a3e69b5cd9f9", "value": "6144:n5X3l2JYEekdsgmhHHGQ1z+/BqCt946b:VWekkHHGoz+Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776650, "uuid": "40879c5a-8fdf-4888-b680-3864f07cf70e", "value": 249880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776650, "uuid": "6ff1dde0-c2b9-4ccc-a8fa-ace5ae981bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776650, "uuid": "84496e9d-fd7e-48b3-9a11-a4ee399b6f56", "value": "Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def4fe19-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803864, "uuid": "0d3c7ea7-1729-4568-bd74-2add2ca39ff8", "comment": "Malware payload", "value": "26eaae21f56eacde51202e862bd90f44", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803864, "uuid": "23973e3a-e8e2-4bb0-9eef-e4e024a4c114", "comment": "Malware payload", "value": "6a37748df0492d1745d58b6e0482af5040f002645c97026ccad13d111958b962", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803864, "uuid": "e29721a4-0695-4261-b4e4-7ad0bcbd2bc7", "comment": "Malware payload", "value": "2b7b5ec92695faf192cd7bbe0cc184b93177f885", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803864, "uuid": "87d35f21-b0c6-4f81-b8d1-098ab910ab97", "comment": "Malware payload", "value": "b518dc8088c7c1d3eaf0df6d80f9204d1901cbaa1dfd3bb30b99c9cd37305a3339c665a9c5da0d17d5be46e4babb96bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803864, "uuid": "04505425-a927-4c79-b48b-91197cc07df9", "value": "T1CE43639193C0B880619BDB73771ABDE5E9295D987585088EE400BFB4FEB4710FAE2D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803864, "uuid": "13a1c305-7cc7-433d-a54e-e52d231dd776", "value": "1536:ALwEv1oN0gjjdULUUuvpSXW2CtrLr2xWQN:ALw+Ujdsuom2CFBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803864, "uuid": "0136d102-2259-45f9-93c8-de0f881565c8", "value": 60502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803864, "uuid": "1303ddfe-a26c-47d0-83e9-df8022a985f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803864, "uuid": "eac24ecc-dcf1-4999-a878-46982545b8cb", "value": "Captura20223611.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a97783-f143-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655803390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803390, "uuid": "68ae2080-97a2-48f8-b1fc-6095e4ac6fc8", "comment": "Malware payload (AsyncRAT)", "value": "6ecf87b625a8254b780f13e0267f5c05", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803390, "uuid": "3812534e-3ca5-4b07-9725-a1f065f39db2", "comment": "Malware payload (AsyncRAT)", "value": "6a4de29a2b535265b7fe6321aa095f5a45c0f8de6312c451dfb5734c122f78bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803390, "uuid": "2d1e04a2-67ec-403d-9da7-88000fcb3d26", "comment": "Malware payload (AsyncRAT)", "value": "f10524d7d3901e391a5a90ac3fb2695268e3d42e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803390, "uuid": "dcb5cfb4-6d93-4787-a443-3e4502331268", "comment": "Malware payload (AsyncRAT)", "value": "e6af4216466502521aad1f76e4deb166043a61c1c6f0e133eb3ada3b4832b1a43762a8a0d7de1454724d0a0100617ef5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803390, "uuid": "7c890969-7e7d-4b55-9139-24f130d5f0b7", "value": "T143B38E103BE9A524F2FA4E3868F222C582BBFD63A513D55E08E531964E337C585227B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803390, "uuid": "c97c84bb-ec12-4ed7-9337-501db6bf5ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803390, "uuid": "a12104d0-f636-4f04-90fb-48f5c17463dd", "value": "3072:TDOmh3d0PPh1b/6KDV5T4SXEhzcA3hH7q/:P5t0PHbiSVsJXRb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803390, "uuid": "2273ae0d-7742-4864-8d93-6a9f3f0ee080", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803390, "uuid": "a65ba22f-f6b8-41b2-8a09-7f99e2949ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803390, "uuid": "2056a81e-2b4c-40d7-9247-61be9a684c42", "value": "G00GLE.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8617b401-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808010, "uuid": "c257e5d2-88b3-4a4b-9266-b70033261d9e", "comment": "Malware payload (RedLineStealer)", "value": "b0f6e15f83e03ea0ab502951b62c3dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808010, "uuid": "8ae80e8c-2bc6-4210-b379-57876fd9f838", "comment": "Malware payload (RedLineStealer)", "value": "6b39407f3c2b6064f483c474c9359f344f2aa8e0afef0941d33deddbc275fdb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808010, "uuid": "134781a2-0260-4eec-a0d5-dd0df9630896", "comment": "Malware payload (RedLineStealer)", "value": "feeb74ad283f27e9eb5e96dccc9fa1c44eab00be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808010, "uuid": "f3fe0901-e02d-447d-93ee-ce1bdf03ca21", "comment": "Malware payload (RedLineStealer)", "value": "734b561cc6cafbe7c9cb243dc2808239cf3c81efdcdc6cc04db5225da053a9068594fa795cffadd0bbe1bb58ab2ed2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808010, "uuid": "033828e1-19b1-4ea8-9afa-00f14271cc5b", "value": "T1E6C47C2067E48E6AE2AE1B7EF1354911DB71FC47B766F74B0E8560AD2C223419C41BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808010, "uuid": "670939d3-a8ea-49cd-9948-1c64baf781a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808010, "uuid": "f7bf332c-57f8-415f-ae67-89e151a39720", "value": "6144:E8fGABIgrx8kFYLTiMkbFT1GvQOTK8MbDGjM+sqaPD5jo07rYeGy3V8/GV0jivyb:lPx7FYPiMjK8vjM+W5jo07kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808010, "uuid": "18ab3162-50c3-45a1-a39b-404fa0864978", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808010, "uuid": "4ba6d578-9e60-4c7c-80e9-1dcb7bd5ae46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808010, "uuid": "a966c2c4-e6a3-4543-ae3c-94786f8fe587", "value": "_-Venom.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1524fa-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655813499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813499, "uuid": "b888d103-0d93-4237-9fe4-8a80e958efe0", "comment": "Malware payload (SnakeKeylogger)", "value": "026b0aea217fd8739a2921536bc93191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813499, "uuid": "182387ec-2bc9-4e9a-b5f7-4712603c8256", "comment": "Malware payload (SnakeKeylogger)", "value": "6b8b5550031664a2a62eb5afaa4fc8deab2418c434f780fc9f27dcaa7cd7d571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813499, "uuid": "c2ef0f33-2b42-4447-a650-38c11ec9e36c", "comment": "Malware payload (SnakeKeylogger)", "value": "74f62182989b2c8e93b8c13b1fbe62758878c79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813499, "uuid": "fb351be1-60cc-4156-9279-5f203e2b36f3", "comment": "Malware payload (SnakeKeylogger)", "value": "7d85f3685c503251890aadcc2fc045fc89c592244ef1bb497eef4f3c9ff212f393a28ff7f349f1bf07890f1adc2c720f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813499, "uuid": "98349441-71a9-4517-a86c-c9e15dd57885", "value": "T1D6D4CF653A4CAF90DA7EC7791221402053F0A86FF722EA1A7EF714CD5961FC95332A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813499, "uuid": "e57522c2-ba16-4395-9add-f137f772aa0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813499, "uuid": "a582888d-f690-4a80-8a2a-7ccc9fb02ecf", "value": "12288:fympX6q7aL49EO0bdwthgiMcNAF2xWCci2cAa9IV5Dkzj3YA2iNPf+B85FrGmblA:FjoA1B+B85F6Oe05msoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813499, "uuid": "a1448899-c522-4fa1-89cf-a8a36bb350fd", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813499, "uuid": "c0e9e620-84c2-4f3d-8359-63f0b3631c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813499, "uuid": "1a06b083-f858-4a7b-9ecb-31e4466dce60", "value": "BAL SWB Specimen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceb6fc5-f199-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840019, "uuid": "0223e001-3544-4d1b-b026-6455596dc2e3", "comment": "Malware payload (Mirai)", "value": "c37415e4b48ac46fb736beddeee40c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840019, "uuid": "7b275633-8dbd-4881-9eed-94c85f694de2", "comment": "Malware payload (Mirai)", "value": "6ba4670820077478ba4699d3e72eb1fe66a0bfb130a286a6190cfe40905172d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840019, "uuid": "83a44167-3e7c-4db9-ad62-e88a3f631ba8", "comment": "Malware payload (Mirai)", "value": "5f211c143b5620af07dc5bc729ec7bdfe0421770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840019, "uuid": "eb285449-f15e-4ba1-8d7f-57c0926f3a3c", "comment": "Malware payload (Mirai)", "value": "92075f7d10b599efdb88d3edaffc1dfbfb0716fabc3911ef8e270fd9d7938003f2f176a7dce82daed1c92f4518fc50c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840019, "uuid": "d5ae7fc2-1232-459f-a7a9-53fcc0e87105", "value": "T1B5E328C1AA53FEF3D5C39FB502A7D62406F398255B5B8E44F3ADADF04A194C8B10A358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840019, "uuid": "6c5c3173-8b8f-411a-a898-697b06c7b60c", "value": "3072:HqybjZcWxXyZsO4tVUvJgGLG/30cHXNP2+gz:KEwsO6VUvJgGLG/30cHXNP2+gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840019, "uuid": "f02fab6c-95b3-48c3-801a-6f39a3e7ec83", "value": 150714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840019, "uuid": "c88298b0-d6b7-4894-98d0-ad57d2acd701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840019, "uuid": "e7ee8499-231b-4b9e-aa13-7ee7481d37ad", "value": "c37415e4b48ac46fb736beddeee40c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20009be6-f15e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655814710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814710, "uuid": "b6f24e32-b444-4552-bba6-b4690cc6ddd8", "comment": "Malware payload", "value": "21569243b4a4a8fcf5d24cbe051ee959", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814710, "uuid": "29e5f55d-2f7f-4990-8ebb-ea98af11ab9c", "comment": "Malware payload", "value": "6d07cc52c1b8336c9ac5becfe3597210cdef4da4cda21d95277e986db7a2718f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814710, "uuid": "d54c5518-72af-4225-bd31-2798e5b713eb", "comment": "Malware payload", "value": "9182d7946c9f51011112b41d77fc89b9e476bb91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814710, "uuid": "499d529d-dd26-45b8-99d7-caeb74a9c0c8", "comment": "Malware payload", "value": "d54915a80bdaf3394742f5f783f967f394227bfda17cc1ba994df90d6a53da7bca0810ae265f9ede9779b06350fedd38", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814710, "uuid": "67391c15-d8a0-43a2-8306-1eabdd5072fb", "value": "T157252390AE681F8FC751B274CC63A94B168A7D9CD344F0FBA39436AF21BA735045784E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814710, "uuid": "d79b6ca1-d7d9-42ab-96fd-3471cde388f0", "value": "24576:jNZwVN/o9fbsyZHYWA1dn42KeI929OyxVTqRBHacQ+HDWJ3UFR:sCod4DZlvpSJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655814710, "uuid": "56939f2c-266f-46ed-9258-17a5c30d683a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655814710, "uuid": "27acf5cc-10ee-48fc-8833-980dbbb65f18", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814710, "uuid": "06766cda-57df-4a87-91f5-45004474cc80", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.8014.23960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bd5dfd-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803035, "uuid": "a76cf92b-6aac-4b2c-836f-2cc9f8939351", "comment": "Malware payload", "value": "c9ddaa4d670c262bf2621b8299ccf84e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803035, "uuid": "fec81a69-ebcf-4726-a693-e73a1f0eb3a8", "comment": "Malware payload", "value": "6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803035, "uuid": "42b60115-b979-4faa-86ea-258b164fea2f", "comment": "Malware payload", "value": "8773fe52563b9aa22909e53671d99d1277427f87", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803035, "uuid": "7a69ceaf-6210-4157-b69d-bf2381fd111f", "comment": "Malware payload", "value": "9be4ba5f6205aee05fe76b7e766a05c08202d09808b2b3b14d8760cb325411008d219b8b13137bdd3278e50f0e7bd9fc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803035, "uuid": "47f5cc64-58c7-4d82-8873-5c4050f23f0d", "value": "T1BCF533C1A77968C4ED129F77E7DF0F21232A5504A47F116B9F34358801E9ADE89A603F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803035, "uuid": "506027e1-d0f9-4f99-b920-89e02bed5341", "value": "98304:hJJ7q4BP+NGHd/UMZ7VvJlptaqnQuT/cVSIzqh4mUhkB82+:h3XBPaYblzlpzQG7ph4W82+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803035, "uuid": "f4fd248a-4ff1-4c34-ad21-86d3566a393c", "value": 3524789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803035, "uuid": "1581d951-0fea-4578-80a4-d3fa62370190", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803035, "uuid": "6be16afb-fe8a-4080-b502-44b4647df0a9", "value": "6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbb9144-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655835993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835993, "uuid": "800e890b-73ad-4c30-8f15-92f0a81aa15e", "comment": "Malware payload (Heodo)", "value": "6bfbe845595ccda2e980334465b64c7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835993, "uuid": "df7b56af-d03a-4f47-8e23-9552b96b5c57", "comment": "Malware payload (Heodo)", "value": "6d2fea8494f30f803d0d6a4a9f553fbc469949cb71e12d3f30dd981e2a5c9b7b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835993, "uuid": "ae4a66ee-8919-4bc9-bf85-b1a86d57e8ea", "comment": "Malware payload (Heodo)", "value": "8572eb81b0950eda0a824f07b68b3a73d59cdc77", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835993, "uuid": "f90effc5-832b-41be-ab42-96f805424fd1", "comment": "Malware payload (Heodo)", "value": "b75d3df6f69dfdf247bffd9dba974c6003bd20c108853173b43e5d92029aa9dbd3bfabd76e5576e0bca3263ad533d62e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835993, "uuid": "d627accb-8132-450e-908f-e609d7408177", "value": "T10D64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835993, "uuid": "a4eb720e-57b3-4d3b-906d-80187f0af99c", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835993, "uuid": "377557cd-aa22-4e24-9cd6-ef49cac8908a", "value": "6144:3MiSTD2He3kjHfNsQnkzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3zNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835993, "uuid": "8ddc31aa-952c-4f33-aabe-aa39aa76185c", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835993, "uuid": "4229b382-fbce-42fc-88ff-4340f153b067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835993, "uuid": "c56e66a0-e171-4622-87a2-06fe67eda074", "value": "6bfbe845595ccda2e980334465b64c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08a14b1-f130-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655795196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655795196, "uuid": "93598046-a2c6-43b3-a8e1-5fa5b561b1b3", "comment": "Malware payload (Formbook)", "value": "c64c0beab3c9f90e245fe3b579e6ace9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655795196, "uuid": "1757fc1a-6e9b-4e0a-82f7-e115ea6f1bdc", "comment": "Malware payload (Formbook)", "value": "6d7cae2e6900b4498dc7531835fa27a6cb76f8dfd2b3c466a1d47f7a2f479706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655795196, "uuid": "6dd4cc53-f287-474c-aaa6-b17a20ada6d4", "comment": "Malware payload (Formbook)", "value": "e7d007829dfe83b8d05b50b21b0cde655f966234", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655795196, "uuid": "810c4598-ac5a-490b-afb8-0a3f3d2efeb1", "comment": "Malware payload (Formbook)", "value": "937de76f250cfdb1467baa1df28a0a2f63ddfcf01d7a24ff701f6068e4d2f7663e848a1b63d002fd85239b1131200e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655795196, "uuid": "070ed7f0-06aa-48db-80b7-f9394212d2bf", "value": "T144E4F1F28FF4B9A1E52821B37095A13C77E35D0DDC61943AD6CBF05A34A2AC661E4E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655795196, "uuid": "cb76f6e5-5a38-473c-9530-418a49ceb852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655795196, "uuid": "32c26c3c-2924-4e39-9902-c285c9b4a7b9", "value": "12288:2YevNcS6vfcdvn/Kg+1NtUopUvili6ATthFbykE2kKm723jd:qvqtg+1Mom7rTtbLC23jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655795196, "uuid": "55900221-8f7d-4a7e-83e4-5cbfe8969425", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655795196, "uuid": "ea2448d8-a80a-41de-ab51-12ec6a53485d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655795196, "uuid": "7ca54edc-e95f-4932-8de1-db150dc7f480", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fea1d2-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "b84cee1a-d622-486d-a0b9-9b6f3c06a52c", "comment": "Malware payload (Mirai)", "value": "bdc90be7d1e8048d54d8d91c73051798", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "55350e90-1434-49fe-85a3-a4d87d904418", "comment": "Malware payload (Mirai)", "value": "6dc3658ef812d088734094dbb7fe0c5040b813713a6058413b4f0385e37eceaa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "7bca33ef-4710-4f5a-a93f-341b8123bb14", "comment": "Malware payload (Mirai)", "value": "64bb821724cd067193a0f101087156d7a3daf8a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "b1bb9bbb-27fa-4387-8c14-98785d6e7e2e", "comment": "Malware payload (Mirai)", "value": "c18bbe7eb05625f30c9a5bc6d7968328cbaefc004307c2b4018f8d4d1fd838ec28dc6b722aaa247fdfec71a8cb15e982", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "c1be30d6-8d11-4de5-8d94-8f50fb6f8a9a", "value": "T11FC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "0ce60fc2-afc0-4f01-bf56-94d52f509f28", "value": "3072:ekYPUfsgnsb0J2ag/VfJkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0JkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "3b60a3fb-bdf4-44cc-8dda-1385d7fd8751", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "757f4ca6-c4d1-48c5-9505-19aafc4e89fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "3a39d604-aee0-4751-bd14-6845b2e715e9", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eed209e-f124-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655789905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789905, "uuid": "76b33a30-0e14-48a9-b01d-8821e6fcdebc", "comment": "Malware payload", "value": "181184965cfecb7606a5940092cddc70", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789905, "uuid": "1f04f428-31e7-4a0e-9e8c-0a04c977d2b6", "comment": "Malware payload", "value": "6ed7b3c6a701a4372461b6267b8d01ce2a05b7b78a582bc5bfbbebd04bae27c3", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789905, "uuid": "4c8738d5-bce4-4188-8d13-b8ddf78d5661", "comment": "Malware payload", "value": "705271d371d3eb0d2f5209d17410ffe4368ef48b", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789905, "uuid": "b19276f7-4978-4fb6-a911-95dc43a8fa47", "comment": "Malware payload", "value": "d0d47d5889c4cf17c1a1e5b3a2fac1e238fa6d610ffc37171947fa936552ac09f3e4c0bb61144dc98dfd046b827f7dd7", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789905, "uuid": "982dd5d3-e068-4692-aa06-cbcc8d0ea9cc", "value": "T1CF02AFD1FB50E611EFB98F38162C3DEA390DE47114C5D16AB015E01A96D15F3294E8EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789905, "uuid": "9e39cd34-c8d5-439f-aac7-1aaf48fc6645", "value": "192:xrXP/C+EsQO8d26ha2YQnipNDlGwpAZ9i5pb:dXPTEsQHMKUNJhiiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789905, "uuid": "f3b93514-119b-4d32-b41b-f938e859ae3f", "value": 8784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789905, "uuid": "37edef01-0489-406b-9531-f33f32fc28c8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789905, "uuid": "c69acd2d-1a54-4f70-83cf-de6bb4731bdf", "value": "agg.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34e758b-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802529, "uuid": "48f92661-0add-4739-a87c-8cea5bcb1296", "comment": "Malware payload", "value": "3ca201f5c7d5f9b35a788c0982481bdc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802529, "uuid": "bae657eb-20ce-4faf-a940-584216e85f5a", "comment": "Malware payload", "value": "6efcd6ba097d192e6f9dfecd0fbd7636525e6b608f4a591c3f34efbcc7698426", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802529, "uuid": "61ede038-3f30-42e8-920e-b11da9ffec10", "comment": "Malware payload", "value": "de4ba55976548e011726729f17a632b3b0c543c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802529, "uuid": "c9c1157e-9e93-4792-aa54-de90ce78aa8a", "comment": "Malware payload", "value": "7616848683f2f73e7130e8650c320e933a13dee7a1c7fe867d097390d99160607f02187138e7f552bf79bd87e89ccf41", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802529, "uuid": "f65e1680-4780-45fb-a323-4971da8ff010", "value": "T10C413ED82302D7762956A9BA71FA4407B188D05EA4F86F09AFFC3CF954DCD04B45A783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802529, "uuid": "dc6f676c-85de-41fd-958c-ac9c9d6cebd8", "value": "48:vTYTY4UTY0YqUTYMOY+KWUTYHYNKqAUTYOYmUTYxYOUTYgYOUTYmYGUTYXYqUTYg:vTYTY4UTY0YqUTYnYjWUTYHYgqAUTYOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802529, "uuid": "d4b0de27-f0d3-4c70-a238-4dbb0dfab99c", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802529, "uuid": "c903ea2e-0084-49ae-9e59-2b8c5c5e629f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802529, "uuid": "70235421-4ef1-4ff6-9e75-a3a91435356f", "value": "bins.sh.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef627567-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655823219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823219, "uuid": "d77b1e06-722f-4c4a-87fa-1f4e0d521bce", "comment": "Malware payload (Formbook)", "value": "9a4cea4caaf5eb230c5b11e7da2a112f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823219, "uuid": "ec85527a-9ed0-4c67-9c4a-005154fe4b25", "comment": "Malware payload (Formbook)", "value": "6f953b35fe9f1aa984e06446bc6353ecf594c6dbe11e7b07be43bd6e0eb8ad9a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823219, "uuid": "bc1687e0-dcd1-46b0-978a-5cf871bf483b", "comment": "Malware payload (Formbook)", "value": "f2b78198a3587b97548717c3a1db995817da1710", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823219, "uuid": "dc4bd35f-f4f6-4fed-a903-66969af22eeb", "comment": "Malware payload (Formbook)", "value": "9ca0fe2b62cf1b285c5d7ee9639f89da2c4e50186276e1cd65f23d6375af1738b8621c35c75577e93799b287a10ddbb5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823219, "uuid": "27722c74-2937-4081-8a67-7c365a7adb9e", "value": "T18964CF1B73DC4F41D9A86AB5C4DF552113E2AEC72F32D39A3F08679C1E423A39E80659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823219, "uuid": "15328917-fe40-4678-9983-63ce9266666a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823219, "uuid": "5aff0939-6fc5-4414-bfc9-e24becbc353d", "value": "6144:LvArm7CtUMT59qL/qOflDhfdW+FfUuABLYRwg:DWpNwbtLBUu5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823219, "uuid": "ce42f1f8-2178-4480-aebb-5fe54c8f4a3b", "value": 313880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823219, "uuid": "bf303787-8f2a-456f-a2fe-9ba3ed620372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823219, "uuid": "9dce2159-9f5b-40d4-98c9-cdb5f3859252", "value": "DHL RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118beb6d-f10b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655779038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779038, "uuid": "cda4a818-5234-4541-b586-992f0d4438ea", "comment": "Malware payload (Formbook)", "value": "b85ae7b195f885f716c75d4f237cd0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779038, "uuid": "ffc5a9ad-3595-4760-a1c7-aa65b1319599", "comment": "Malware payload (Formbook)", "value": "70239322a00a334498eac4672e0fd100a6b33294eebffbbc673b7667f9583e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779038, "uuid": "878eed63-b9f3-4aba-b0d1-cc39fbf84de2", "comment": "Malware payload (Formbook)", "value": "5783658698da2ef574eb0eb3645b235d0df29298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779038, "uuid": "19a2b3aa-4711-4813-8e51-c2988aabc298", "comment": "Malware payload (Formbook)", "value": "7fea6aa4a93637a5fa6ff94251f8943ebb9dc92d553d4a61f8af0aecf230b9d9c7a6ca6f458861cfe61f990ff42741cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779038, "uuid": "1dc73bea-05ca-4b7e-93ed-a9dc6dee49c4", "value": "T1F6A45D6DBB018AB7FD0DE03185010B08FB660F837248B9A667DB27E9C7DED659C45C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779038, "uuid": "e3827cf1-e424-44ca-abc7-7bd43aeb28ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779038, "uuid": "11d03e73-3be9-48a5-a306-82cd4d3a0618", "value": "6144:LN6/tx7iBjLkKV/nXlXYdKf20AlcSO7yg8mB3i8HgM3gEdkoVy6bY482G:otx7iBjLrnXNYdBrKPQOTJgEXI6XXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655779038, "uuid": "7b3e8cae-ceb6-4770-95a3-0aa5c49d7125", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655779038, "uuid": "aa8d2630-42d3-4755-a636-a08138950e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779038, "uuid": "56c135c3-d311-489f-8922-1d80a2e3d653", "value": "SecuriteInfo.com.W32.AIDetectNet.01.4867.24744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd15b83-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655802276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802276, "uuid": "310f791f-fe3a-4a49-b7de-8bfc3ee8e9f4", "comment": "Malware payload (AgentTesla)", "value": "71869e932e61f81f84749a487094afd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802276, "uuid": "2a574528-deba-4bf7-b9e6-e0ab1c1e9e6e", "comment": "Malware payload (AgentTesla)", "value": "703e1e42772dec3d580a2812c31ec51dbeed5a48a488858013c6227820ad58a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802276, "uuid": "3636d0bf-c001-4f10-9bc3-8afb8d726f3a", "comment": "Malware payload (AgentTesla)", "value": "b339dc8dcc8ba16cc5d30602f45b50b7c4bac682", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802276, "uuid": "e09e009f-e3e0-4b6b-ac2f-e96a5f20d91d", "comment": "Malware payload (AgentTesla)", "value": "41a106c29759b857f6485fa556aed7b59c2895e5a9e6e4d16e53c3c0155a3989e7b42491497e99dcef2c66c806085897", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802276, "uuid": "0c20dc3e-aa74-405c-bec5-c22a4d201704", "value": "T12583E0062504C712E6687375C26BCA4D4360EC9E4C48C357A94E73DB9E72EC63BADEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802276, "uuid": "2e797e87-5730-4169-ae03-ed0759404f2c", "value": "1536:4ueBJoZtQan5VZQN14e7Pyj3bYoZfzQIbLT8Q1PKakkPq:4uZzb5VZQF7Kj3bqI34QQXkPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802276, "uuid": "9c075a8d-3111-45f6-8387-4f337e1d056d", "value": 81688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802276, "uuid": "34407c0b-5991-4111-a14d-180356bfc7c6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802276, "uuid": "123d9383-e750-4893-9ba8-97358140a219", "value": "awb_bill_of_loading_receipt_00000000000000000000000000000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4740354-f197-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655839441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839441, "uuid": "f2028806-af10-44f8-8147-8f4a8793326d", "comment": "Malware payload (Quakbot)", "value": "4b06952de277a868c5561126e757c102", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839441, "uuid": "17e7634d-2c27-46bf-98e4-3dee4dd3fcdd", "comment": "Malware payload (Quakbot)", "value": "7043dc865d6c6de28e2ff6e5c7614586c739060dc6deeaa2e27a0e208ad084e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839441, "uuid": "c211099b-1cef-4490-8b64-ad669a5101c1", "comment": "Malware payload (Quakbot)", "value": "ae279091b9104915a5e81fe546d71419c245ffc4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839441, "uuid": "d1ed090b-d78d-41f5-b7fa-662e95f950a8", "comment": "Malware payload (Quakbot)", "value": "23f0512a71ffe237c99a77abb2c92f92587ebcfffb7d929c4a8775118f0cf9ce68b9c032b6b376ee01dd077e2610693f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839441, "uuid": "17a09f08-a198-4f08-a0d3-acf8ca3271c1", "value": "T132F49F72B3E04837C1771A7C8D1BB76898297D113E3C988A7BE41D4C5F3A7813669297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839441, "uuid": "c040db9e-8940-4591-b1db-4ab0a754a748", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839441, "uuid": "fe21d348-2e40-4c14-87af-d61c5cbf1c54", "value": "12288:pSHEVZKP1O+hamzhv1fm3N7qxZF0WGNY:eSi7NvEJkeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839441, "uuid": "e34d09c5-f147-4ffb-882f-9b670c2dbb1e", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839441, "uuid": "4bb3a9c3-98f7-4802-bccd-b0bf5b24dbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839441, "uuid": "33833859-5af4-4684-bf4e-cd06341c147c", "value": "200.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8fdd84-f13c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655800454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800454, "uuid": "7156837f-47a1-4988-bb75-9f1cb3e9a272", "comment": "Malware payload", "value": "629efe35e1db16675f55f359629a1a74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800454, "uuid": "d89089c4-08b4-4207-ba09-fae12938c189", "comment": "Malware payload", "value": "7092b91be83ccc07c222deb80a0898a35e53a66f3f378c64743e98e5259fabc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800454, "uuid": "c64202b4-d559-4cb2-b7ff-c3e37f72f7cd", "comment": "Malware payload", "value": "f430cbb578db7dc8070e640fc8537646624b4ce0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800454, "uuid": "a1a6c1dd-a6c5-4bd9-b82d-da42c35aac5e", "comment": "Malware payload", "value": "f1cd1076bb460886ba797057d9a49ef0c1bcd7df53fa2e79c6ed1780eaa34e1330fecc067441f3aeffc2ce6744aa606f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800454, "uuid": "89d62217-8d3b-4ac9-af85-d5e613782250", "value": "T1DD9533367EF30FAFEB2D84F1926B6CE910A6BD9D6759803216E932463132B714B13314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800454, "uuid": "c3549a9c-8906-4317-9ad8-880acd935776", "value": "49152:df6o4AzEI95UqPj7Rj9LapZhFvEpSwcxdk:df6NAgI9577V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655800454, "uuid": "87a91926-0112-4f65-a69d-7835e577f6c6", "value": 1922560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655800454, "uuid": "a84267f0-f23d-4c96-8e47-9657c4d56edc", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800454, "uuid": "ca59f535-f524-43de-8180-069141ed379f", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.7594.13728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27edfc5-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802044, "uuid": "b0a9f315-c095-44e7-bd6f-475421b50678", "comment": "Malware payload", "value": "80c541ef8733b76a0f1eb80fcb3c8e13", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802044, "uuid": "e4f3e4a5-1ffd-4bb2-bf49-cb36a1e19b64", "comment": "Malware payload", "value": "710cdcae000f4c39150a322369eb1d6bc16df04b55bc340584bc29ba1af0adb2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802044, "uuid": "28fde4da-ac1b-43f7-94f1-2f422422b318", "comment": "Malware payload", "value": "67e226a5689b1c04afc96778faccc3cc1a1775f1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802044, "uuid": "1f5fccae-2272-42c7-aef9-30b0fbdc071c", "comment": "Malware payload", "value": "be153d7c477c37cf43984b3ba663c2fe46f141bbaa86b4a91a4ee12c2bf65058ad2ba5469e9fd44e9fca59245fbdf758", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802044, "uuid": "1a942889-39ee-420b-93df-925836e5a1ae", "value": "T10A467D23B284A13FC06B1A7A4977A768A83B7A713D12CC5B17F4588C8F355817A3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802044, "uuid": "3013faa1-c6aa-4c33-befc-5f364b400469", "value": "98304:7IjmGD/cR0WkmOiuVj7mAoao2Tw4xWF8tYYEA:7I7/cR/OXj6AoOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802044, "uuid": "11514c14-7558-414e-af28-de78d0d6e660", "value": 5520896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802044, "uuid": "0c91d94e-5c2c-4e69-b002-85fc1d72ab11", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802044, "uuid": "d7b36ff4-0256-4515-b74a-2748fbbda6c1", "value": "IDfac-t.165.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069fe808-f196-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655838720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838720, "uuid": "c7ac9582-a6a4-400b-b0be-09ba1479b1e1", "comment": "Malware payload (Heodo)", "value": "dd42d6818567daec5f496134ac657a74", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838720, "uuid": "ca0177c3-ae7a-41e9-b28d-3b8edd1468a4", "comment": "Malware payload (Heodo)", "value": "71ed265e325581d682a0c1ab1f3ab148d0ae47d50fe8ee289b69c2aca0ab3ffc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838720, "uuid": "0a13dcf5-a803-4c7f-a817-dfefcfd1e98a", "comment": "Malware payload (Heodo)", "value": "82f69f7da527bc0242a39ddb631850174d7a7628", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838720, "uuid": "edb9405f-4d08-4f53-a17c-aa8a463ad532", "comment": "Malware payload (Heodo)", "value": "0dd722a9de52c2180a2be82bf7547823d6390cc8c6190fafc4ac0f305318f70fe34248b23c790f07f7fc73ea16801da9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838720, "uuid": "8ea84b28-9466-4e34-ac3c-a83f96863411", "value": "T15B648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838720, "uuid": "56507f89-5fd3-419d-bce9-195365f8c9f6", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838720, "uuid": "1023761b-9936-4d74-aa75-6a3cfc03ab10", "value": "6144:JqdSTDcHe3kjHfNsQnuXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3uIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838720, "uuid": "1a5dbd18-bf2e-4207-9f3c-041ceb794ddb", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838720, "uuid": "d2032f06-de2d-47f4-9a52-2c6302c5c2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838720, "uuid": "f169c060-7afb-4753-a6f1-a0861d0b3666", "value": "dd42d6818567daec5f496134ac657a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2c6b6a-f197-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655839423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839423, "uuid": "7551f379-5f90-4c27-ab93-549f51b76730", "comment": "Malware payload (Heodo)", "value": "f278bd6bdd8d93b357f6c893a6f8a063", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839423, "uuid": "12e0b765-5830-4670-bb71-a7244a778065", "comment": "Malware payload (Heodo)", "value": "72c631465056f9b736fbc1387dcb267bd2cb057e7c4b6b9424c1b765bc525a05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839423, "uuid": "5cb75d13-9e03-43bf-ae53-30ffc28f5f55", "comment": "Malware payload (Heodo)", "value": "8284e382ce46f601a8c9d08e4aff7ff020a4c2b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839423, "uuid": "60ba6c00-4f9b-4a63-8803-6e7db6f20179", "comment": "Malware payload (Heodo)", "value": "eea8c49201feb343d1db35e40779b0cb1f8691a9f12861c66fa8fe9a46810f861a17ee41f16db43346548069a71ac4d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839423, "uuid": "bd9e5fcf-fddf-46ae-997f-8157cfaa7418", "value": "T17964AC062240446AF74A4B708A17F9D687667C7950E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839423, "uuid": "348459be-7d0e-40b0-b4fe-3267fe46f60a", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839423, "uuid": "7f8981bf-803d-4440-b502-46b1c1a7d180", "value": "6144:3MiSTD2He3kjHfNsQnXzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3oNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839423, "uuid": "8b964087-ba9d-49cd-a1db-bf7ec0f856c3", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839423, "uuid": "10deaf53-c8d9-40b9-9094-fdfb55659bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839423, "uuid": "8db41f11-ccad-441a-85bc-1ee12adda151", "value": "f278bd6bdd8d93b357f6c893a6f8a063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e65a21-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655840562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840562, "uuid": "9e2daf36-862a-4151-a79b-e563e4b563df", "comment": "Malware payload", "value": "de941794760f98e49eef46ec3b7d3c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840562, "uuid": "e6aed8de-3a59-4e3d-aa26-c703efb7b465", "comment": "Malware payload", "value": "72caec95e98f61048c2838ebb0213717c41575cccd986f8fc1d789d4caef01a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840562, "uuid": "4f40de55-6ca5-4627-b9cf-b8f3ad323eb6", "comment": "Malware payload", "value": "e1fe19ca716aee5d0e23e4ea9febf86307764fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840562, "uuid": "4ca09d50-551b-4b86-a66b-c44315b0ce84", "comment": "Malware payload", "value": "a4e07be732c1260097d350ebe9a28b0c72a4b7f294953b6764510cc03034670f0f3a9475eb2f0d6d00ca079df74e817f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840562, "uuid": "acb2f005-41ef-405b-a4ac-761fe8733e3e", "value": "T183946F8EBF0CC5ADE863CE7A965A364372A2714366F304D636DD5F3917D1A8D3810B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840562, "uuid": "c0d16b6d-b2d6-4918-87ad-f314798dbae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840562, "uuid": "80fb6bdc-c071-406e-8895-f04a0e103019", "value": "384:wbLVFUsvvAqjyWk8gHcR26TD8WhMjNAW8dC7k7X6jM9858txGwQA5Alo:wboUv1G1r8R2JOdx6wJxGwQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840562, "uuid": "d79bcca6-0039-482f-83e4-d12ad6096db1", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840562, "uuid": "0dced51c-86cb-4f85-847d-d8f63051ac82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840562, "uuid": "bb3cd968-76c6-4d60-b1df-3f0b2939e8ca", "value": "SecuriteInfo.com.Trojan.DownloaderNET.345.29836.20721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98966e22-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655813624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813624, "uuid": "07741b89-99bd-42dc-a147-71ffbf87e30c", "comment": "Malware payload", "value": "19caa8e3382ba072ee1ccf976a13bb36", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813624, "uuid": "9699ce9f-7884-4e57-9a39-34650e704886", "comment": "Malware payload", "value": "72ecc21cb472e3bc24a3ad0f9908aeb3234ac1680aebc2ac751a256197303c42", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813624, "uuid": "6ed58963-1ee4-4ade-875f-7aa0f2d3a911", "comment": "Malware payload", "value": "b7518bdbf3ceed7a1258162279b4821ffd759859", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813624, "uuid": "4474a94c-78a1-4524-a46d-7f64a3c32ab5", "comment": "Malware payload", "value": "5037682604d96c62980df49e2ed3230f096e0a1807cde973e440e3a98d99cf124db4dbe5bb4d2f17d6a74b387b96c4f8", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813624, "uuid": "666feb11-df0b-48d5-8267-ea24cc912eda", "value": "T1EE83E10D8E7C40ACCBEA17BE5E405712906CBE11296E5C2BFF43BE689C749E04A407DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813624, "uuid": "160cbf1f-af51-490c-9eec-0137ff0ba9cb", "value": "1536:TDN99ElYEeKHXyjsHYwHmcudUjCfmHJusoHYr7LaGAE9OZ:Tx99SHfYwHmcRjQmHJyIAEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813624, "uuid": "03179d36-b842-4b3d-8bb5-8a52a1799c4a", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813624, "uuid": "2598db26-59d4-425e-9c49-e59c17203951", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813624, "uuid": "90eb508b-e40a-4371-9844-23fb0aef1a1d", "value": "newlistfor6.21.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f7fe5-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655809729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809729, "uuid": "c95fc958-41fe-4438-a944-5d361f9d6044", "comment": "Malware payload (Heodo)", "value": "965662b53daca6f13d41aec9704e24ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809729, "uuid": "ca1c4787-35ef-4a75-815a-739b93616b4b", "comment": "Malware payload (Heodo)", "value": "734f15f960748e5e975566ff963b9b4d5a230e46c8c7d33aaf70af2f25e01ca2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809729, "uuid": "4f3999ef-9baf-47fc-bd92-0b141492f88f", "comment": "Malware payload (Heodo)", "value": "5ff9062e7bc69c6285f15ca0561a763c8dba18db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809729, "uuid": "adc1214b-6c28-4b8c-827e-4415c3731662", "comment": "Malware payload (Heodo)", "value": "7d000a05136a8b11674ba87a309ff4066b8379831d89aa67abf15b994afbb7458f4bb9d866048dcc1ad39d1e848f7f4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809729, "uuid": "762be396-207c-487c-a0f2-896e447398ce", "value": "T18A64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809729, "uuid": "9eb6d6d5-06ab-433e-9e8a-aa608dad7510", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809729, "uuid": "db3a28d2-2ca0-49c2-b2bb-0bfd35aea6d3", "value": "6144:3MiSTD2He3kjHfNsQnuzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3JNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809729, "uuid": "fe56615c-fba9-43f5-a500-c9e4cfd09c00", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809729, "uuid": "46b24488-e566-49f3-a89b-bf5c3f281cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809729, "uuid": "374914f7-0f47-4009-9d8f-d94201ca8002", "value": "965662b53daca6f13d41aec9704e24ae.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4d2c4f-f115-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655783408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783408, "uuid": "1377982a-8402-4de8-a912-1a28fbd78443", "comment": "Malware payload (Mirai)", "value": "2d24b69cc0b0c6de6e241f70dc259658", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783408, "uuid": "ed70efce-8914-4cca-97d5-a5a282c2c17f", "comment": "Malware payload (Mirai)", "value": "73a0975f1a2a60d3d0b22a6bed199eed43199ac93b14695363f66a0117d7abf3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783408, "uuid": "edcd3611-322b-48a9-b990-f2378568af25", "comment": "Malware payload (Mirai)", "value": "5e3270bcb769cdcbdff0246778a7ab2c2a698ba1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783408, "uuid": "ad333c9b-5de9-464b-b773-75fdd52a0a13", "comment": "Malware payload (Mirai)", "value": "f809ae720fe7d244a76063b203010911a73233636cd222e61d831c2220303341e6c6a457cf8462ca7b1f9ba003691f6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783408, "uuid": "74a26223-d35a-4b89-90e7-50930f28e8fc", "value": "T16A030985B8808E13C9E4527BFA6E41CD33256798E2DF73079D222F51778A82F0D67646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783408, "uuid": "365e2daa-8e24-4dff-8d0e-879f32be67f6", "value": "768:Xin395VQZbphZXDSwY3G6Yoetg1kUqi0MCpN+151d3pahR1v:I9EZbbZ63GB3tgrqi005cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655783408, "uuid": "eebfeae7-7018-485d-aa53-dbf2acbb52a6", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655783408, "uuid": "5dc6e7b4-44de-4a11-afde-11f3841c8865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783408, "uuid": "70c6cb2e-20ce-49f6-9041-8ea3fba22d43", "value": "flow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee17cf4-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655799649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799649, "uuid": "35876147-efc9-45fb-9ce1-dda5dd9ac6af", "comment": "Malware payload (Loki)", "value": "3a1a0bf1e61fc7662a80aa237efb1d36", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799649, "uuid": "637e5b75-baa8-498b-a02e-c672b55a94db", "comment": "Malware payload (Loki)", "value": "7462e98e5d3eb8b729978bc8d511cc736128e4fd0a984390deb141785bfe3af9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799649, "uuid": "43c5902a-0e6c-47ba-a07b-7a452e4220d1", "comment": "Malware payload (Loki)", "value": "4c495a59096654f9d80066872cc1f3209f22bb2f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799649, "uuid": "19e3d953-8c3d-4201-b599-27cce6d55ab6", "comment": "Malware payload (Loki)", "value": "7a5ecba8f6744a767e703b63bd7e6d2fd6718f414cab8dab74d8a3470caaf2df3f5fafffa0f8ed93fb50af6f691bd537", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799649, "uuid": "4791fd7c-68a2-4a7c-a637-680d1391bf8d", "value": "T12D73E01516455A20E6B8163CA3A64E92C38AFF279DFBD27AE1503B4E86333474C204FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799649, "uuid": "934e72bb-f38b-4148-a445-77aa5a59e605", "value": "1536:rhwlYrOD+gH6WxL8o7AgjNhBRUMFifrJRy3fW3kDHPlMwpKmiHaf:rh2HH6WxtRTlS3spFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799649, "uuid": "d40b7873-811a-4343-b9a7-dda7caa287a1", "value": 79880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799649, "uuid": "db2a7246-329d-4821-8496-d8fc82b40e6b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799649, "uuid": "fe94a8ec-730c-4ee9-8d31-2217712d21f9", "value": "NEW ORDER_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eab9e4c-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655802253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802253, "uuid": "4608676b-7b1a-4fde-a1a2-211aec4898b3", "comment": "Malware payload (Loki)", "value": "a0017f8667fe0e4edd60412cb64d7d3a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802253, "uuid": "d6d62bfd-9df8-4fba-9f4a-3d0b8ba8ca5d", "comment": "Malware payload (Loki)", "value": "7512140c26eb03a123c7f12513c061e6b4fdf9e45f6b0cad7c2b501eb98fe252", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802253, "uuid": "e245a4b6-1804-4551-8553-a9de7f0312e2", "comment": "Malware payload (Loki)", "value": "26e3f0f49e3da7ce7472b9b923e8db555b89009b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802253, "uuid": "72993bad-4295-46a7-84d4-dc64a1416f8c", "comment": "Malware payload (Loki)", "value": "e33ce938bf56040e579b260d462d3eaae6f239939b69ed8201239ba1665e24fc13dab6ea75a28bb09ac8e45ea1d43f8c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802253, "uuid": "fcb8120a-faf7-43f1-9354-73bc4bab3dd4", "value": "T1E783E11DFB619A1CE456983E089E56ADFCFCFC06405221E74A3B33AE0B30DA90955DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802253, "uuid": "32b3a332-d92f-4005-88b6-b01115ae3dfd", "value": "1536:zX/aO4WZzwi6Zwx+HUOvxztyFvtr68urc5QQZiJZJFV4W283:zh4ksi6K+JztCFr6tOQX//r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802253, "uuid": "d32cc770-08bd-4b19-8ea5-5f8a2ae6eb73", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802253, "uuid": "f36062f6-9625-4d11-ac04-3f4bb9492d54", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802253, "uuid": "d36b9f19-8f4d-49b0-9eda-545b0997efa9", "value": "Payment_Advice_USD 64.645,00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1a92dc-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655813632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813632, "uuid": "3cb28661-89c6-4426-9197-ae035a09e4a7", "comment": "Malware payload (Formbook)", "value": "1122f29208098e9d39655827fe7efbd6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813632, "uuid": "5cfe3d4d-2214-490d-be84-eb145ee89cf2", "comment": "Malware payload (Formbook)", "value": "756240595bd69e9c3415ff6c49e8703dc2bb54bdaa0d2914ce5e33ab92f51813", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813632, "uuid": "4b9c1d2f-df65-4ac7-be66-f5439cb3c500", "comment": "Malware payload (Formbook)", "value": "fca1db5fff0698113d88e70c876a63e630a6ff0e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813632, "uuid": "39da90b1-e274-440c-82f0-ce3eff075447", "comment": "Malware payload (Formbook)", "value": "8832fae6a15fb3234f32d650bf71a8a91971abea5bab0c23bce2191f08564243e484b44499f58ef54195d80c06343932", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813632, "uuid": "57ce11e1-fe60-45e8-aeb1-6fff8ac9dac0", "value": "T11073E00792991277CE6A4B784DFEBF4252727DD4BBC6B2301708BA8940B7503C9F056B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813632, "uuid": "a5971782-0373-48de-9c37-fc21e854c849", "value": "1536:1gmkQ+HHfIyhDVSeQFA0ny9KsidD7MBGeuDR3zEfDTMTGyXEmjW4S:1IDhZkhny9KsWD7MAesEfD8Ypb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813632, "uuid": "9889b982-5bff-4f2b-bfc3-06be3359cfda", "value": 79976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813632, "uuid": "56bf91ef-6816-4697-9a7d-3addc63c94a2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813632, "uuid": "aca75b9b-530b-4445-ba50-da9e44f47ccb", "value": "PO1286482.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd2b57b-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655793363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793363, "uuid": "5edebd57-4422-4c3f-ad1b-bb9b6cd9c2db", "comment": "Malware payload (Stop)", "value": "51f31fb352710a83bfb23b4e47342a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793363, "uuid": "0940d0a7-c7e3-4e58-8994-83b12fa6504d", "comment": "Malware payload (Stop)", "value": "75642166df00faf8887d103f1e985db3dd436d112a95392c209b92a43a03d710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793363, "uuid": "2441df5e-4976-4383-a589-6fda85553f7d", "comment": "Malware payload (Stop)", "value": "87e6f42e004af7eb2f3102c0fecc3f218b0da9a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793363, "uuid": "a04ebf0b-f8ad-486d-8374-b4cad964da75", "comment": "Malware payload (Stop)", "value": "9313ceafe0766e840f4ff08aa18bf2228a6f1be4c28d17af4fc1dd099e39ad47bef0e6b7554e8f9604c0b24179f1dc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793363, "uuid": "8cd6c7ce-0c1f-466d-a46e-ff04843c2e47", "value": "T1E40523127763C871CC1B46744C15DAA4AEF92EB32A34444FB7A92E5FAD603D229343DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793363, "uuid": "884e0b1b-d7ef-4524-b088-dac83ccf063a", "value": "32138f5b4c47f39b193f3de45cb1e6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793363, "uuid": "1e688b17-20d1-4f9a-80df-f3550ac0a91a", "value": "24576:OU8HqS7Z9/7XIdGf025VHzGQMvGhERnx8Rrbn:OzHxPGu55zGQQB78RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793363, "uuid": "f664e0b9-8fee-420e-a838-86bec3f12020", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793363, "uuid": "31196d7a-74c7-49b1-9d3e-3be29d661629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793363, "uuid": "d0652822-5daf-46bf-a8e1-ee45924781f0", "value": "75642166df00faf8887d103f1e985db3dd436d112a95392c209b92a43a03d710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527e917a-f1b5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852161, "uuid": "b9d1883e-2cfd-46e3-85dd-e1057662bd48", "comment": "Malware payload", "value": "304cb95f6389bac2caf00f65bbb47b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852161, "uuid": "6c9b5a51-a924-4b4c-9b07-d55eb3dfd6d4", "comment": "Malware payload", "value": "760d7b49899f67e6a3bf767e7b028aee3263b29aafb77024886e40859eca904e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852161, "uuid": "74a19c98-d03c-4384-b770-f1866ba9f06a", "comment": "Malware payload", "value": "6297684d59466e03e1f35ebf6271b594138c25cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852161, "uuid": "45303496-9039-4e2b-bc41-116f90207626", "comment": "Malware payload", "value": "ab77c22605784aba49195e1f94a921995b92ce5ba6baa3ad73e40f3886277ee977a9b927ad981b06a4b1c345c7e8aaab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852161, "uuid": "fabaa26a-0cba-411d-a3db-86de6674dcdb", "value": "T1C494010DBF48C629E0A7D73E4A5135673A999A4322D30DE53BCC9F319B8132DB5A1DC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852161, "uuid": "dfc2c4f2-0f4b-45f8-9cbe-4620f080ec25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852161, "uuid": "adc4dd63-f086-4a78-81df-2a9eaab423e2", "value": "384:4LPGQFvfL499jDXE4wFvnNJPO/WZC7WoX6jc9858txGwQPcuK:4Cyfs/zuFvnTPHc6QJxGwQUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852161, "uuid": "1d6323b8-7294-4632-8438-11b100153ba0", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852161, "uuid": "24e2856e-4f90-4b38-bc24-1430bf7a0875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852161, "uuid": "f9629a27-74bf-404a-a6a8-c5efc3060f97", "value": "SKPQ090000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7716b0-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840506, "uuid": "ce6e7e2f-b422-48b1-bfa6-e1d006859471", "comment": "Malware payload (Mirai)", "value": "850cb3c08f5814d3b6f103aacc88de93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840506, "uuid": "610a3f4c-e889-44ff-acb6-f47cd9d572bd", "comment": "Malware payload (Mirai)", "value": "767f01dc1e0929c910b920e33da426c83e4f48bf9ed8f2182d9de5c9c62580d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840506, "uuid": "78390283-818c-47d2-b492-a9830a33b89e", "comment": "Malware payload (Mirai)", "value": "c36ef090fdcb0bf8640d208f626a05741fcf56e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840506, "uuid": "6e84013c-2cec-4f84-a23f-dac42da7394c", "comment": "Malware payload (Mirai)", "value": "6361586c5256c899322e5f7eec4760aa433543e86d2aa916b65acc947e6d8490b9d30f3e8dd1f0b8126f25fdbcd618b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840506, "uuid": "0996b16b-e0b3-4153-bfd0-0ca63b35b2a5", "value": "T110933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840506, "uuid": "3c50d53d-9e6e-4939-b31c-ba7733cd9966", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+86l4umXxVqDrstKfz9e:Q97vk51RcG7AIl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840506, "uuid": "6ad502af-03f5-42f3-b781-6b50d382b223", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840506, "uuid": "53e17711-7411-4d70-8f81-d7f59fc6900e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840506, "uuid": "b8d35646-db4c-4c9f-a20a-7e05410c9519", "value": "850cb3c08f5814d3b6f103aacc88de93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdda5d0-f17d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655828098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828098, "uuid": "12852138-4410-42fe-a679-ae3267d88175", "comment": "Malware payload", "value": "243e6ad8c1188a137e99cdaf68b70384", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828098, "uuid": "68538684-562e-4492-aae8-b28ab7253126", "comment": "Malware payload", "value": "77455163378d89a98833a8278b82b549405a8c855a62657f850b20ecb05f1f42", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828098, "uuid": "2029273b-c21e-4e30-a0c1-e55f292a2afa", "comment": "Malware payload", "value": "49b94d9e141aae47d73c2a585f93431e6192188c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828098, "uuid": "3edaddbe-a820-451e-a658-ff59e6dc180c", "comment": "Malware payload", "value": "215a0b46f18785c74c3a431709dd7b43dc3c55f153d8b8d06c4f98fb31006ebf540e34430d21347fceb43faedd51e939", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828098, "uuid": "025812ec-a6d3-4b12-9ef5-b7aa4ed12473", "value": "T16336330375D11BBAD0CF57B01ACB47668A75BC30CA12482B3219565E3EA3662B3F73E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828098, "uuid": "d77ecb45-5fcf-482e-b530-2f8f017d990f", "value": "98304:OYxArwTzxXA6KMvLWL0s8V+99492sJkfAvE2cfwTgN:MwpiMDWL0shE925j2coTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828098, "uuid": "d664bf79-485e-44be-b0c8-789adcdb045d", "value": 5133312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828098, "uuid": "f14ffba3-50e6-42a1-a4c2-a0882e7cde5c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828098, "uuid": "71ae1863-52d2-46a2-9d48-579166929a9a", "value": "v,iv,0458918256pfdhytjq f9wcw6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3259c56-f1a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655844243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844243, "uuid": "fd4ed440-e08d-4911-ae4d-c425bc2ab462", "comment": "Malware payload", "value": "9091bf2180b72d212ec8b351533fab28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844243, "uuid": "0f19d1a5-a4cf-44cc-9a9a-21cfed19d9fe", "comment": "Malware payload", "value": "77657a83f8941d6b0eca6dfdf1d5f41105315986548045146ef92810b393a9d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844243, "uuid": "14bbc735-83da-4389-bc09-2b96317487ad", "comment": "Malware payload", "value": "01808da1659f08e6a4151c4c4102e4089e8053cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844243, "uuid": "495a229a-1e75-4fdc-ae66-a6f916a31103", "comment": "Malware payload", "value": "47b4b05a1c3c4be1bc7950e56e9993442091069dffabd3e5d84592c618511e004df5bf9057d7cbc44e56bf1505519b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844243, "uuid": "b7c49cbe-5f86-4515-ab96-ca310762dc3d", "value": "T18764AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844243, "uuid": "cb178ab7-cce6-441b-8407-921d59c90203", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844243, "uuid": "f527a3ed-1157-4b75-a810-2cac6833a445", "value": "6144:3MiSTD2He3kjHfNsQnwzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3nNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655844243, "uuid": "b1870c4c-0d15-403d-b761-8c81a5377d84", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655844243, "uuid": "093ee36a-e7d2-4e46-b6a9-d5a7032d0df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844243, "uuid": "1eb0d3cc-4a43-4ada-bfb2-8e6a6cfda8b0", "value": "9091bf2180b72d212ec8b351533fab28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aca1f70-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655835908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835908, "uuid": "8ecce140-cf6c-4f09-81da-36865ff55acf", "comment": "Malware payload (SilentBuilder)", "value": "bb58d7ca49b20172117bd1385749096a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835908, "uuid": "95238795-d42a-44aa-8454-8e4992f268aa", "comment": "Malware payload (SilentBuilder)", "value": "78a26f40d27e47759c1309178b4135a62bfe5c5d32abbebb568d59b676f06d06", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835908, "uuid": "64b4d1de-c726-4147-b4d0-0f9b22748790", "comment": "Malware payload (SilentBuilder)", "value": "c539677c1e63adf1be04c1ed145783fd227f7a4f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835908, "uuid": "c6cd7ab6-3598-4591-986a-5ad278584edc", "comment": "Malware payload (SilentBuilder)", "value": "14f710bfad060e48498636e05d60e714b7835cdc7462ceccfd57c368b22d13051e50d832a8af8e0152728119f1b9735a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835908, "uuid": "4d8e2a43-81f8-43d2-86a4-9a8146569f58", "value": "T1AE532956BA5AD81DF915873548D74BAAA327FC314F9B0B832269F3106FFC8A0561710F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835908, "uuid": "2e7ba4be-e20e-4280-b719-29ea5402aa3a", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAs5A:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835908, "uuid": "ffcba56e-6e84-42db-8185-158259f7b12b", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835908, "uuid": "2a8498b5-f101-4ad5-8429-443cb2516a22", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835908, "uuid": "6f67850b-a050-4c00-9b5f-0d80e4da1e2c", "value": "2022-06-13_0811.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab0c35f-f198-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1655839720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839720, "uuid": "9be36559-a985-4103-8511-d904f8c668bf", "comment": "Malware payload (Amadey)", "value": "a2132d767bad830a692b031356c9b0c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839720, "uuid": "5c066730-6b04-4d23-a94f-0205e254c770", "comment": "Malware payload (Amadey)", "value": "795ad9d254028b8fcc3f3e51c8501903214cdf27bf769dabccf88cae723bfb68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839720, "uuid": "d57c7b14-d17d-4dbf-99a2-c0c0caa2a93e", "comment": "Malware payload (Amadey)", "value": "996ffac04b0fb8164f4f1c836b0b166a07d1f4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839720, "uuid": "b0686eb6-636f-449b-8a4b-d551561ef168", "comment": "Malware payload (Amadey)", "value": "159806f8349c2f4d9f8d48851593592e9c406f09476095bee67f1d408acb8864617f244e2b7953cc23359135f7dd152d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839720, "uuid": "93a5c7f9-86ba-4e3d-b3c6-ab81968a0e45", "value": "T1A274AE00BA90D435F4F712F849B6926CB92E7EA15B3851CB52E426EF57346E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839720, "uuid": "629decf7-cdf7-4ca9-8140-5a7b5a4f28a2", "value": "f02b034e89d56344c5b4492097e7d30e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839720, "uuid": "f2117ad2-6beb-4431-8ec8-79d59a5529c3", "value": "6144:hvWqRuqIkcnHgHfvu3QG4mLHiAHWmNaoyLkCEYmmbI1:hvW06kWHgHfvugWHH6oCnn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839720, "uuid": "c70b6592-0b15-4e5c-9657-80bd465ca107", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839720, "uuid": "b9f9877f-6cec-446a-a8d3-1ec5c5757ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839720, "uuid": "1130f153-63e7-4fa2-bbf8-d5accaf24d0b", "value": "a2132d767bad830a692b031356c9b0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61824fb-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854556, "uuid": "f2a74eda-8e73-4a3f-aede-37851a4be7b3", "comment": "Malware payload (Mirai)", "value": "9bdfcf879047105c8e5b2e57e3e61c93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854556, "uuid": "c677aab4-ceb6-45a1-92c2-13b66bc4da5a", "comment": "Malware payload (Mirai)", "value": "796231709e15ae3eb7de08f63ec47d3df7df24eafa91d9522675f63b1417bcff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854556, "uuid": "c3df553c-e955-4f6e-bc17-ea90113ae739", "comment": "Malware payload (Mirai)", "value": "38521d32e9020f3b0f79ed083808ed0d1c856c30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854556, "uuid": "0ab6309e-29eb-441a-b541-8000ecc29a6b", "comment": "Malware payload (Mirai)", "value": "f6b92cf220b5e3b4ecb391ee523ea0d61532c775f80dd9e650d3d8c2d7e2f6e19528a962ad2aaeb3a831c80a2c1a716f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854556, "uuid": "593d24cd-dfc3-40ba-ad0d-42dbc9466683", "value": "T1F4D2F299A7FD456EC8721E39CF3CEC5AC494097BA132B18EC981871065FE236E695CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854556, "uuid": "4c33535f-dda7-4ccb-a8ab-39258c7a1fdb", "value": "384:MbL1vWBD4oDXDb6/YcIa3NQFwzsdg/m8PoVRF+Xqy7OJisdSIorlAkgTBJlTsNyD:AxcDTv6/Yl3am8P2+J1sgIy/sPTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854556, "uuid": "cb5936b4-2b29-41fd-a283-6510b65f4ff7", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854556, "uuid": "8874ff94-01c9-407b-b886-372f70a3f408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854556, "uuid": "68ccc926-b983-44a9-b2b3-dd299c71659c", "value": "9bdfcf879047105c8e5b2e57e3e61c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560cc0db-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655840571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840571, "uuid": "46b1df1a-902d-48ed-96b6-c97235c88263", "comment": "Malware payload", "value": "181409b8ed16ee30c69ead0bcd679734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840571, "uuid": "c74b7664-052e-4c5d-a0c8-7af3251e0d00", "comment": "Malware payload", "value": "7a99767b1156e38716202e8cf7715187619f0917de050e5fe73b12966a529df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840571, "uuid": "bfdd57d6-b102-4707-8b69-e75bb2039d04", "comment": "Malware payload", "value": "b236b7e92d5b6e6f6ee6957a750faff7091bd311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840571, "uuid": "6e88aef8-02b1-4db1-8761-44e337b10998", "comment": "Malware payload", "value": "4057b397cc9843a5f655c16df870a2701145139b2b5d1fff692d369f8cc652f9e2927445d7b7a1eca93e30a7738a3f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840571, "uuid": "77a18bfc-f317-4790-bfb0-08b392d33e69", "value": "T194044AF08FF8B965E02521B77090A17C37E35D0EDC52E53AC69BF04A34A2AC564E5E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840571, "uuid": "b1f59094-bb74-434e-b2fb-349e26da7194", "value": "3072:2OO1sjP4+r4eDNR5dcZ2DKJHVugbGbMycpCrg9s1iOf5HiMWGzSFobvj:2OksjP4wA2DKkQFpOZHDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840571, "uuid": "e92562ab-5e9e-4b0d-9dc1-6884915f99a3", "value": 182087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840571, "uuid": "e6c09f6d-5c81-4f33-bf86-752b09d8bfc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840571, "uuid": "147d2d1d-74a4-481f-ac37-3887fb40113d", "value": "SecuriteInfo.com.Trojan.Siggen18.10673.7051.15761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b401819-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655823077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823077, "uuid": "499346d4-c1df-4e51-a470-fb8773cf423d", "comment": "Malware payload (SnakeKeylogger)", "value": "df7a5fc79c5a84b0ffcbc3d731a40f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823077, "uuid": "bd9d36e9-c2d5-4b78-b731-7afea1b631e8", "comment": "Malware payload (SnakeKeylogger)", "value": "7b59a4629a4ba14300e292a33edb15dc42c209137ffa863ae4e78458a60f2258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823077, "uuid": "cd6ae98a-24e6-4266-bd58-9e10ba203327", "comment": "Malware payload (SnakeKeylogger)", "value": "602bf9337271ba843b2c3adc11138f31d461fe49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823077, "uuid": "2c3d6da9-b778-4f29-9b3b-1109126db8d0", "comment": "Malware payload (SnakeKeylogger)", "value": "c0b8c483095d5b2a2051d2adf52291a5afbb45e87f5518ab9f02b526a9f05593b342c5ee23d890d4df8144f2995a1b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823077, "uuid": "0eb969af-6826-49a1-9f15-9998ef6e8ec2", "value": "T12B93E122D28F0776EAB4477574C79A3223B8AF21B026A0AF08AC3DDE7583B14454F707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823077, "uuid": "9f8ed747-9aef-4293-839c-af03b13dc18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823077, "uuid": "d3cb8c15-6f06-4e9c-96d9-5856ebe299dd", "value": "1536:MS3XYZISewuI9cPppv3s54ldQxM/TsLi+vQrpazPcXofYsxzR17TtJeqZS:MS32owa68d4kX6YsxzRB5JeqZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823077, "uuid": "92163d8d-0f80-4b12-882b-9f42817573da", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823077, "uuid": "6ebd19b5-72b5-494e-8e1f-bb001d3e6be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823077, "uuid": "5d7c0b92-65b9-41e7-a17f-95e6ca8ce32c", "value": "ORDEN DE COMPRA.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdeefeb-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655799644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799644, "uuid": "e7c0e2d0-dd7a-411a-b8eb-39d24d30781f", "comment": "Malware payload (Loki)", "value": "d7908f710192f25a7bd11fa2e32d9ccf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799644, "uuid": "f95e76ec-4461-463c-9bfe-b9e1ea97561a", "comment": "Malware payload (Loki)", "value": "7b69c45380a4602950ca16c2ed64e1178c2c7f2e3d3fbd82e952e9704a098a5d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799644, "uuid": "511f7ad1-18e8-4b0a-b9dc-98fa78e632ba", "comment": "Malware payload (Loki)", "value": "2369f44d1059a4ca9dfdf79b070c24b04136709e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799644, "uuid": "51d9b6dd-358d-4074-8b64-c74aaca5d3c7", "comment": "Malware payload (Loki)", "value": "1ac66e91c45d9159746748f2f0568d66594d5f42a0412c90b424505791420d495d66787e9329d67e192a391246c5d5b7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799644, "uuid": "a40bb53d-2a04-4434-8cb1-3c1f05e00026", "value": "T13263DFFA6F5CB2AAF35A6EFC1D4944202AF16C09D88C6E431DD4F62E1533893D5123E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799644, "uuid": "ed1b062e-84a9-42ae-bae3-60dcd63838f7", "value": "1536:adUTxm5RjhOF+IKRVqP/Vf867B8Q1HJX9ga8YBXSFTznt4:a+TkRMkuVE67BDpX9g2YTzt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799644, "uuid": "315bcae1-9357-4ca8-8af4-5084b9980a0f", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799644, "uuid": "75ecdc37-3c29-4b2f-8693-00dc7d4f22f8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799644, "uuid": "7f1773c7-2ee4-40af-8c88-187cd0a4dc91", "value": "HBL E.P.B -NFLNYC22074.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7cfff6-f169-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655819404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819404, "uuid": "a5df52a3-48c9-4526-9815-15344d8cd388", "comment": "Malware payload (Mirai)", "value": "4e635085cba96bef8c9803f37a9c5a2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819404, "uuid": "421f0c10-9999-4dcf-9c5f-b07f9d56a7c7", "comment": "Malware payload (Mirai)", "value": "7ca1c7a2e6225b0b7479e2b51609c8c39c0420b067c0b020e3fb7f6aab100b80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819404, "uuid": "0ce33bc5-c7ed-46b2-b46b-09ac500b470d", "comment": "Malware payload (Mirai)", "value": "240354338b7b60969869ecf7741d5a2adf6711fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655819404, "uuid": "a7801aa8-9852-4e51-aed4-ca170f8d3afc", "comment": "Malware payload (Mirai)", "value": "09c5dfc5abac13c28cc86edfe40018f4c40d40366e95145df8487df0be7d6f95ecf236a3f7787e37fd7bdf0439c1e64a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819404, "uuid": "501e20c3-dc13-4218-b601-3897c2e23b4c", "value": "T12DC2E1E63E773997DA2500392869CD339674F462C7AFA7139241924D210B1B8BB328DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819404, "uuid": "d30e3689-6de8-4512-99c1-daf21b3bf2c2", "value": "384:M21DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8QdO/S+ceNv:vMwKDZOFbBy6sSHRYfeAxdd8KO/lM0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655819404, "uuid": "cfebdff5-ac29-4502-bf9d-b3ee88359207", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655819404, "uuid": "6d1df88f-57a0-40f8-ae28-3d9e026b4c54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655819404, "uuid": "090c944c-60e5-4f0a-9af6-427cc953be26", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3735f87f-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840519, "uuid": "c3c61f82-5b4f-4287-81b0-53279915ddb6", "comment": "Malware payload (Mirai)", "value": "e047f76f319fce386226895dbb78c7c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840519, "uuid": "9d0aea87-1ed8-4f90-80b1-3ffc40014483", "comment": "Malware payload (Mirai)", "value": "7d39ab4e3e9744478b00add80cda75e98d089fe288c48733904aad4b1477d4f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840519, "uuid": "dfb3b05a-1031-43da-8fd8-e6c51797be79", "comment": "Malware payload (Mirai)", "value": "0552113827f0cefc3a2a90c50854e4d159012c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840519, "uuid": "7e12eaef-d3ee-422d-b768-8d44c6f8700c", "comment": "Malware payload (Mirai)", "value": "7bd8f70070e33044e05b72fec0139d9a04fd1dd6bea028f0ca77b527fe90322dd141bc9e5d376761edf66e44af0a4b41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840519, "uuid": "29089e23-e86e-4c6b-99c6-3a39f577278b", "value": "T17604F981BD117E73C2C3ABB6F79BC29937B36A1497D73301A964AEB01F46B8C1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840519, "uuid": "f5cead65-ae88-4ce2-ae30-9506f67f3a12", "value": "3072:+T0z4SqyjsCjEIMgali/sxIqItIAcdlpkgrTbjIsob2qYR1kP6G3oFG6yZgSJKQC:ibjIjbZYR+PcG6uJKQjvDyGuPoZAEMY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840519, "uuid": "3a272410-cab3-4ff3-b455-62cb3a1c30c7", "value": 174804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840519, "uuid": "d470de75-66a3-496d-a556-f87cfb29157b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840519, "uuid": "53aee1f9-ac1e-4267-9af7-e014f3a93b2d", "value": "e047f76f319fce386226895dbb78c7c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe9b47d-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808133, "uuid": "2172c4ad-ffdf-469a-b4a9-7dffb200f888", "comment": "Malware payload (BlackCat)", "value": "861738dd15eb7fb50568f0e39a69e107", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808133, "uuid": "53384517-c13e-4b72-9a2d-9cbf9409e621", "comment": "Malware payload (BlackCat)", "value": "7d8671c91a02bfbff8b89a76501b9be017a66a8bba624ed4fe2c7f81b9380ac9", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808133, "uuid": "9ccb5e32-7434-42a3-bfe3-6d0f4d8a2a42", "comment": "Malware payload (BlackCat)", "value": "e96950f2b7a9c1cdd542ab5bce025303a0b032f9", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808133, "uuid": "e756f091-d32f-41f2-87b1-b1f718bce2de", "comment": "Malware payload (BlackCat)", "value": "4524da9595d80d1028d6147b9e78441b8fc1b3a051966f42ad455a1f78d12caf0c85501660f5bdf5bee487ae2a67857c", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808133, "uuid": "1993e6e7-14fd-4fb9-a380-d3c93eeda0fd", "value": "T1B152A5123987946E527377B6CC87A50CFA29027F40B04618B4DC94E9AFB5126D3B8FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808133, "uuid": "bfac6250-89bb-485a-a674-dd03cfda7cd4", "value": "192:AnFu2iT7f65X7J5d/rdV8THeUN/66HBUveGq/TTe0dp7bp6l8wjhEdnygllgTwav:AamMeQBUvQTpH7l6lC6Twav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808133, "uuid": "435151c1-dd1b-43cb-93c8-2fc25070b3f5", "value": 13442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808133, "uuid": "f991cd73-c6d5-4120-82ce-f92c2335bbba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808133, "uuid": "e1110dee-0051-4bac-81fc-bb5068ecd9d8", "value": "7d8671c91a02bfbff8b89a76501b9be017a66a8bba624ed4fe2c7f81b9380ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b971132-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655809603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809603, "uuid": "a95fb175-3732-4243-a625-00b1fa2060a5", "comment": "Malware payload (Formbook)", "value": "2dce5b90b3f523aff613693f6d93769c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809603, "uuid": "51818461-096b-400a-87eb-a19f12ded123", "comment": "Malware payload (Formbook)", "value": "7e05b0a9ffe1cfbc4cb926477d044ad7b6046352f8734b95037e4f5ef21bca99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809603, "uuid": "3dd04d0f-076b-48bd-8237-7de78af53f54", "comment": "Malware payload (Formbook)", "value": "d9947b0881ac67b10687b48ed44a49c6198df310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809603, "uuid": "dd14db8d-0110-465e-bc82-e1fb86b59633", "comment": "Malware payload (Formbook)", "value": "c25837c2cb9632f322418fb01b572f05ee0c99f85cb10f109f5ee2f5fd7158feddd20658d83a29126bac792cdeb337df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809603, "uuid": "b8809514-50da-4062-a349-34ed201b7e0e", "value": "T195A4D0F18FF4B966E024317770A0607C37E31D1DD952E93ADA9BF08A34A2AC165F4A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809603, "uuid": "471a8f24-8154-420a-8fb2-9459bc625b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809603, "uuid": "54f8686e-0650-48ea-873b-5f266a8ef5d0", "value": "6144:Zj/SP4wWf8dxjUqT+GUjMuoHhWwMBYUQlBzon/NckzewN7UVHUjxmTU1pXk:ZjevWfgbhBW7klNSC1O7tdAwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809603, "uuid": "127c1333-f37b-4691-9702-069862fc1320", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809603, "uuid": "ed6f545c-b490-464c-8618-bf12ace7bd50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809603, "uuid": "1f9316ed-2005-435e-b71e-4161d2e91c7b", "value": "AWB_811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f5f785-f18a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655833731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833731, "uuid": "e6b0ba04-1052-44d0-ac6c-e0710fec90d3", "comment": "Malware payload (Formbook)", "value": "3e6ac5aae0d14c8fd1b46c82c81f56dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833731, "uuid": "6e637092-7c74-4a63-a563-4906636dfdf3", "comment": "Malware payload (Formbook)", "value": "7ee8ca05500f7d2caa6053aff0486736e850f28861dcff8aaa82e3fc30a5d857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833731, "uuid": "896e08f9-96ac-4902-b9dd-ca63d936678f", "comment": "Malware payload (Formbook)", "value": "31012e27166b82be615848d7a69b31420da2af7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833731, "uuid": "c3aaa67d-2315-4727-b687-df8cce44c32c", "comment": "Malware payload (Formbook)", "value": "bc92b942e94b6b3e939aa9675f60c101e753ff2552b7f656e2f81beb5a8bc0506133a48058ba80fa9d1fe0af35f43c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833731, "uuid": "b3de272a-d106-4bd2-a5c0-f91810443601", "value": "T13354DF1B73C9CF00C5882A71C4DF557913E4BDDB7A73EBA23F05225C1A423A7AD49A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833731, "uuid": "4320dbd5-8533-4350-a167-a4376db93487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833731, "uuid": "0f3a77a6-f28b-4eb4-8e67-827f04d6d0f1", "value": "6144:YA3kiPghq98xstE4tk76x+UHo6ZRsA5yznd8SFve2jnqd1XSy:1tPghqAA7tkF/635yDd8R2j+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833731, "uuid": "8ec24d9d-9ada-41ac-b7aa-27a262debc5c", "value": 291864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833731, "uuid": "10711d01-08f2-4bc9-a5b0-e8f0c0c095d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833731, "uuid": "4d6ba2b6-3bc6-415e-8b26-6fa2343d45c3", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3298.31392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0eac3d-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655842086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842086, "uuid": "d6e1c094-91b8-4d58-8aba-80e05bbdc845", "comment": "Malware payload (Mirai)", "value": "ea57a12e11438df7f3059fe8a2f7725b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842086, "uuid": "f7c68af7-110b-4e90-a180-25f473cc2516", "comment": "Malware payload (Mirai)", "value": "7f0188f3bee04cba692cc30a0de5d8e6724a1b9febfcb3b48eb4cf1d15826cce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842086, "uuid": "1435e701-c6cd-4065-b68c-5dcb3b85bb56", "comment": "Malware payload (Mirai)", "value": "9ed556be05f72763ce81d796405d35c93be28ac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842086, "uuid": "71b69fdb-13cd-4e31-9516-09a704458468", "comment": "Malware payload (Mirai)", "value": "583b20d8dca60d2546db66507d6847fbb87583e352acb902722f63f4a7a1ca5da0b18d5a16d79ae3804af8e08885f6da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842086, "uuid": "8b65b543-29ed-4683-925b-1cca3105c787", "value": "T16E332982BC919912CAD42377F62E11CE372173A9E1DF3207DE126F21778992F0D6B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842086, "uuid": "913f7685-2540-45e5-b995-231d6bcad2be", "value": "768:1hg7ZwM+VQQy0Nos7t8djNzCY7vns2XjSq4/qUoOGb6BNOO9+KVFnzM+d:c7iM1Qy0Nos7t8dRDjnsaSV/qS9tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655842086, "uuid": "d3f42f55-097d-4e36-ad64-5c3f7150936e", "value": 55032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655842086, "uuid": "6d6eb559-1631-41cf-be85-7e97412c68cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842086, "uuid": "16cf10d7-1a58-4799-9df0-1ea6538f90ce", "value": "ea57a12e11438df7f3059fe8a2f7725b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47d00fa-f176-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655825240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825240, "uuid": "e0c69aa4-cbe2-4ba5-bee0-e14101ea918c", "comment": "Malware payload (AgentTesla)", "value": "a51cb4733a8a3cd043c5fa6bce52feb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825240, "uuid": "25f02b9e-4d04-4ebc-889f-2cb7cefb717a", "comment": "Malware payload (AgentTesla)", "value": "7f60791ef2534df51c697f687eba4bfcc6753299e7eb44ae50e40ef84ce49c88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825240, "uuid": "35c64071-69d1-4405-89bc-f0d50bf98aac", "comment": "Malware payload (AgentTesla)", "value": "b737d45696b2e824e53cc1c982f87b74ff1469c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825240, "uuid": "7407f009-8499-49fd-8cea-f1dcb94d571b", "comment": "Malware payload (AgentTesla)", "value": "fe7a452e57ad0b07d2a87c1ab65485b9096d3c4433eb753ebda3ac29a418533a9e46fc68b6134030d27be211bdda9387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825240, "uuid": "9f3f446d-f58a-4c10-85a1-8ff1a9a738a6", "value": "T1BCD42D2CA7511AE2EC4DCD714D114B08FFA30E837640B95ED39A26EAC3ABB55DD048F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825240, "uuid": "5094664e-007b-46d0-a146-a2ccef107e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825240, "uuid": "837d08e2-f350-449d-ba9c-389f8f065734", "value": "6144:v17vDqQg3NxPysXqJHIEuD56tSKmqgZTA4NhVV1OK79kdidva+:v17vO3NxPyb7tSwgA0xOhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825240, "uuid": "8ed9c5a4-9f05-4d0d-a7fa-6cfbeaf65129", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825240, "uuid": "991b50dc-904e-4707-be51-a9f94bc14a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825240, "uuid": "49fdc716-2af5-4dc6-8ef7-3849b26e9bc8", "value": "products specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead2d527-f1a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655844256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844256, "uuid": "2aeff57c-9e88-4ce2-9e36-7b9d79cfa932", "comment": "Malware payload", "value": "87de59eb0b63a0b1be53812986d0472f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844256, "uuid": "0198a6ce-bd91-4cc2-af83-fad67788a452", "comment": "Malware payload", "value": "7f97c42b45ac5ddbad2a35dc5b52cb5bdbd45534c013eafaf36c0452a2256dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844256, "uuid": "cb6876c6-96a7-4979-b5dc-36ea4a47ca19", "comment": "Malware payload", "value": "bf2843dff7ba2fdbdc2649306392d0a1c095164a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844256, "uuid": "66b9078c-8f25-4d17-9f1a-90c06d6c42bc", "comment": "Malware payload", "value": "f6c86875f2cd58d6b2e642994200eff0dfa6892c4c2336e1966f2b09678897c0de80a5c2192e1181b7199cea71baa2af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844256, "uuid": "e93fbed0-6921-4274-9598-be279f793bc6", "value": "T17464AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844256, "uuid": "fd8c3517-3ee7-4b79-8229-541c5d24c223", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844256, "uuid": "de96d053-775d-4662-8bc4-12ff54486b0d", "value": "6144:3MiSTD2He3kjHfNsQnqzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3NNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655844256, "uuid": "a5eaae30-20c8-4b1e-89af-0830eb750e13", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655844256, "uuid": "986f8363-8208-42bc-81e9-530bc442d4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844256, "uuid": "d3576ef9-094e-41cb-986e-2e36e8bbdb9e", "value": "87de59eb0b63a0b1be53812986d0472f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1095f6c-f143-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655803384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803384, "uuid": "a9b0163d-1b28-45de-9e94-52a822d8d4ed", "comment": "Malware payload (Quakbot)", "value": "11777ccd73871f3b3f32faede50d4a48", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803384, "uuid": "8005ebc6-e65a-459d-b95b-8212159d727b", "comment": "Malware payload (Quakbot)", "value": "7fb9ee27c127512ed7fb1bedb777c3af87bf42d2563edd7147edb8dccfbf1759", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803384, "uuid": "1372ad43-f3a5-4c97-9260-94d90197bacb", "comment": "Malware payload (Quakbot)", "value": "948f20f735fac3356a6e13832c04cb2a2807ac81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803384, "uuid": "4d6cc47e-0447-4c0f-8669-7b30f92b41fb", "comment": "Malware payload (Quakbot)", "value": "31a311c98561cbd011b213b6b1bc8be6f59025d279df294d7c42ace5331be74191d005e11fe13a26ab6c004805f86ab7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803384, "uuid": "a9b571dc-5a14-4d04-aee3-94d106521c5b", "value": "T11625B062B3905C37C1632A3D9C6B7764A926BF112E3859C72BF81F4C4F356913B252A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803384, "uuid": "bf626856-bf02-4464-b7c8-2a6c68974b50", "value": "20989e3840429c9a803f6f380c7c63b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803384, "uuid": "640ed6e1-2946-47a1-adde-f9022dc3b67d", "value": "24576:3FsIvAexp4zV2Kk546oeKg/EEgKny5Qy5s:1tGM8sy5x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803384, "uuid": "ed3b3465-c0c7-4d6e-9906-d92789b1f9f9", "value": 1023406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803384, "uuid": "11c46880-b38b-4239-879d-e6d39a3bcdb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803384, "uuid": "d6ea8b2a-42c5-4f65-8e9d-ced966ecaad8", "value": "244335499.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c81dabe-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655809604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809604, "uuid": "4743fc57-98ca-4e7e-b382-ba3bdc1371b4", "comment": "Malware payload (Loki)", "value": "9abb41f94837896e1d485ced8f396579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809604, "uuid": "c31849bb-68d4-48d1-afa7-0d033247414f", "comment": "Malware payload (Loki)", "value": "8089aa749670b5c58745881dad38067e4a55a198e3236e38dc3e705b663d0529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809604, "uuid": "c7b32396-8ef8-458c-8b1e-0c88263452d2", "comment": "Malware payload (Loki)", "value": "000464033bb17ac7e9b29b1d9dd690e1323dce84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809604, "uuid": "5f64c10d-004e-46e4-84f4-f95f23622049", "comment": "Malware payload (Loki)", "value": "9e884ccae4c2c48c2f85b3bbebcfd89ccec42677c65cabfdd59f6080a2037cc96fa5c8c8e8e45a3caeac61baccd6a99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809604, "uuid": "22884538-7c31-48ce-b73b-322e4827831d", "value": "T11675F1102AC81A16D7FF1B38A079161E53FDE34A5086F70D5A25BEE92DA3F40D503B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809604, "uuid": "0f32af71-c5db-4428-9993-5d1ed231e994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809604, "uuid": "05f2d799-da22-4a53-94ff-e15e64fbabcd", "value": "24576:PNEErmgVAwTuRBUGLM6quaRcGtcLmRjJruRwQl3kh9GCydI0pfD:6w90gvp0pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809604, "uuid": "9f7f3ff9-7cd8-44b4-9e80-e55383b9f053", "value": 1611776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809604, "uuid": "718ed994-6206-460e-a207-f46d21f66d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809604, "uuid": "acf8b5fb-b37d-4609-ae2a-8514d1c19550", "value": "9abb41f94837896e1d485ced8f396579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf33512-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655782328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "bf65995c-524e-49c1-ae9c-512d3d0c1e2e", "comment": "Malware payload (FormBook)", "value": "8270442ff4a657551728cd15af2dd598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "512689f3-94c0-4aa7-86b2-8c3751a3520d", "comment": "Malware payload (FormBook)", "value": "8177e5c3a4e3cc4c471e834c36ff00f7374fee8372dfc2e56b6a71fce5a3ab0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "890fe232-85db-432e-97b3-1b528f3f7fbf", "comment": "Malware payload (FormBook)", "value": "03e93e80978c7e29523b1b4f7d5f2807a012babc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "eb8517e6-cd04-4ade-ae0b-d9ab38f9d9e0", "comment": "Malware payload (FormBook)", "value": "2d84e3182a2dd2f7637fe9a3ce3a298d906c459a50ce56d513673182a44bf1057b54cb627e4e6295451a75d10ada93ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "a7d595bf-2f84-4a01-a13f-5c4c2d731f4c", "value": "T181A4E0F18EF4BE66E12431773051A13C77D38D0DEC66A53ACA9BF04A34A2AC565E0E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "224d8a12-8890-488a-992a-1d4e9c819f8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "19763656-342a-4934-babd-0bf1002a198e", "value": "12288:wYvxzJ6NwkV6s3r9B+Zcajwe9z3wOvalN8YO2sV:tvFmWs3r9BIcaVjvm7O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782328, "uuid": "010abc16-c649-41f3-b774-b69fd7ece0b7", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782328, "uuid": "0696b248-fe92-49c4-9820-8b64cd3c77a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "7b6b13b8-ebbd-4a88-8dfa-beaf89281ade", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22871.5438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceee299-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1655809632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809632, "uuid": "0364dd00-3916-4d46-9a2e-332cdb6228df", "comment": "Malware payload (GCleaner)", "value": "2f5b19f3196cf8903daa3de2163e56bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809632, "uuid": "d0fbc92c-41b4-407d-ab2f-1857c4324baf", "comment": "Malware payload (GCleaner)", "value": "81a110de18613503c0f3075da56cdbe363091cebcd8c52423ac1d63aa791bb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809632, "uuid": "8a90482e-96d5-46a8-8470-14d054e10090", "comment": "Malware payload (GCleaner)", "value": "ddff7f0771687bb3632da27c7e46dcd7ef167e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809632, "uuid": "ef827361-fb09-4d69-b384-741724c33729", "comment": "Malware payload (GCleaner)", "value": "5d02704649b058613f20ab3fa192d270628b7ef4cbcae5912e720ec041d93f93d9233b37c7ae92131b1083fe8ca5a573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809632, "uuid": "86f50ec2-808b-4b79-984e-4a00089b2abe", "value": "T1A484BF00BAD0D434E5F752F449B692AC793E7EA09B3450CB52E52AEE4734AE4EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809632, "uuid": "ef55e8b2-c4bd-4924-93c3-48be8bb4e5fe", "value": "aa1d842c09e4e41d9b0bfd7b3276b5b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809632, "uuid": "1b53f11a-92e6-4189-a97d-037a72efd717", "value": "6144:Eu7hmZaTjmh4s79iwBsRte9d1RNmJ8aTQG7H/PozhPxhomonnKVKt:Eu7h48Q4s79iwBsRQh3m6IZQfhomon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809632, "uuid": "67de0df1-b889-4ad0-b4dc-ae12649fa556", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809632, "uuid": "f63130a0-39ae-4c05-bacb-cba4d38fddff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809632, "uuid": "9c090813-66f3-485f-93d6-67fa22c66142", "value": "2f5b19f3196cf8903daa3de2163e56bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b941a6-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655806296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806296, "uuid": "a7259f85-9e67-4cc5-9219-7d6a57178971", "comment": "Malware payload (RemcosRAT)", "value": "46c7424bbc974b8071f30e2c6494612b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806296, "uuid": "4eaceebe-57a3-406d-aba0-81dfe3229627", "comment": "Malware payload (RemcosRAT)", "value": "81bc33ce9bf2c1eaec168f5a5a4c2da715a2fcbc8972daa23834e22e3d27c547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806296, "uuid": "2d1a0533-5556-4601-a5a0-b1d5caf51589", "comment": "Malware payload (RemcosRAT)", "value": "7e957166a5a73c6e7ddf9af391fd1837f4339a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806296, "uuid": "7764c283-401b-476a-a8dd-eeda542d184b", "comment": "Malware payload (RemcosRAT)", "value": "c1ba8aaa62aa23e9121f43179ad3760666527ee84697e3333a6a60ae60cbd9696df44a70033db04d4529309484c5f1ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806296, "uuid": "7cbc141c-a669-49c5-922d-311ac13d8c26", "value": "T1FDF21A477E407665E98619732453330E523DEE3CBCE59A2B1DCC308EDA739821D14AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806296, "uuid": "0db08895-aec2-4b3b-b360-0c43f09fedb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806296, "uuid": "0cd65165-1cd9-4f8b-9dbf-04bf539a64a3", "value": "384:smXunBkNPYTnTg2nEky83Gj66JatXhuH4hEEF193PmaBVjVBNf+RukFO3CyN:zX6FEiXhw4y219f71VBN+QJ3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806296, "uuid": "2f24ca1f-81ca-4ac8-afd3-c0b448e82c26", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806296, "uuid": "ae857435-c822-461e-a0c9-4c694cf73cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806296, "uuid": "4186ff74-2e87-4345-a7a3-3a6f3356d164", "value": "Kzckpxc.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04cf814-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655830522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830522, "uuid": "8aeb165c-6cd3-48f2-b56d-3a68a113545f", "comment": "Malware payload", "value": "0ef928f3d7722856ebd0835b29bb022b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830522, "uuid": "4564566d-f8fe-442b-9a09-0e3696a6b172", "comment": "Malware payload", "value": "823f0103e7526ee09bd4cd8a5c3f62c793a2e04d7e67d67d1ffdbb6c6f94f9b8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830522, "uuid": "10b6fe6f-1d37-4b81-8559-fa560a2a39e5", "comment": "Malware payload", "value": "3638ed66682b8dee71bcbfc1f6372ed158cd9fc2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830522, "uuid": "88667db2-b461-4683-84eb-1eb57aedd5ee", "comment": "Malware payload", "value": "3bf19ae2be7a39baf374bc37a25a27fd904afee54b041ef5b61e22bcb3b6a6b9a78c91952454b52b2a5e7ec3d47e40d5", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830522, "uuid": "f0806dc7-a577-4f9e-b148-0f0918390ee6", "value": "T162B5AFB876046CD6E56F477BCA976DEC13A626238ACBA4CD40A47BC30973375FE12805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830522, "uuid": "1699f8ae-caf8-4169-a214-e075c1e3d8a1", "value": "24576:dKIwWVONhcM7Z8WUQ6nOqbxfY7uhHmJP+Xcdy0/F+l:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830522, "uuid": "2e8cd27a-2648-4ec4-982e-2440627b7430", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830522, "uuid": "bb0fd62c-46d3-4921-8672-af1e7c438bb5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830522, "uuid": "9a18bd5a-dada-43a1-8b34-fdbc975010eb", "value": "Report_06-21_invoice_402_doc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd663b3-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807999, "uuid": "54a3268f-69b2-488e-b070-a2b3be851776", "comment": "Malware payload (BlackCat)", "value": "5f3ca913f43596c6dec26733394277e0", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807999, "uuid": "16fdafa0-635c-4bfe-9e5c-062869a3d78a", "comment": "Malware payload (BlackCat)", "value": "82479ba19531a5b3f108f21f939190de2073395a708bb4446d6acc398518b802", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807999, "uuid": "77124c56-ed45-4d59-a5a1-56c4d00498d6", "comment": "Malware payload (BlackCat)", "value": "08aafdd6e1ab7b11c9aacb704872a9ee02ef349b", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807999, "uuid": "c26780f4-4dcb-4d83-b992-81ca1d9bcc06", "comment": "Malware payload (BlackCat)", "value": "7a46936fe505193def771c7bb277653fea0a170c1f988659c7356f8f755e7cdf675667046fcda1f7efb44265099b18c2", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807999, "uuid": "d7f34938-8a84-4662-9edf-0ca16be716f2", "value": "T1AAE5AF95FB43E2ADED6B14B0345EB33ADE34481C01199FA3DBE45D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807999, "uuid": "ee9a722e-ecfb-45e7-acb1-8881b17375f0", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807999, "uuid": "0f332eb9-86dc-42a8-a976-135c323e77cd", "value": "49152:1QMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNtMdtjsQKAzQmy7:aO7xei83ksPBqanlMdJKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807999, "uuid": "3bd01edf-a19c-442b-99ec-de01e3faac75", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807999, "uuid": "feb980eb-f336-4086-8961-b359b1abafc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807999, "uuid": "c35037a3-7afb-4800-97fc-747373bb7eec", "value": "82479ba19531a5b3f108f21f939190de2073395a708bb4446d6acc398518b802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62383bb-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655802158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802158, "uuid": "d30240a9-337d-4418-858f-d9f12bbfb505", "comment": "Malware payload (Heodo)", "value": "7d23fe3384c8fa8efa4c9ffda03ac05b", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802158, "uuid": "273c2c5c-6320-414a-b098-1066b12f2d9d", "comment": "Malware payload (Heodo)", "value": "8266eeff5de439ad1b0ca01add997ef5294f0afba5da7d3cb75c128f8110364b", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802158, "uuid": "f1b02abf-76ef-43da-9c0e-25ade8c5b56e", "comment": "Malware payload (Heodo)", "value": "147015fab7b0807b6ec5f7c3fbc6ab471f7cadf0", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802158, "uuid": "c2d9a641-a175-4722-a62c-1e18b362266e", "comment": "Malware payload (Heodo)", "value": "4d8a14b8b9c9d9f325d598ce944404570f096076c2bc95468f6085500fb25efd77b9c42eec3da0c6dca4d50c9c34afba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802158, "uuid": "626bac3b-0bee-4dce-91d5-e65047856bbd", "value": "T1C2E48D9967E60778F4BEA5348A368961FA72FC440730874F03A3517ADF37B24596A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802158, "uuid": "0ab83487-5f97-40cf-a158-afbbd2a50225", "value": "3453e632ce30879aafc5b698fff99cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802158, "uuid": "0d7aef3e-3abd-4d38-af26-470a65d3c914", "value": "12288:OuLAIfbduxjLrrXpRoZqAQq30PNW6iSp5tMcPNMCthT6mx:X0IfS1Rocq30PZnMyNDT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802158, "uuid": "c66a4795-52a1-4cba-a2ab-a48020047ee0", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802158, "uuid": "d5f2ff63-2623-4f64-889a-9465e8f5f7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802158, "uuid": "cb3313d1-8765-4279-a70e-3ffb306e04aa", "value": "W1pXepFZclrNgtsh.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0746010b-f15e-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655814669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814669, "uuid": "c57809e7-c6d8-4c16-929a-768b06f770bb", "comment": "Malware payload (GuLoader)", "value": "3149f968ee0bfb7264996cd81671866d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814669, "uuid": "893cd09a-c41d-4cd9-bd6a-99d5a9560d52", "comment": "Malware payload (GuLoader)", "value": "828d4a86ff243534c7632cae1472b6c887e313d8c45c66cde8ab630db38f7827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814669, "uuid": "fc11ee53-acbf-4922-ae15-d84e8197596b", "comment": "Malware payload (GuLoader)", "value": "8fa87118890a34c14eea87a65cd7662a57256d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814669, "uuid": "c9870803-f906-4e00-9dbd-0704d628e577", "comment": "Malware payload (GuLoader)", "value": "47ba229f69714ede0cfa1001c8448dee621302ed5e281e34368ad96ca95c9522ac32c39a03f03c8e78c1af83bd6b78e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814669, "uuid": "109e967f-5784-433c-b2ae-9fa7b6c39a17", "value": "T1ED34020563A6C43AD0D34B31DEB1FAEB27F5AE3929698B4B03545F4B3816392890F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814669, "uuid": "6e73854e-a26d-475d-acb1-b6b80a9f9c85", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814669, "uuid": "d3cf5473-3f3d-4580-9a0a-59337861115c", "value": "6144:tNeZ3uU35ILcRKVcQI9ZPpdjChDpNy0mY:tNtU35W1+QEPvjiNNJmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655814669, "uuid": "80d9c6bc-a635-4eb9-9687-f9de8ce7331f", "value": 247800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655814669, "uuid": "4009f305-682f-4ebe-b914-a982c8189ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814669, "uuid": "8a630aee-dd7f-494b-8735-f9703387ff39", "value": "SHIPPING DOCUMENT PI#PI19-201171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49811a1b-f17f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655828953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828953, "uuid": "7748acc4-3eac-4f00-80e5-d9e9beef115f", "comment": "Malware payload (AsyncRAT)", "value": "601333f79512f0303e749ca94c42a6db", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828953, "uuid": "095bf0d0-0a37-41c9-8e03-17283226beb4", "comment": "Malware payload (AsyncRAT)", "value": "82aa98b1a230926362b96da6f0630e557318963f764733fa991093500b72ce39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828953, "uuid": "db0e3d35-2eca-4bc1-a535-817b6a3336b8", "comment": "Malware payload (AsyncRAT)", "value": "2f29a9d67ac7915d220c569768687aaccb43600d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828953, "uuid": "7d813f62-7748-4590-a6ca-39f9a5805ddb", "comment": "Malware payload (AsyncRAT)", "value": "6590c203594c009c934ffa8cc008cf414a1bad89068ac327eb786aeb083cd10ee6e792535ad7647fb5e97411db99e89c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828953, "uuid": "ee309b05-7091-4abb-9f2f-c43900b356cb", "value": "T1FA636C00379CC965E6ED86B4BCF2550006B1D6376002EA5EBCC454DB9BAFBC65A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828953, "uuid": "8c67226f-841e-412a-bac5-6347725ca356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828953, "uuid": "8101d811-a939-48e0-9c14-04cfc16b3135", "value": "1536:hn+Uc4WqUPK0dEgNC7941bbkmxR8V+askNpqKmY7:hnJWjPcja1bbkmMVKkWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828953, "uuid": "5ce630fc-da02-4a9b-9717-63317391739c", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828953, "uuid": "c02b3f49-ea7b-400a-a5ed-858b429241f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828953, "uuid": "ce31ba91-ddf9-4db7-be6b-c02490142f81", "value": "premiere update.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9365ebfe-f15b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655813615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813615, "uuid": "eaa9b4fd-e313-4368-a05d-88043e95f7bc", "comment": "Malware payload (Formbook)", "value": "6eb7cdf78741a76e34fc2a28f6f85653", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813615, "uuid": "d930f21e-7dd8-413a-8f4b-5e4862bd7122", "comment": "Malware payload (Formbook)", "value": "82d4a5db7563c67d43eab4e320daf91465ecc5080747a98850059bca5e45aec5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813615, "uuid": "40024acf-b6d5-4101-8484-d929b8379815", "comment": "Malware payload (Formbook)", "value": "ec7982080385abbc4ff6f4cf13ea1282af241ae2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655813615, "uuid": "305670e1-a0dd-42a8-9113-9c92de04f8e5", "comment": "Malware payload (Formbook)", "value": "0f721c42fa3476548973ffa5f302b60e13c10bcd733abdd38d01f6e95820e2f74fc24fa7cb058d51acbc5f0ccca1a9cc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813615, "uuid": "cea34f6a-c194-416c-a1a6-22cad86e1429", "value": "T1BE83E084D32987E8F922B6759B6F47317E2A6F23F932952E24DA3D8C0C31081FD15676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813615, "uuid": "a8a4050a-0e4f-4bd1-ae9a-8cd16c6ed68a", "value": "1536:E+d0PVhABSbJsJU8vAtXvKX3XDifXeJ2BvmGcN9KwCiy5xSoK5EGvvk:E+dcVhAobQvAtiX3XDi24utN9705xaTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655813615, "uuid": "eccdcf18-edcc-4e3c-bc6c-2fbc686c930c", "value": 82008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655813615, "uuid": "d7b8fbf1-6392-469a-89e1-1d06cd65e7f6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655813615, "uuid": "60f41d1e-37ad-4991-8aac-6fb5c68bca7d", "value": "Enquiry..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f3bff4-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655803795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803795, "uuid": "c5bf3650-1d20-4d37-9a83-b6f072154441", "comment": "Malware payload (GuLoader)", "value": "e0e60a4c8c2ffe66978633ed90fb7bde", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803795, "uuid": "a76811b4-c082-4430-9a7e-37bad574093e", "comment": "Malware payload (GuLoader)", "value": "82f063e5bdf4d7bd5b23d72d7d411e0988eef0686eb5b8704958f817dc17266f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803795, "uuid": "70cf2afb-111e-4b54-a293-7d89285579e1", "comment": "Malware payload (GuLoader)", "value": "263c022e20e152a8b4a888c1a458889efe260ba7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803795, "uuid": "80b35b12-8a8b-4355-a287-d21f5e5aae1f", "comment": "Malware payload (GuLoader)", "value": "e01550b0dd6d6ae0aabe01301e426646c3c6f06d0aabcdc0eaa1d10ec7d6b74eee5196c7b95f33cb95d752d5a1a99515", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803795, "uuid": "d6a131be-6288-4d4f-92d4-ad40e3fe8e72", "value": "T12A34DDA0685F49B2E608DD1E25A4F650ADBAFEFB30C1057123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803795, "uuid": "954eb7dc-fe2a-473b-93c8-068b66d88e2a", "value": "1536:iK3LtJVFIs3WFCiQ9o3RWVdWZVzFz76mAg5eeVhMDw5wfLc:iFHVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803795, "uuid": "063cf74e-cbd6-4883-9b5b-ca2d2de2785a", "value": 238547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803795, "uuid": "ce82cb46-564f-4982-8139-3df30bdafe5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803795, "uuid": "a5a1109b-ff77-4839-a876-565f350275f8", "value": "Our PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e33aae7-f1a4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655844960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844960, "uuid": "b50ccc83-3813-4eff-a347-6e6bbb804a50", "comment": "Malware payload", "value": "86d96d15fe782414ff9fa093053b338c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844960, "uuid": "a5bc2f75-f056-4d07-a1b6-758df9a50eaf", "comment": "Malware payload", "value": "833bc9d8136b99b89efede166085b55f1f855062d2429b32ddf12ef0082299ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844960, "uuid": "f5e34db3-9588-436e-b724-886a056d2c20", "comment": "Malware payload", "value": "f1ad75cc3ecf8f512b8374695eec1276abf3d01e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655844960, "uuid": "4c381d38-31c0-47bc-bf4d-b06a97f40489", "comment": "Malware payload", "value": "c6d4d2db3b753158a0a5fef73dafd11f1bcb960de6236ea63e6d646bd8a8026645062473ca9e18146d0f93199d0da898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844960, "uuid": "83ed9407-30b9-4918-a2e9-8039c4819824", "value": "T1F2239E17FA6C8664D6A4473BCDE396840FB1E1939813DE1AF48923553D033F2C947AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844960, "uuid": "2f691928-3eae-4102-9d73-8ec9c3834ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844960, "uuid": "7a08c7f7-118d-4053-8cd9-3a30c577ed3d", "value": "768:wwKlptITzDIdnx5vi1uMRIGCh9Nf7oSFYwQjXvLWRgcL0ST8iNxy2Z:jKl6MxZi1ihf97QWRgcL9HNxvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655844960, "uuid": "3e88d3ed-f85d-4e92-9523-631512686995", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655844960, "uuid": "8487fe98-f3ab-417f-926b-1a7904f40c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655844960, "uuid": "2c4a653e-ac3f-45bf-9d4c-cca0d5b80a2d", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362e64a-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655825480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825480, "uuid": "bc48b418-c606-45b6-9071-dc64af063a20", "comment": "Malware payload (Heodo)", "value": "2d0befa683812a5d1220db91b24f8f3a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825480, "uuid": "d3184006-1760-4855-a149-0530f6048390", "comment": "Malware payload (Heodo)", "value": "8355d2429d453838954dfa3e1ec592853c1c49aa7cbd5a1dab48dcf2c070c4ab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825480, "uuid": "1dbdfa86-ea9b-484e-a995-1ec28a4bd81b", "comment": "Malware payload (Heodo)", "value": "7a339d4f00076e28c69f17015ad1dcbe3dbd8b53", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825480, "uuid": "200dce98-3f24-46b2-954c-e0f3e56d5fa7", "comment": "Malware payload (Heodo)", "value": "aa399d7720d5cf7b7d804dba1952f12bf205a3a1961375b11eb3fa28212e4ea804373fa0cd8220b47e1843e98d2bac89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825480, "uuid": "85c1a71d-74bb-4a63-899e-788244658d2a", "value": "T184648C0236A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825480, "uuid": "8591ad41-2405-4fa8-bb72-01351f67e056", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825480, "uuid": "6e2aac39-1887-459d-8f62-25c3a3f42a4d", "value": "6144:JqdSTDcHe3kjHfNsQnTXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3TIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825480, "uuid": "ab47a378-0a50-4a9b-9b52-c05b6468720e", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825480, "uuid": "f49bdfbf-0073-4beb-96b9-e8b9f2025c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825480, "uuid": "621aed50-3670-46ce-a459-4faef60de343", "value": "ahZiNvgs2sKBBOR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56c24cc-f181-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655830074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830074, "uuid": "60846e28-75fa-4722-9171-bb0f8d8adcf2", "comment": "Malware payload (AsyncRAT)", "value": "51ded13168a62c8dcb024855dc039f93", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830074, "uuid": "b80a76dd-7101-4182-a552-54b1a694ca4b", "comment": "Malware payload (AsyncRAT)", "value": "842fb6327e8d09667003b87a199aafde3dd0b05b9e603cd154bfefc0fe0c7280", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830074, "uuid": "2a7fd130-ef47-4d84-a2d9-26f857c61f1d", "comment": "Malware payload (AsyncRAT)", "value": "381e091243776dd1102c2afedd688d40d24fd491", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830074, "uuid": "f00ef25b-b6f0-4665-bf7c-dc7af32ab55d", "comment": "Malware payload (AsyncRAT)", "value": "6e1f82fe9ed5fe549d3a49579c485be55580e5ff2096c8a46ae1dd696557519b09675f321998176f097991b75054118a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830074, "uuid": "bcd21b77-3ba7-4fde-b348-4ae307e5c5f8", "value": "T1C2E4F11127F94F1FF1AB56BDE13D46128675F8336847EB98892961EE60C37C08B21AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830074, "uuid": "18f3911d-e7d0-4159-80df-2b22552fe281", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830074, "uuid": "0d1f354c-b11b-499c-b83f-66a29319817e", "value": "12288:TNp3kjxqpvcLKlzdeHT7Ni5OdwQoTL8W0w+o4G1hOyu0kBEoKV/BC8TS:mx4SYEz705zTrO5ilS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830074, "uuid": "a1fb5899-2e81-4ec5-b549-1772a31b4593", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830074, "uuid": "8a85df3f-7893-428d-a521-e80ad38ed54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830074, "uuid": "2b380002-660d-4f81-9517-2bf1458ef7ba", "value": "SecuriteInfo.com.Trojan.PackedNET.1391.29854.9598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8135908-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793598, "uuid": "3881bdc9-16d8-4f0c-a647-7408821f4d63", "comment": "Malware payload", "value": "d48614478c10d4cc40104f6ec7d36152", "object_relation": "md5", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793598, "uuid": "6e88a0ce-ed5b-4287-a87e-3fc54f20f6a3", "comment": "Malware payload", "value": "84ed7fec67de5621806dbb43af5167a5fc60ab7f2403448519dc0eca2b8f9022", "object_relation": "sha256", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793598, "uuid": "963322ec-22d5-4d09-970e-bb403ac8fd8e", "comment": "Malware payload", "value": "86e57eb5616e8bb5394058a7de6bbbfdf84bb4a1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793598, "uuid": "6cdf0a25-b916-466d-a4e2-6a0de052a9d0", "comment": "Malware payload", "value": "5d5e97bd705b5b44fb97833e070bcc77f2e9275ddb6a775b5a3953cab6a905d8e63168ffb3634e7cf2441e57a02533bb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793598, "uuid": "9ce986d9-3104-4275-8b2e-2dfb5d436189", "value": "T11BA37B6B63E834F8E567863498E04A05E772F43217608BAF43644A961F273D08D3EF79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793598, "uuid": "09d032da-ae34-448b-b1e2-4f74fafdd012", "value": "58b8edce961e0f18c8bc37a9d263844d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793598, "uuid": "052f14ee-4eb1-48f6-a96a-d5be17a80680", "value": "3072:tLXMyJaOBw5tcbROV+F6QvMqP23mmCi8YA:tbLW4bsVhCiBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793598, "uuid": "a8f3041a-388d-4e9c-a4fc-23df55d21bcf", "value": 107376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793598, "uuid": "bc360a33-a30a-4989-8d29-0e4966a34377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793598, "uuid": "9ea66ec8-9ee1-4ec7-a578-2c365a5b8da3", "value": "84ed7fec67de5621806dbb43af5167a5fc60ab7f2403448519dc0eca2b8f9022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0b1395-f0f8-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655770923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655770923, "uuid": "883e848d-8254-4489-a59c-79f2578896d7", "comment": "Malware payload (SnakeKeylogger)", "value": "d77db7fd3ec3287790afce9261f2238a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655770923, "uuid": "230fb403-8d05-4181-813b-5f2e7f0cd903", "comment": "Malware payload (SnakeKeylogger)", "value": "85bbe9ec788c306f0ab0c273f84daa554b7c9dbe7071654fb1f874f9d31e3398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655770923, "uuid": "6cc25a04-2604-4934-adbd-2d459a5a540b", "comment": "Malware payload (SnakeKeylogger)", "value": "0ff7dab9c48524e04b1d673c974d38797ec6123c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655770923, "uuid": "4dff80ab-4659-4be5-bd44-3634167abbe1", "comment": "Malware payload (SnakeKeylogger)", "value": "c74cd29112ba644156bbce5351528da695ae8e183e9e0487977c8f489bab6b4ea0ead60019dd9118638e3da8e2cd8d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655770923, "uuid": "9800680f-31cd-4c19-bf0a-115604ed4f05", "value": "T194C4E1366A5B4B6AD9CD177C0535721336B5B32297C2E24C460C0095FAD27EBE8EB3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655770923, "uuid": "af7cf104-64d4-47dc-9093-1e74f57d79cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655770923, "uuid": "d5921d7c-60b5-4c98-af34-93510f264e16", "value": "12288:Tt1xeBkqcfbXFhN+S+MIP+UPXeNwpyVKXT/LRk2l21gBeq:u5cTVh9IPjPXxyVKTzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655770923, "uuid": "d1e074b5-5378-4b9b-8602-35c12e4c4f83", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655770923, "uuid": "58c9be30-d373-4507-8935-4d8b93acbd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655770923, "uuid": "ec0cf175-2125-41af-90fa-ed59fb16db47", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de7462a-f167-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655818599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818599, "uuid": "6171f686-e8a1-483f-ac59-5ccd37e19c74", "comment": "Malware payload (AveMariaRAT)", "value": "f7ebfa7c7d581c5327b44b300df5bd7c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818599, "uuid": "5e18713c-eb50-4ba6-b632-2927b2440761", "comment": "Malware payload (AveMariaRAT)", "value": "8629955b1f6c9eda7084159056adfdeb2d79599fcdf09420f245210f681d9638", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818599, "uuid": "13bf1de0-8f8b-49dd-81b2-eafc8ddb86d6", "comment": "Malware payload (AveMariaRAT)", "value": "7d9cc21c81e8806408f78e8e798ba4769eb3322c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655818599, "uuid": "81828737-0471-4a00-9a6d-2c8231dfba2a", "comment": "Malware payload (AveMariaRAT)", "value": "239c5b9e88190610eda7e97793c7c8b884b932e76aa35fe78d041273e4027f72be4dcd9928ab551853de2adead89e408", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818599, "uuid": "b79c1cdf-3f60-4537-97fb-2149f461cb5c", "value": "T1B6339DF2D6844AA1D14F0A3F692257900237DC89E4B5ABFF5C4DB48B1DF33861912E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818599, "uuid": "b075a81b-5974-4d77-9cf5-df3ef2af0464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818599, "uuid": "7e99ad60-d89a-4600-8154-745d6a21f5e8", "value": "768:PsDpXr4R/DaOtifPYoe1SX9d9s9MXPtwcyU2jnBkfM7TM69jwRUA:EDp74RrNtifC+bH1wE21kEvMUjwRUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655818599, "uuid": "75f85088-08dd-476e-8859-5bd540b58d00", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655818599, "uuid": "e1fdb115-3753-4dda-852c-d07b5a278c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655818599, "uuid": "4a1735d6-cdd6-4e05-a506-e36ef2ad7cb5", "value": "SecuriteInfo.com.Trojan.Siggen18.10428.19570.29571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4854bd83-f17e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655828522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828522, "uuid": "a0841243-2003-4f46-9e1e-303830afda08", "comment": "Malware payload", "value": "8f460aedfd95b6092fc989522a66f2e3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828522, "uuid": "336d10bd-af26-45ae-9829-771767506caf", "comment": "Malware payload", "value": "878b3cd29398d58608cb2820e55c88a8b197e59bba7701f48d2f2ef56703d3a6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828522, "uuid": "db6db70c-a40d-4e1d-8f75-147056eaab3c", "comment": "Malware payload", "value": "fcaaa3adc5396daa3cf6f8a3a2bfbf0004c5ec14", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828522, "uuid": "5da46d98-3dc3-41dd-865e-f5414ce40480", "comment": "Malware payload", "value": "a0070db2642ad8114c2d699935f2d8bab9d13550f6680ef22ebda4001f29eb3954f24388589fe74412f1d0649cced311", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828522, "uuid": "b2337e29-b53f-4572-9c31-e1dff931f257", "value": "T110C4395303891BBDF69D0EC9C94B245B20F2D4677D241299EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828522, "uuid": "cddc3678-c4a1-45e4-b93a-033598a97626", "value": "1536:+5IM/VnE5GZXyqPLjfYMhmjFvqreGsF25CC1G6sNGAkdGBYIxHiJatcxE/+FKTUl:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828522, "uuid": "ab2abf3b-3cf6-47a9-880c-f6b803d86596", "value": 584642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828522, "uuid": "717cd8c3-a8f5-46f6-b107-05e2ef06c8ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828522, "uuid": "e972b190-a2ec-418b-b131-f7eb41b9ac34", "value": "42502d_ae41dfef32144f378cf0dc6c59b8c1e1.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a3a96b-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807953, "uuid": "6662ef92-7f02-4caa-81e3-c0d98ebdad59", "comment": "Malware payload (BlackCat)", "value": "6b91764322681f4a2b2a89fadae5b6d3", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807953, "uuid": "f4d44628-4cb3-42f8-bfc2-0880a0cf51a3", "comment": "Malware payload (BlackCat)", "value": "87a14583b72250a660b74f1e475a268f95285820d72fbd5115f1b8c6ec787a9a", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807953, "uuid": "e92361d1-73b1-4e65-9691-909d29fa5ade", "comment": "Malware payload (BlackCat)", "value": "e312befa34a1eacca48dfce1b2a0d6c75820e8ab", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807953, "uuid": "0bf3e7be-021e-418d-a2e6-d5511f58eb6c", "comment": "Malware payload (BlackCat)", "value": "f0336a12f549e721ea4ff27921eb715f4f0a324f337378a45c4a9dd0072d964487eb53877345022bf83d63430e2d98d5", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807953, "uuid": "1d8a13a1-f3cb-43eb-b3cd-014dc6a86ba2", "value": "T162E5AF95FB83E2ADED6B1570305EB33ADE34481C01199FA3DBE45D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807953, "uuid": "334a7f12-8b40-4df0-8946-80956c022c2f", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807953, "uuid": "57e2e424-7bbc-4189-8c67-b6fe772391e3", "value": "49152:sQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNGYX/Ih621dMKAzQmy7:LO7xei83ksPBqanuW/ILMKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807953, "uuid": "b52dcb44-f919-4c22-b2e3-7e9fd74cd5ae", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807953, "uuid": "edaeb27e-b94e-47e1-ba3b-81ff7286d70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807953, "uuid": "4cacad34-bb19-4cd0-8018-0b062487c17a", "value": "87a14583b72250a660b74f1e475a268f95285820d72fbd5115f1b8c6ec787a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e95ffb-f105-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655776701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776701, "uuid": "8b91694b-21a9-4a34-bc0e-91d224f6e7f4", "comment": "Malware payload (NanoCore)", "value": "1f5d7b000e3725a8542e675e123034a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776701, "uuid": "0f413f8c-1a10-4e71-9189-c921de1c6f7b", "comment": "Malware payload (NanoCore)", "value": "87d13b5f503ac06123332618c22f4b251c72d6d5637470e63fcc3579d5847402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776701, "uuid": "38fbce29-9e03-45b6-bd63-f20fbb04cd97", "comment": "Malware payload (NanoCore)", "value": "ff81dc7f1a1efc00fed8e98c542dd70a3bd00bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776701, "uuid": "097e9cf1-a53f-4cf7-a30d-02c2293df076", "comment": "Malware payload (NanoCore)", "value": "3f22f8df909959f1dc27261c3009875641c8c73c871b1603d0d86f380d54742bce06ce43ba3544863f67badc7815ac7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776701, "uuid": "39bda37f-5c48-4450-8c59-bd4af5d746d4", "value": "T167D4D42CBB025A76FD1E81308D1D0B08FFA31F136280B99757DB27CA875F1666E95C98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776701, "uuid": "a0ec674a-12d4-4421-8055-ba18b6127ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776701, "uuid": "c7c8b86b-3b2c-45e8-a1c6-89e8dab559c6", "value": "12288:xphraMTvP+5qFwRy71r5UUvJvUtp5KZABNJaJIMvcgrvjXFkvOTT7TE:3hrERgB5JvVUtvKO+IMvcYvLFtT7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776701, "uuid": "ea996745-ce22-4d07-96d6-c2df1a13bd12", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776701, "uuid": "7739e64a-a6d4-418a-8a0e-9564764537ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776701, "uuid": "ec429431-2986-4682-bd25-6e62a49f2104", "value": "0908796.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e87a96-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655831788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831788, "uuid": "ffa5c8cf-76e7-4e63-b9ef-403154e9158d", "comment": "Malware payload", "value": "6dbc5b6f41e63bf8f87895d733cbe024", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831788, "uuid": "ee73c5b4-2e28-4429-9c90-6d13891d235e", "comment": "Malware payload", "value": "87f5879bd7d52354c4aa8062255f5fc86c83b487732da6b6661b3de51d118b80", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831788, "uuid": "902b19ed-1bf0-4f8b-b136-9372fba23db5", "comment": "Malware payload", "value": "a2b9040538788899bbdfdef8f76b56badef08a28", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831788, "uuid": "9b374745-e3c1-4e8d-8536-27a1c664d653", "comment": "Malware payload", "value": "650fc3f035f40ad9dac7ccc4281228314750c9e767c60ca3d590ee0a771a897a3a356f61282b644ee773ccfbac2269c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831788, "uuid": "664c5bcc-f2e2-4782-a5cf-c297055f2e76", "value": "T13782D12BF2E9B765FE7A80955269FDEFB36353D82174C1B145458D9F58F0C58032A10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831788, "uuid": "c06468cc-cf08-4750-81f1-e96a542c3eb4", "value": "384:cpMVV6HEWwiAGWIuNELGTjy/q+CM8WhfVqs92MgAkKc6VzLRgB:WyV6Hd69NI0u/PCM8WVqso+kKc6lLRgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831788, "uuid": "6a1f1d26-c354-4007-b873-64b4d5d24b43", "value": 18119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831788, "uuid": "22b28a3d-76b3-45d2-a362-862b8369007e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831788, "uuid": "043f932d-4701-4010-813f-697be0291682", "value": "11IU 20062022.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d8a668-f1a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655847176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847176, "uuid": "8175f38d-429d-4e52-bd6c-66bdb34f4624", "comment": "Malware payload (AgentTesla)", "value": "8d8f7636816358b0d3cbeb533aacae5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847176, "uuid": "e321fe0f-451d-46ba-bf1f-d97cf34256b8", "comment": "Malware payload (AgentTesla)", "value": "89125f8e9ccc509f8d9b780a58f3d1fd65159d2e2b85e4b2c65d6f43959a7ff0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847176, "uuid": "d5932ae1-da29-47c0-bd35-717360be011d", "comment": "Malware payload (AgentTesla)", "value": "3119324334a8ad26c5df66110c1d6e11ed311e48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847176, "uuid": "cee60b67-7747-479b-b702-c8fc0745642d", "comment": "Malware payload (AgentTesla)", "value": "0c44163a995209fedf90c10ae98437fcab684e13e730c934c866eda4a9eacc1c40153b4bd4bab8b85862dde4269a1ff6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847176, "uuid": "cce345a4-e7f7-4fe2-ac86-082d747300a1", "value": "T1EB15DF037B849B51C674367B816ADB0413F5FDC6A182DB0B7FD862A985B37C26B2D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847176, "uuid": "f0c608af-144c-4ad7-b60b-adad772f5ae5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847176, "uuid": "c08a80d6-c84f-4207-8455-dda60bb70187", "value": "12288:rLXHPS+GPjV9nG2lEEPZ7bAq2HmHM8mEpXNKj6Fo2mYWJ5:rbHPSDVJGyhPZvAq2HmjNKuYR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655847176, "uuid": "ad6120ef-3530-474e-8d44-5f7d75948378", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655847176, "uuid": "9f240cfe-9c0a-4e15-a811-cd89fd5bdff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847176, "uuid": "e58d38ff-1541-4288-8adc-2b8a6783bbf0", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DSR.genEldorado.3026.29313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61808994-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807948, "uuid": "92868d0c-84f3-4d7c-baa5-98167d085720", "comment": "Malware payload (BlackCat)", "value": "4c1d1a3467ac508a66d680514a327eb7", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807948, "uuid": "83bb1970-edf7-4b4f-962d-6459f1de6bf2", "comment": "Malware payload (BlackCat)", "value": "8a22a91c931ac80ca91cf91fef678c4bee00e3eb5ad24f209bc8595e012ba5b0", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807948, "uuid": "3d33164d-af15-4d9c-b7cd-defd76693bed", "comment": "Malware payload (BlackCat)", "value": "4913b76ec31e6e3e58188c5b51ca745a7e6003d7", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807948, "uuid": "b5a35496-9b6f-4a1e-9b94-ffecf56bbcb4", "comment": "Malware payload (BlackCat)", "value": "b3c04f6c4e420cb34557b96fa6f18b3b04ed05fd5cc2650707ae511aa09fd11e84d8af6ebc50749841b2321dc79ac936", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807948, "uuid": "ca8bb124-5329-44be-9a3b-da12e0f9c45d", "value": "T1C8E5AF95FB43E2ADEDAB1470345EB33ADE34481C01199FA3DBE44D71BA2EB111E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807948, "uuid": "d6d7881a-8e3a-4cc5-b21c-c912b1d9e783", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807948, "uuid": "9594ba12-39c7-4124-8204-c9a0e76d8235", "value": "49152:BQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNy5eBZw4KAzQmy7:eO7xei83ksPBqanaABK4KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807948, "uuid": "5db4504d-7670-4ad6-9ed4-330eb79b1586", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807948, "uuid": "2ec030e0-5ad9-4a0c-9d71-ab272d96ac00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807948, "uuid": "03fc768e-0769-407c-8b60-3470b7a7b7d7", "value": "8a22a91c931ac80ca91cf91fef678c4bee00e3eb5ad24f209bc8595e012ba5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7629e26f-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655801970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801970, "uuid": "3351107e-8bec-4493-92ec-3ffce7b4b9bb", "comment": "Malware payload (AsyncRAT)", "value": "bbe47d4f59845136736d4d04120b38bf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801970, "uuid": "0ec4de94-32c3-4517-9b05-7ef2e05f8bd0", "comment": "Malware payload (AsyncRAT)", "value": "8a9d65797203370c9d17d7d125629492d591399f8f4c911a4a8c588c2e0f42c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801970, "uuid": "4192735d-f7cf-48c2-913f-e942666f4d40", "comment": "Malware payload (AsyncRAT)", "value": "ff82fad13179e65d593c76bc4d1db7ca326cb0f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801970, "uuid": "f348a4da-da37-48ae-8255-024abc5eba94", "comment": "Malware payload (AsyncRAT)", "value": "52482a537b52d16aaaa31c6b1035c798a2e6feff63ed6d4a66556118eed9e3ee10940aabd709c011c317b0245420b703", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801970, "uuid": "a044c404-b5e5-4230-b434-2bd6636ef8b2", "value": "T1EA1533E0C0A75143FCBCB8B65903AED1AD64457D7A2194A7232C640A6E3523EE39B71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801970, "uuid": "279b5596-325e-48a6-915f-c0a410216f30", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801970, "uuid": "a6273943-f254-4775-bdbb-466470fb24b4", "value": "24576:ZF6LL9rgrvPWIMMN0PxVgvD4KcYDQxABe5:O0zPB0fgt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801970, "uuid": "ff80d9e2-56ee-4e80-b119-b281353c5e38", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801970, "uuid": "37698ca2-a918-4a75-b13e-5428b1faa5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801970, "uuid": "69127e7c-e9a0-4f67-a425-e7a931a121a2", "value": "bbe47d4f59845136736d4d04120b38bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec5ecad-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801877, "uuid": "3d0cc0be-5b77-4b37-b85f-2d06feda3904", "comment": "Malware payload (SnakeKeylogger)", "value": "cfbc65891871e26b7d1022c8156e1358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801877, "uuid": "f7fc2282-76c3-494a-ae9f-c6bee959dd6e", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab8e038fb9d3581161593d14a73eeef265a10c31b47e338c9f2b54ccc6016fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801877, "uuid": "80f9fbe0-5cbc-4b22-a0b9-b07a4aa0fc08", "comment": "Malware payload (SnakeKeylogger)", "value": "b2d01176becd6bc713b49104fcfcb62f856f6f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801877, "uuid": "6133af8b-2881-4a94-891d-63da0af452c9", "comment": "Malware payload (SnakeKeylogger)", "value": "cca16c675a53e19a5ceb2cc85eb3f67a046d2d021ca34916ac70db9b12dae5fc084fc9c46e0e3008e96d7a6acc4c9057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801877, "uuid": "7b5a6726-e410-41a6-a720-085121145791", "value": "T1F594F142B6F91B1AE6FB97F452B6504547F135AEA2A1F11C4DCA20DE2876F008E90F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801877, "uuid": "cf17bb53-bea0-4e18-bb73-d1b748b111ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801877, "uuid": "5681b2e7-89aa-4068-8645-ce0caa893a09", "value": "12288:LS91v8V6FwuNvqOk/MyaNFBimcElktzzOw:VsFfBJ9fBimcElQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801877, "uuid": "994c75b2-8a0d-46aa-8287-5ffd624bb4dc", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801877, "uuid": "f99d99bc-4e37-4445-80a7-3448956ba421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801877, "uuid": "b9ee1d1f-75c2-4c9d-b024-f138f3027c99", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78576659-f1b7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655853084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853084, "uuid": "f7ae79a5-e82f-47c6-8092-81651adad597", "comment": "Malware payload", "value": "508bd23f9c8cf13633f1ce4dccd6385f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853084, "uuid": "5139de24-f910-4910-9192-5bbea5dd8a5e", "comment": "Malware payload", "value": "8adfe76c18665958893d29d9dca89f59cec4175de645a379668297c78013a7a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853084, "uuid": "7218db7a-4746-4af9-8524-aa6c1e0d54c2", "comment": "Malware payload", "value": "3dd448bd161db5150760cd98d9b30ecf3fac4aa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853084, "uuid": "ff95eb7e-3743-4fb9-80ea-97a71c3d649d", "comment": "Malware payload", "value": "e3e027e1399ff758daaf3c0f7417ab865a504370ec6e28869096741a0faa3d6da9366030e2d8cd12e9ff9b4ad9031afd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853084, "uuid": "7aa7b533-1f43-47b9-9354-b75322607dea", "value": "T14DE2CF17E3948B3AE9350B716EB383014B74F552CD13DB3F78C05A0B6E167A20A56B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853084, "uuid": "6df5ebfc-cd24-410d-8541-04fa0659bc48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853084, "uuid": "9413ebcc-16ea-4410-ba6e-a43ce49d063e", "value": "768:PB3Abt1X4Nf7oGFYwQ8XvLWRgcL0ST8iNxy2/:PibtNCF7XWRgcL9HNxv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655853084, "uuid": "39841690-4dbf-42cc-b948-b4050ac95a0e", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655853084, "uuid": "4022613a-41cc-4ef1-a91a-7e789094777b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853084, "uuid": "2c75681f-a8a9-445d-bbc8-11551511da83", "value": "508bd23f9c8cf13633f1ce4dccd6385f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6c443b-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655808770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "417712de-6a06-4d30-ba3a-289b2ed36171", "comment": "Malware payload (Formbook)", "value": "6356f0da135b950d56394d8d709fd1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "3ff74cf0-e764-483c-97e1-038aabfe3972", "comment": "Malware payload (Formbook)", "value": "8b3400df5cde1ae7cb0fd19326152d173f6a43cfc7864355f047232dd7f53df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "34088e1d-f44c-4844-aeb0-b804d510d9b7", "comment": "Malware payload (Formbook)", "value": "f76bf1e5c1de7549f61dda35fa58bcffb9cd723a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808770, "uuid": "b3b200f2-3cde-4f39-a234-a22a2f5e0655", "comment": "Malware payload (Formbook)", "value": "7690ef24871d141e9de94fe1df0b4eca56d2cdf0dfdd6c099a4d1f616c1e4aab04b8e407d6d5387ae7ce48b3292e8c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "0ba9759b-5691-47fc-9a2f-ca78037c404a", "value": "T1EBE401F19EF4B966E13425737064A03C33D76E1DD866E439C6CBF04A30A2AC165E5E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "fb290f94-6a8a-499a-89ce-33dcef9ed2e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "d36c6c55-7481-45bd-a3c2-86937b9e708d", "value": "12288:NqvsSnEWEHDdWNvxeSM0+WHeYggMhrfoPPOF/qwk6rrhuBAgQGhE:kvzEHDd0EnWHVwLFo6QBWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808770, "uuid": "f7f99ce5-602b-4d5f-b4a3-9af3d2493dbd", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808770, "uuid": "3504274e-872c-4092-ac9d-41447b20275f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808770, "uuid": "ee1ebd56-f304-4019-bd69-1a1cf1895136", "value": "\u00d6deme Onay\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a01910e-f12e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655794138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794138, "uuid": "6a909903-d04e-46f1-8bf8-c411cc0ee466", "comment": "Malware payload (AgentTesla)", "value": "c2fd3c9538ed22c3031f86380663cefb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794138, "uuid": "2d37a75f-b400-4218-ab38-be2e30f05a9a", "comment": "Malware payload (AgentTesla)", "value": "8bfc83001eb6632991a13e2cd0f8b8a70b0788b4bf21da7e8230859433d15251", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794138, "uuid": "1f626f92-45b6-4792-86c6-a242d5efa1d5", "comment": "Malware payload (AgentTesla)", "value": "63fa82375211b6bfb38dc2f634991808457cf460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794138, "uuid": "835901eb-5d29-443b-8db0-7c0780b1c030", "comment": "Malware payload (AgentTesla)", "value": "ed3ed3361f59ba722cc0b4741faf59cc5ba1b31cf2e1f3d64d3188ed89af35ecd2955be62cb5dd1c0a7fb44d198538e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794138, "uuid": "dedbf4c5-8d88-409a-8293-e103db89cb6a", "value": "T17983D06721E58010D5E186325F6AA0F96E27EE9BD82BD0063400FFF5B73D18B24E6637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794138, "uuid": "a3bd8332-1270-4674-b6c6-3ec1c4c68370", "value": "1536:B2r99pAY7lgZ7v1UH4jWfGXzoyldUaqxxKhVsN0godYpPXupp:B6bxlI7vQuFdUvxUVsSkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655794138, "uuid": "41458234-a883-44bd-934e-71126a870722", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655794138, "uuid": "f8e117bf-5a95-4c6b-9dc3-0a53932f512b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794138, "uuid": "44bcaf6c-dae9-4f90-86e3-d97d6ddcf3aa", "value": "Invoice 001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3812eb-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655802218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802218, "uuid": "26297740-9d15-4f44-8bbe-d28f5699a278", "comment": "Malware payload (AgentTesla)", "value": "c4923fa08694fae5350ec88e48a857e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802218, "uuid": "b501ad96-0a3d-4018-8b17-f928868b1bcc", "comment": "Malware payload (AgentTesla)", "value": "8ca96ed1095c5dc0d3b4a81c7e654a8d091dbce9439c47a4ac9eca4221b323aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802218, "uuid": "3d55ecc8-21a8-4b47-a3ff-4d498524c7e6", "comment": "Malware payload (AgentTesla)", "value": "37b75977d93ed6d1f2eec96db0f8784b5e4e0cb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802218, "uuid": "0ef03b5c-e597-41f1-980d-ff5b4092c5ac", "comment": "Malware payload (AgentTesla)", "value": "655e3b10776ff55fda797ca4a86db5cb31d8f9759aebfaab7ab7d1b9473e6109da2f14d370ae736f6a54e85321c13007", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802218, "uuid": "9a52a9d8-3524-43ac-8ad8-f0ce760d2467", "value": "T16F83E0849DB38C45FE278EB615D6B32DC5642D7590FB74C1330AB62F007ADA06CAAE53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802218, "uuid": "c346189e-a975-4790-98b0-4a147f32017d", "value": "1536:zAtUKURRKZGXw1wNj3EBaqjdOEinPMaCfY9ARvirvEYs76iyd:zGUHRogw12j3uFOEyzsOi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802218, "uuid": "e18a362f-35c3-41f4-837c-8088ae97f0f8", "value": 82120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802218, "uuid": "55d473d2-ebde-4f0d-b611-9e893b0175b9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802218, "uuid": "54c2c930-3d1a-4610-b417-0418daa494a4", "value": "LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8872eaa-f11a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655785868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785868, "uuid": "11ab3bac-bacd-4dc2-9d8f-a2f579815216", "comment": "Malware payload", "value": "b82a3c035691675f3de8f286d4110b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785868, "uuid": "a8191872-9ecb-4335-b02d-b796e1f25977", "comment": "Malware payload", "value": "8ddb37ad0ce04fb6561daa7a68e2ef200b8cd43bcd13f3fa0d75a53bb86356b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785868, "uuid": "fbce5523-8e45-46d2-a91c-8c61c60e1bbb", "comment": "Malware payload", "value": "ddea3b2d617d521c8507357d2dd697bebe2a9720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785868, "uuid": "275cf17c-be53-4a1f-92ea-09b3649a7fe7", "comment": "Malware payload", "value": "f9521d4e6e6ab1e969b31efd61a7df85408a5e910cf05a5e84b87e8f130512082bcb364da49d41275717e19c7f5cbda6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785868, "uuid": "9a29a633-0d1f-4a3f-a25f-dfd45d0ebb65", "value": "T113625E6173E95529F4FB7F747D7356100BBAFD42A839C64E09C9414F0EA36448A60B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785868, "uuid": "e73cf5b5-8680-4a66-a7bd-b7fa724a6d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785868, "uuid": "b543afef-2045-417d-8afe-630d431f9de5", "value": "192:yYQIWbY6TwUK/vkpGFqNODm8+ABvuKY9v1pR07gcR/gt/yi:uM6AvkpG+Oq8LuKquyt/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655785868, "uuid": "0a80b93d-8a31-41aa-8a10-03178eb9ebae", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655785868, "uuid": "e5f12d27-8a17-427e-8a73-9ecc255cf97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785868, "uuid": "71863b14-3f26-417d-b76b-e20acd954ce9", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.6875.21484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48dbef7-f128-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655791820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791820, "uuid": "8d8cc283-984e-4a9e-90c3-5dadafbeb7cc", "comment": "Malware payload (Formbook)", "value": "64111e3560f8aca2655c751034ac3523", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791820, "uuid": "d73837dc-8a09-4515-96b7-6375f118954d", "comment": "Malware payload (Formbook)", "value": "8e3b196020dba34e4ee41595065c497a3255e80ee80cbf782209e644fdd44db6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791820, "uuid": "936ea7b1-f652-47fd-b510-e52798425fa6", "comment": "Malware payload (Formbook)", "value": "3db08e456cc831402de6e57f9e43f844df1bca41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791820, "uuid": "967eef6d-de4a-4c5e-8283-0686cf5e1ea3", "comment": "Malware payload (Formbook)", "value": "e9bc8ec5ac23b9a9193c58f43e3d129b3fbb22ee1e41658ce847270f7114980665c951f3a40bc663b816c1634d45feb6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791820, "uuid": "f1f32c2e-3ac6-4d3f-ab14-2bf1fb08b29a", "value": "T15EB4230432E3D5384AFA06432FA99BC263F5C46850A6AFB51AF6914C22342F9DD775B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791820, "uuid": "24387903-2904-4eb9-9f57-7cc8622ac522", "value": "12288:wx8H2EO4939Ny55zttNBUZcW9CRdxjUEUAyq:wGJO49NNNV9CDaoyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655791820, "uuid": "1ea58afb-d477-4120-a3fe-8c0bc1b7f61c", "value": 498763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655791820, "uuid": "d9c8c24f-f23b-4c64-a0c7-b95ea043b07a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791820, "uuid": "ef4e6be2-726a-4615-ae27-6cd2403b78e7", "value": "NEW PO 87910219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cf7d17-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655823042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823042, "uuid": "76d74c1e-b78d-4f19-aa6e-90e67ed38331", "comment": "Malware payload", "value": "608fc63d1c3a71173e563123573da665", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823042, "uuid": "87ab7b82-1037-4856-88c8-ba02a2a9a694", "comment": "Malware payload", "value": "8e438f4e47b5c19cbb9499416be46a3b1b322d5a4b37cc264e5008e5d6b30aff", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823042, "uuid": "d869bc1c-2bf4-44a4-93a2-09830b4102f0", "comment": "Malware payload", "value": "36bdb5de7209c93f55067831b8723add01d4de28", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823042, "uuid": "8153b788-5e1c-41d0-b231-54f7c953bac7", "comment": "Malware payload", "value": "110fdd84e421b74481aa6912d8e8f9b6654eca0684966844d9e48351808ce63403c8c75c83cf1b0ee50817c84b6327fc", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823042, "uuid": "b1fd6b4c-6263-45ee-9681-225dfddc173d", "value": "T12BA5AFB875043CD6E66F477BD997ADE813F626229A87A9CD407476C309733A6FE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823042, "uuid": "772f5094-6528-49c6-80f1-8f3e2a294078", "value": "24576:ME9rd0ARR8qdowcDnq3R1/AAl9h0wkLB0C:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823042, "uuid": "758d24ab-ab09-44c3-885a-ec2962ab3726", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823042, "uuid": "e33cf67c-53cb-4467-96ea-6a117ea06deb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823042, "uuid": "526826c2-1841-46e9-8877-e0f58b078bf4", "value": "document_2022-06-20_invoice3.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf05b62-f187-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655832474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832474, "uuid": "32bdbc2a-41f7-4ced-a417-c4ebf9c93be3", "comment": "Malware payload (Heodo)", "value": "ec758d5b0f4a1516b1c20d55079f8b14", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832474, "uuid": "0b93ee24-c0b5-41cb-9c3b-26b60db9558e", "comment": "Malware payload (Heodo)", "value": "8e82a5abb742f68bbf414d4dda2f6adf67a62a0659418eda6fd74531e6f95769", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832474, "uuid": "aad42e73-150f-4a18-9b9c-2dbcf036122e", "comment": "Malware payload (Heodo)", "value": "1b197830772259d51c95b416eb3f735c164fd60b", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832474, "uuid": "f8b8ba4b-2402-4a88-a702-1642c61db863", "comment": "Malware payload (Heodo)", "value": "450f6177fd62f3cd1e48e5467568006de691855ad6ebf086497ff29410c1c789a4ef1878768baa20cb0051346299d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832474, "uuid": "ba5a6fcb-df38-4b60-8bc5-24ee3a630401", "value": "T19364AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832474, "uuid": "4c4d66e7-15c3-4c18-89cf-2cea5fd0d742", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832474, "uuid": "9abe1836-ab2f-484f-9cce-f0fd23a4e4d4", "value": "6144:3MiSTD2He3kjHfNsQnZzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3+NmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832474, "uuid": "72a583b1-8733-43aa-b22a-3813acddc9ec", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832474, "uuid": "5919b887-ef0f-4287-8ec8-5f81ccc62828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832474, "uuid": "7026b181-f0a2-4479-bcca-4db12a404a70", "value": "VGBVX9EsTyllaKi.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc187668-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655831830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831830, "uuid": "490a59ff-4c14-49b5-8714-302b277f53e6", "comment": "Malware payload", "value": "baabb451745bc5a7f80308d0a0eecfd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831830, "uuid": "253eb7c0-b7c4-4656-8d03-fab5f7a79f36", "comment": "Malware payload", "value": "8e9f4c7e6c6e3ae6f215b0e74286564b3c9a042f8af5a217454a9efa3a28f952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831830, "uuid": "cd3f0a79-895e-4b69-b1ae-3cab4b585e2f", "comment": "Malware payload", "value": "75ea31515812d8c64d764503d420af324e9ee0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831830, "uuid": "2a793a44-ce58-4ea3-a2a7-c2fcbedc3e63", "comment": "Malware payload", "value": "2f727cf444216c36714d010e033aa56c2327f20237153c7d72a32d24e71b38952f41cb5a1defb997ed6023319f4a78a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831830, "uuid": "10312ecb-0a4e-4aed-8980-53ad005afadf", "value": "T1C9947D06B766A1EDE479C4BCC617A727EB60701C63606DFF46D048542E76FE4A23EB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831830, "uuid": "1b2ab367-6fde-42ba-9aaa-81579932d901", "value": "c225c6bf02595eaf6e1585d9fecf4b80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831830, "uuid": "9657bef8-9aad-4918-934e-18599758d562", "value": "6144:zm7/2JkIr9zDo+oGTwUkOTS3FDosKNgGF9InX2E7bVyDNaD0toEGNzNOF4jwawaY:VJfxsgTwh3FksfHX2YbkpaDHJOFGwaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831830, "uuid": "cd49ae96-c629-4e08-b019-ca1260645e15", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831830, "uuid": "67e5f96d-f713-4a5d-83dd-fe4b97328840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831830, "uuid": "a49397d3-3aa1-4bb6-bae9-40318659e7f8", "value": "client.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f322513-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808777, "uuid": "fa4decec-adc1-412c-8a8f-625e9772ee03", "comment": "Malware payload (BlackCat)", "value": "82db4c04f5dcda3bfcd75357adf98228", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808777, "uuid": "f91575bf-6373-446d-ad5a-3392a411f604", "comment": "Malware payload (BlackCat)", "value": "8ee191b51b853addc862307c8f641bd251a8b7dd88263d228453bb06882f2464", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808777, "uuid": "1118ad6d-5171-4c7b-a92d-c0dcd3e4281b", "comment": "Malware payload (BlackCat)", "value": "b310f72d967b265fb82cdee21ad75b3c7b90bc20", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808777, "uuid": "826f92a2-4030-4988-b419-422e60017707", "comment": "Malware payload (BlackCat)", "value": "4adb5fc779314f5d66de8cd2f372a58103a131cac5b34c3a1837a9fe772e0ca80f968b57954e8e4a5567c46f0a219150", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808777, "uuid": "449b597c-cca8-4466-869c-a191d7fe06fd", "value": "T1A6341A01B7908038F9FB16F855BE61A8593D7DE01724D4CB53D12EEE5A35AE0AD30B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808777, "uuid": "74d40b6e-7f01-4a73-a91a-b1349605ef17", "value": "9665931b335055a366209ba1f912f31a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808777, "uuid": "19239d5d-7d05-4545-849d-2b173f5980b9", "value": "6144:HzDcPM4peII0+7kDs7VprOYYgtg9RLz3:HzYPxMkI7VpjVts/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808777, "uuid": "71b5767d-5408-41ef-8adc-30bb04e272a5", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808777, "uuid": "b6f807b7-b4f3-480c-bf71-f29cc56fd8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808777, "uuid": "a3c30df8-044b-4314-aefa-2d00dab8ab50", "value": "8ee191b51b853addc862307c8f641bd251a8b7dd88263d228453bb06882f2464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebbae67-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802038, "uuid": "87ca520d-7d4a-48f5-bcc1-ea49ebd1a52f", "comment": "Malware payload", "value": "423543a0185aafc201777ae3b962766f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802038, "uuid": "f84aa27f-cc52-4462-85db-1b54b5e95911", "comment": "Malware payload", "value": "8f64dd3613560d7681c1edf3d861b662d19b0a02b69879fbb94eb8e43e745d38", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802038, "uuid": "fd3e22f2-f773-4096-8033-c35979e3c154", "comment": "Malware payload", "value": "2ce32b58c02950f54b63ec04a1c3c8327f3e59be", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802038, "uuid": "5116c3f6-d7ef-46a3-abc9-40110122e9eb", "comment": "Malware payload", "value": "2ffc0b0f28ed74211eb673833d0d13c38544d84ac0b2797a12cf0f120a4a4957a5c9c698c3768dcd682472f63a10a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802038, "uuid": "ea72502e-98e9-4910-9fbb-a4ae8a3d66a8", "value": "T1E2366D22B284613ED06B1A3A49779758A93FBB712D238C5F5BF4094C4F399807B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802038, "uuid": "8dcff082-78ad-436c-a09d-9496a05e41b8", "value": "98304:xmmXVGupqzGV629TSzKGegu2KhiIQvOYAA:xXUucGV39TSeGegu2PI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802038, "uuid": "1d5c1825-603d-4241-82db-7bf2475dab5b", "value": 5096960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802038, "uuid": "8e46b065-b238-4f04-bfd0-c265fad00668", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802038, "uuid": "fcb232e5-3044-488c-a60b-955a0e713060", "value": "IDfac-t.165.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27521deb-f196-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655838774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838774, "uuid": "ba70c081-62fe-41e2-9974-c521d529a030", "comment": "Malware payload", "value": "220c907a56a97bb4ddd257df1280fad0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smuggler", "colour": "#88627C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838774, "uuid": "74fde991-1ba0-4482-a677-ecc7f021f723", "comment": "Malware payload", "value": "8fdaa5db9738c21746114025811e37ce91323ac6f91e5dd6d4304a83ffa3476d", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smuggler", "colour": "#88627C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838774, "uuid": "ea2c02f6-eaf5-4dc0-9d81-62a3d6510688", "comment": "Malware payload", "value": "e75681261eeabd08003c691ccfd23235f2a3ed39", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smuggler", "colour": "#88627C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838774, "uuid": "836e9efb-85c2-4a9f-9423-0b807d28d1b1", "comment": "Malware payload", "value": "56e56cd77c972438723a3d9d64e5d6ad78babad8ac19fdd3fe191abccd7bced1f952b165f43a568906ded13cffc3feb1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smuggler", "colour": "#88627C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838774, "uuid": "39b509b5-6833-45ec-8478-5315d92fca1f", "value": "T1CB21B71BA73E810AF7A6D33D0CD3B90905F13755EA6107978FC06157829B0D408AE957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838774, "uuid": "b944aedf-6ec4-4a7d-8b0f-44922d4a7af2", "value": "24:9V6kkapFdOoA316Ltpf1Ybzt5Pl10xgWly3/6TOATJekuU25aSA9dcOs4:9JPWwZpfOVhQlX0+2p8qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838774, "uuid": "6e2904ce-3a26-4a05-ac11-d65548c9445a", "value": 1219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838774, "uuid": "62007964-b6e1-40a2-86cd-d267c04d4634", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838774, "uuid": "cc8241c9-8230-4109-8bd0-094f4c0b2c9d", "value": "Scanned_1697532281.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1682f1a-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1655823571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823571, "uuid": "f88b2c4a-fb9a-4e9d-b366-92358735c497", "comment": "Malware payload (Amadey)", "value": "5f358be9fc637665cf7179cecd191afc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823571, "uuid": "0a08d0c5-589e-439b-9469-4dbc7fbdfadf", "comment": "Malware payload (Amadey)", "value": "904fd9db22a234ac854e7a95447ce3a9653dddd34aa76d1fbfb2a663a519245d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823571, "uuid": "85210164-a851-4749-b848-8f701d854a5c", "comment": "Malware payload (Amadey)", "value": "45b2e3b22b0be7c2b10cf63569838b0e70784a1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823571, "uuid": "0b8d1b81-9522-4eda-89f7-4309a574a4e2", "comment": "Malware payload (Amadey)", "value": "3f8ed9c34f76412a14cca03f78aaaeb86924f9fb702b4a16b86e9193123517d351dc4d1e2b0a8fe3e4cb855250d9a065", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823571, "uuid": "fc25b557-e2e3-4a79-b8d2-a69894d9e82e", "value": "T1CD74BE10B790D034F5F712F859BAD368B92E7EA0676095CB52D41AEE5B346E0EC3234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823571, "uuid": "8b3cd7ff-72d2-4e79-9bc3-5f2652ba38ff", "value": "3781bb01be22688d5a8de1b4c8b859f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823571, "uuid": "eb0d0a0d-05b2-43cc-9e82-08142d9837b0", "value": "6144:JCxhF+qtAfuSOzY3bvWooEqMKXqd1ytaJPLlwYWL8Hoo7UpmxpgGn:JCxhJiuSOzY3beoofMZP5x508HZ2mxpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823571, "uuid": "4e65a21e-2b03-42eb-954a-7681f993df9f", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823571, "uuid": "94c69333-1503-44c7-b4eb-c5e420f61a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823571, "uuid": "07e8c88b-d855-43ab-a7e8-832f439ba5fe", "value": "5f358be9fc637665cf7179cecd191afc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58840d41-f148-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655805356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805356, "uuid": "b33c434a-510e-4ce5-bf8d-49f00e4f3689", "comment": "Malware payload (SnakeKeylogger)", "value": "84541310941961535649b4c966134d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805356, "uuid": "c29e0fc5-1821-4fbb-aba5-4dc58dbc1217", "comment": "Malware payload (SnakeKeylogger)", "value": "924f61ba19c7ee9f31bb66a3ca14aa9bc573e193043720cbb368b6e2fa5be2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805356, "uuid": "e4cb4a7e-ce18-4f1f-9855-5f20b7f6dc9f", "comment": "Malware payload (SnakeKeylogger)", "value": "56ae4f6efd8fef293f8ae7b0ee064f577214dae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805356, "uuid": "9d086e4d-ca91-4855-b5c9-f2b631235aa6", "comment": "Malware payload (SnakeKeylogger)", "value": "8ef654b156ba8b0e69a0be018b368db42f96295f7a2ac7581b35fb0775fc00499c98e830c266547fc93ce73a65c8c72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805356, "uuid": "1028b96e-a38a-4024-bcd1-e3ef932a94fc", "value": "T1F904CAD7F848985DF93750F90CB793599DDA29B28F004EDEAF463A8902B2DDD640C90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805356, "uuid": "ed7ef108-be6f-4deb-9d21-76a4f88c1d04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805356, "uuid": "eb870541-b790-4d04-b93a-3d3624e7f9b9", "value": "384:UwygSgKYlkykhuFxyBc1CA5pZfK3f/8u4D5RbE8YfjfcUBKOzDulvqotqi91Eqwl:A7YWOXpZsf/vt5UsLbgg58JgfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805356, "uuid": "cc25d3c7-18e9-465b-ba73-130ed5ffd030", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805356, "uuid": "b178c1b7-248f-4105-aeea-fce4b1d015f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805356, "uuid": "f0b1587c-8b35-4f34-8e0e-d696ff34c947", "value": "Remittance Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfc53ae-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655802356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802356, "uuid": "86a0d61e-313d-4a4b-9c96-4657f122957c", "comment": "Malware payload (GuLoader)", "value": "bfe6c6a98baf9badd8cc52fa6e9e645b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802356, "uuid": "8d17cc58-6de5-4bdb-a588-958235280f04", "comment": "Malware payload (GuLoader)", "value": "94035ec7382eb53ab8038b3ea25efe0279e1281f4f0f67d7f1837e81f8649c4e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802356, "uuid": "0cd51982-8718-4c96-8bcb-3bc575d7510b", "comment": "Malware payload (GuLoader)", "value": "1fcda5a449596414be6b9578501901ec50e2d4d5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802356, "uuid": "4e974c6f-5ce7-47db-9ad5-d8d224bce3e6", "comment": "Malware payload (GuLoader)", "value": "92a0c77c788a239d01b9ed414dea230a8ffa30dafc6d79bac6c98eec525276447a9ac83dff903bec387111268562630e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802356, "uuid": "26dd6afd-878a-463d-b428-427b350b0817", "value": "T18264F94533226A658DBE5810711D8B190FA06122ABE6D7314722D3F9CB514BBFB37E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802356, "uuid": "ae088522-9d94-45e8-a36b-df5b607b7b8e", "value": "1536:coVoMl7JJsqnWhhJ5Bz3hTUen8NUgj4wySx7GXRzCs6mwGhU5RZj/HTCnniab0v1:cUJSzjFRTU9vYcGh220v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802356, "uuid": "2bd2c6a0-1cde-4fdf-a227-8b17a3de8dfd", "value": 333987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802356, "uuid": "8f57853a-0dae-4be2-9bc8-59b48591b5bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802356, "uuid": "58c55927-373d-42fe-868c-d04c286ef2cd", "value": "JUSTIFICANTE DE PAGO.txt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3225f483-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807869, "uuid": "2dc4b2ed-19a1-4738-bc32-3495836fd40a", "comment": "Malware payload (BlackCat)", "value": "19ebc459a9e2837659272da0b2164684", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807869, "uuid": "c015bdb8-abc4-4fde-a279-bf6b9e24ee27", "comment": "Malware payload (BlackCat)", "value": "942946c6ae139b1f1efc91262f91034542eb75b80c3c66c10d69dda014d706d6", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807869, "uuid": "3230299a-b940-480d-bfc5-44f0e953d087", "comment": "Malware payload (BlackCat)", "value": "03520b41161f1191a699a7b7edbcf22f737dea17", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807869, "uuid": "d5c76077-0ab9-4952-a93f-184eec7669e7", "comment": "Malware payload (BlackCat)", "value": "2d2a3f66e42bbf8c1551c10e8c803c3ce16391fd9e3dfa1f953f7e6b27046d93aa1190f0a83363a0de03ab2c64df9375", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807869, "uuid": "7ee40a23-0d90-4b9e-8faf-5d28f3a5eebd", "value": "T13FE5AE46FA8356ADCEE71971305EB33EE631491C001E8EA7F7E49D70BD2E7111A48A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807869, "uuid": "0502c3fd-b864-4e6b-b0e2-cf393b23a0d2", "value": "5cfa80280c095d8ac5899898ce966027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807869, "uuid": "a2d3abc2-c4ae-49ff-9093-4ab6e5f4f10b", "value": "49152:rzt/s43JMJVvzU//8B9nPXdNuA2OHIxn/Vf13cF:1EaJGrU/uP92Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807869, "uuid": "d5337c42-658f-4314-8d57-617f2ff695de", "value": 3123200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807869, "uuid": "046b6606-f051-432c-89a5-0d9b5d67f04f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807869, "uuid": "89514e53-0e41-459a-ac65-07c77bdb9a1d", "value": "942946c6ae139b1f1efc91262f91034542eb75b80c3c66c10d69dda014d706d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4127b29-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655801752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801752, "uuid": "4378426e-e64f-49bc-ad0b-34e73181ada4", "comment": "Malware payload (Formbook)", "value": "fc2ab61fce7f203add8bd65a77df7de5", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801752, "uuid": "4886554b-ba33-43d5-adf9-bd9e17adb364", "comment": "Malware payload (Formbook)", "value": "9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801752, "uuid": "e7a7fab8-2c22-4186-9f11-32f10ddd6e73", "comment": "Malware payload (Formbook)", "value": "423261d0362864ecc99f05a726a940b33b69f5df", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801752, "uuid": "512e6532-f1e7-47f4-8f08-3dc68755fe5c", "comment": "Malware payload (Formbook)", "value": "289c51de3584a81dcc3c65c9dc1333376cc904066716b52ee9cab0b7e8cf50b91c957b75bab3b35fa19c4e511643ffc0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801752, "uuid": "7a07455c-9664-4de6-9685-70a562b8a0ff", "value": "T112A3456DBAF4C6A5D0F68633A6A1F6B2D46ADC9B91707947DC8CFA10F8B34E4DC54020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801752, "uuid": "b8d98fd3-80c6-4e3d-8b22-0e0acd47d297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801752, "uuid": "6a55bbe1-a1fc-46a2-aa7b-2e96891218ea", "value": "384:Oz3I2jy/+74+RrJkykhuFxyTdcSyB3rLnqP7YZFCG9oE7UFQhl2T:Oc2jy/7+nA1abqP7YfCG9N7ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801752, "uuid": "5636e2e1-65c7-44b4-8df3-43c7d0e88afb", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801752, "uuid": "7cc1062d-94fd-4718-a0b7-7158a37e19e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801752, "uuid": "48e9b482-e85c-43ce-9a30-d2703002f4cd", "value": "vbc (2).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4151846b-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655806176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806176, "uuid": "367740d5-11f8-4834-9481-f14d9adf4038", "comment": "Malware payload (Loki)", "value": "b6aebff0d656f16d2132fa83dd336cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806176, "uuid": "ee557afb-c525-4ba2-9ff8-9cd912f777b0", "comment": "Malware payload (Loki)", "value": "94c07d6f7dc09f720b39adb0d26f20677d7e6692fdc2a0e4b439078b6cceb79f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806176, "uuid": "17ae4531-b266-4159-bc4f-dfe17cb2a9e2", "comment": "Malware payload (Loki)", "value": "5cbad7f9273bc51841897af4378ceed987b4534b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806176, "uuid": "badd71a3-0416-4b76-a03e-097c9c95e5df", "comment": "Malware payload (Loki)", "value": "22cd01ac9c7e07dd72f13498db9fd17b5a9d5230190e1c960720db064fcbae29bd01f38d20a2af245e82bf2f1296a9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806176, "uuid": "9b5ed5b3-a891-4c7c-a687-2d40f776bb83", "value": "T1BF84CFF19FF8B961E02825B774A4603C37D31D1DDC91A836DACBF48934A2AC525E5E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806176, "uuid": "e32afc0c-33de-4829-b8d5-3ab7a4f03dd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806176, "uuid": "74dfe036-ec67-400d-9df6-76ca0b9e1f03", "value": "6144:NN4P4wxWUwbL71IbJUyLS3/ZDDUnQS6ffakHZ:NOvsp71gqOS3lYQffaqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806176, "uuid": "9f28911d-8b3c-4298-bd00-21a223f0ad69", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806176, "uuid": "80966a6b-e17f-4986-8059-fde1c0820b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806176, "uuid": "80ce7d43-3058-4944-a755-694948aa9023", "value": "audiodg.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d244e2-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807959, "uuid": "bda3fa90-8736-4b5f-a474-41adc95280f3", "comment": "Malware payload (BlackCat)", "value": "446ffb66972f7170d0dab6a4749c68dd", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807959, "uuid": "4815106c-7768-4766-9556-93ee474ad4a5", "comment": "Malware payload (BlackCat)", "value": "94e56379b7a31b01cf826076a74fc4ddb7f86f7991a6f58300f28712d484aa33", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807959, "uuid": "53084a6e-d81f-44fe-913e-3b874831e150", "comment": "Malware payload (BlackCat)", "value": "0ba4ade53ae75d44fd72abccf040b1bbdb80f707", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807959, "uuid": "df6a549f-999d-4c1a-8ca4-8ded095df073", "comment": "Malware payload (BlackCat)", "value": "b76766c0c1a216e9cfc51dbb2fb0f47c0af5d699bf9bba5188c14b5250e5806f7efe9b264a0964471d63e1ce2347445f", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807959, "uuid": "c1b44576-ac04-4c6d-88ca-8feb49c02a60", "value": "T167E59F95FB83E2ADED6B14B0345EB33ADE34481C01199FA3DBE45D71B92EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807959, "uuid": "cbc87fd7-06e8-4ec9-9ea1-8856e353583a", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807959, "uuid": "ac6ef21b-e824-412d-a6fd-22c72857648e", "value": "49152:EQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNy908pETJVFOUoeZKAzQmy7:zO7xei83ksPBqang0jXKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807959, "uuid": "445a6c30-72cb-4688-baa9-906ca069f71b", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807959, "uuid": "18c228c1-fdfe-44a3-a603-a7c5bade910e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807959, "uuid": "a28cebe8-a176-4bbc-8826-85dc4fa0aa06", "value": "94e56379b7a31b01cf826076a74fc4ddb7f86f7991a6f58300f28712d484aa33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a045087c-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655789585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789585, "uuid": "c5a398bf-1480-4152-aed8-b9dd577ab337", "comment": "Malware payload", "value": "3e285b6c86a6f0807682217596b966f8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789585, "uuid": "c1f7c575-d55c-498f-ad58-7df3ed09d968", "comment": "Malware payload", "value": "94e822d8007f8083df490b1a164e0cc124ada8499da4bebc56c1df5c11c58f17", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789585, "uuid": "ec07078c-75c0-470e-972e-b8636a038ed3", "comment": "Malware payload", "value": "d8c9294ccd61e2dfa34edc43d12ba50a6abd7e96", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789585, "uuid": "2f17c2d4-4ba8-4e4d-a8df-758fbd7ab8ca", "comment": "Malware payload", "value": "ae3580a9d654db919113c7572d67264f799b3d105e4b8045837504e9618b9378cc565ed376b6480b0df07c0eb9b14c18", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789585, "uuid": "2654765a-c33e-4e6e-84bb-78f9146b9567", "value": "T15AD2D19DCA4ADCA9C1F5B2795299378B233C7064530BC1456E8101B618135FEEE8EF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789585, "uuid": "46e2477a-bbea-405e-9d11-3405fc184bac", "value": "768:CfdSQwSIqLDTtYNBBu1a/hN6Rx69+zZ1/v+bBJvIP:SSQDz/tQBIwJNt9EZ5AJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789585, "uuid": "1542e15c-0349-41ac-ba3b-0f8e876f828a", "value": 30986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789585, "uuid": "6363ded0-ceb3-4b8d-af24-2442eb59a2d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789585, "uuid": "2ba180d8-6405-4ae7-bcd5-8b947657a507", "value": "SecuriteInfo.com.Trojan.GenericKD.49188232.27721.5181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61513cde-f1a5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655845314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845314, "uuid": "89fb2086-23ff-43d4-b926-1ee1bb675630", "comment": "Malware payload", "value": "641bcbe113b1bedf6a380b31c044d491", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845314, "uuid": "56e623e1-ee3b-48e0-9409-6300ed6ed0f8", "comment": "Malware payload", "value": "954bbb40c2856cab3e180781bf1d1ce58e00bb386220746b5fa6a9a7f3e7322e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845314, "uuid": "aea3d58d-cbd4-4ec0-b11f-6ac9f01e5eee", "comment": "Malware payload", "value": "b1b393574569ffe8201576fbcb751d2791f51b3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845314, "uuid": "f8824cb5-40fa-4953-9f5d-0ecb0f3218c7", "comment": "Malware payload", "value": "7a4263d72dc07fea1ce40097543b1c8d8233bfdc9c3caa0edb0e32f7d2906b430a748e88ab06994878ca436315cc7f41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845314, "uuid": "53bc8628-5d68-428e-8df6-8738f8c36455", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845314, "uuid": "6d39af69-f95a-4624-8198-2ca0132b63e4", "value": "3:d6AWRn:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655845314, "uuid": "08a5d781-db18-4e1f-8d33-75aa7462f4f5", "value": 7, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655845314, "uuid": "67e5bf4b-9643-4915-826d-bd97426416ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845314, "uuid": "20f36e71-03f8-4d52-aa0c-07f4dbe18f37", "value": "qa_test_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5870a9e6-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655831985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831985, "uuid": "4ae3e3ed-2eb0-41f7-93be-0ca326514fdb", "comment": "Malware payload (SilentBuilder)", "value": "ea97951b73a0411c15192ff2d12bbfee", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831985, "uuid": "b76506a7-5c48-4e16-b3ad-384ee950154a", "comment": "Malware payload (SilentBuilder)", "value": "9594b550c66cfa25899d7f1fb8769c272fe2e20c09b63d508665381c15ccf258", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831985, "uuid": "0aaa2f8f-89a1-48e6-af00-e33534859ecf", "comment": "Malware payload (SilentBuilder)", "value": "847c47ee484be26b9445c9461c9a6ab57cb50b9f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831985, "uuid": "0c47979d-c0c5-4a21-a76c-3c5a41cfe821", "comment": "Malware payload (SilentBuilder)", "value": "53856c8cd112ef45d895fe6636faa18d305fef17961f09ab01b0144a43f98812c65818e84803f8775401685c42f15f63", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831985, "uuid": "4310ef05-ed38-4c10-83d0-8b10be310e95", "value": "T150533A56BA5AD81DF915C73548D74BAAA323FC314F9B0B832269B3106FFC8A0561714F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831985, "uuid": "a7188b7a-c261-41e5-8fe0-6be95b158b7a", "value": "1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5t:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831985, "uuid": "a34b7992-e10e-4cc1-8b32-12d6ef6f32f5", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831985, "uuid": "8eaba208-b7b9-4e62-afe4-d3b174d0be7f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831985, "uuid": "bdaf33c3-5c96-4478-a609-2de0eb048965", "value": "Untitled 007035342.xls.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e0e3f3-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655831868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831868, "uuid": "c0af7b4a-9c1e-4664-9241-930321df1fdc", "comment": "Malware payload", "value": "e256478fc5b8dbdfc039f7c2066dcc40", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:OCAOI47br", "colour": "#95AC93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831868, "uuid": "9056ab3e-1ce5-4e71-a1fe-811a1ef2546d", "comment": "Malware payload", "value": "95c002a8aef993564fced54ee4d61744285797971101a62246e9c8bae1b866e6", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:OCAOI47br", "colour": "#95AC93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831868, "uuid": "d385f785-d9d1-433b-9931-8b87f15de4dc", "comment": "Malware payload", "value": "2b13fbd09aa867c5bfb2ba99c56cbcaf2d68717b", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:OCAOI47br", "colour": "#95AC93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831868, "uuid": "28f1f7ee-db34-4bab-aded-de51fd35329d", "comment": "Malware payload", "value": "1479107de89ee31b96869602e1073470a3aec3d409d721e562b92525a004f6a4b066116ffb1e239e5f0d6823da3b0df7", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:OCAOI47br", "colour": "#95AC93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831868, "uuid": "a34f2dd0-b5e3-412c-a435-64196ea65df0", "value": "T191F2E0C3414BE071B397E97529DF39966C0D92E8A63E404B14FF894C39896E39D0FAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831868, "uuid": "fcb713fe-eb2d-4c5f-aa71-1762f869fcf1", "value": "768:IebCuiTEaFPAdslt7dBnHArC8updix+2c+Agw5SAzciYN6X:jGfTEaVkKddBng0oRVw5X31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831868, "uuid": "b2a37ee5-5017-43e1-896f-b84ab17984e4", "value": 35897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831868, "uuid": "991e83c2-0af8-459b-ab91-908be06f5f7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831868, "uuid": "465396a6-2556-4ac3-ab6e-15f34f2fb2a9", "value": "Invoice _ US-54192643.zipbr Password OCAOI47br.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851919e9-f183-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655830771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830771, "uuid": "b06c140a-f7b5-4ac4-89d1-3f7ff6147c08", "comment": "Malware payload (Heodo)", "value": "3be3e842c68d7e35e5bfaaa3016669bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830771, "uuid": "8322c3a8-85f2-4218-8fff-fe766f39feb1", "comment": "Malware payload (Heodo)", "value": "96b404e6974653e0bbfbd3f2fc10fe13bc58eca4682e33237d579b924d282ef0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830771, "uuid": "98b639d7-b9d4-42b4-8b4b-2cbaabc55545", "comment": "Malware payload (Heodo)", "value": "8cc769a3a84ac60aa995b689660cf7d93f7f13c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830771, "uuid": "a15947f1-905f-4d29-acd1-d31e0b486208", "comment": "Malware payload (Heodo)", "value": "f07efc473757000a05384ce5f3dd76a2ff960bb331ba89e94296db9a855f8ce213648b15a26121f7a775a6588a3905e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830771, "uuid": "1afec05e-a664-4c5b-9cc2-c63aca37dc1e", "value": "T150648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830771, "uuid": "d2484dda-bfd9-446e-9d77-21eb7539fe5f", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830771, "uuid": "06ae2e01-4486-43e6-84a2-cfb6901d2d40", "value": "6144:JqdSTDcHe3kjHfNsQnsXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3sIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830771, "uuid": "ef5eb0a9-7072-46b8-b4e5-74a9d4c6475f", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830771, "uuid": "752fb64b-9ade-4cca-a0ba-743115ddb269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830771, "uuid": "7407cd03-d819-4475-9f4e-0b3291180704", "value": "soylH5eSmexn5ikCeCwwO15o8sSV5STiJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4c4f95-f15d-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655814405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814405, "uuid": "d8fba347-de32-4e9b-a5ed-59fde081c3cd", "comment": "Malware payload (GuLoader)", "value": "13c4915fa822884a6b2df1c4e0d3b183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814405, "uuid": "21f98322-96e9-40b5-94d1-1a2d1635bc8e", "comment": "Malware payload (GuLoader)", "value": "974b2db4d0d3de54167582fe598595162eeced8fbb917be5ea40ddd7bd3aebd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814405, "uuid": "bce1ebef-f740-41fe-bdf8-b9049c9efe75", "comment": "Malware payload (GuLoader)", "value": "62558a6c43152aaa9c70498a2add90a437488251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655814405, "uuid": "37d80cce-7992-4725-b8d5-b7be1777ad63", "comment": "Malware payload (GuLoader)", "value": "b90079eba9feb2543904994aa21c953a278ab92e814cc087607a8d4ba5e804d0ebfcfd20434ba48c2815c2a315d2f2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814405, "uuid": "9187db73-8fb4-4275-9a33-24dc993d3c27", "value": "T15334121837E6C07AE4D32B31DEB6EBF726F4FA362A681B1B03904E4B3925741540D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814405, "uuid": "83f2a4aa-d537-4aa9-97bc-53722a4ed572", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814405, "uuid": "24818380-20b0-4365-b8d9-92e525a7c847", "value": "3072:Y1NjcVVnLpPu12upU3HZILcDjps6pPisQ/Kgabu2Fvt/EzA1IV25o01tYkKTCcec:cNeZ3uU35ILcRKVcrXzI8WYtimJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655814405, "uuid": "dc4d1e0c-8d77-43d5-a2fc-42809f161507", "value": 248136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655814405, "uuid": "de9a9cab-3a56-4c66-964b-7b732e97f5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655814405, "uuid": "0161b0fc-ccb9-4d33-83f9-41d96033a11e", "value": "P.O8942378478291-V890-00267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d9da13-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655799664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799664, "uuid": "b03b5b1c-7d70-464f-9187-32f43b4a9093", "comment": "Malware payload (RemcosRAT)", "value": "91a077eaddde1a284c8ebbf13a038ff3", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799664, "uuid": "98af454d-2f5c-4647-8eaa-b69ac7cea7e5", "comment": "Malware payload (RemcosRAT)", "value": "97bb3cfb9858d49db50039d3bd2761c6c15bb703fb8dd5f8701e69aa0b53e085", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799664, "uuid": "140fcd37-e628-40d8-b71a-e951bd28e6c9", "comment": "Malware payload (RemcosRAT)", "value": "3b9ec2e803c36fed7ead79a829d7871ebe5ba83f", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799664, "uuid": "6b303636-ac81-4869-b2d0-1b9ec1bcaeca", "comment": "Malware payload (RemcosRAT)", "value": "75acb875d74192babaa67a22be85258095160992ccadafb3b435371e92d75b9c1707514161c4e15cc9e00c6c015e4ef9", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799664, "uuid": "cd24f983-e59f-4233-b481-ca4b4734211c", "value": "T157D42334C0B63BF865136DA7A7402B95D5CE7362A7C56C3077979CF80968BA201ECDB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799664, "uuid": "df3c17f9-04f2-4ecc-b632-801ff0f26648", "value": "12288:AWQJ+4kdqDk/MOWzppCIhWObknzk9ax4OL2XaqEaIK0O1hBcRekL:9jqDkEhppCIh+4aCZa+IrRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799664, "uuid": "63c41a66-54e7-47b5-bb71-54b8dc05b247", "value": 618572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799664, "uuid": "b045e4e0-db24-40dc-95ee-676b8c3dcb4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799664, "uuid": "035cb1d1-069a-49fe-b52b-3c0df50dc649", "value": "SOA 20-06-2022_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331b3b3f-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "bc425f0e-1795-4fdd-8815-70505b62d61e", "comment": "Malware payload (Mirai)", "value": "ed791ae9ce23f0c6e616baae7413e1cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "f5de9999-4f05-4ac1-ad8d-5f0875b528ae", "comment": "Malware payload (Mirai)", "value": "99a0c781beb1d27c0617ce98ba2b9590def7b4ad2c8106a1d7f9182f73e7f862", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "ff60729e-7c84-4f13-87f5-e61d3b67aa5d", "comment": "Malware payload (Mirai)", "value": "6754d1d4a2a33ade13d461af1ec8f338ed2bf45d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "bb96d3c0-49cc-4ed5-b388-2ba91b7a0aa5", "comment": "Malware payload (Mirai)", "value": "0b1d2862ff16a09528cfe9443a1fb2755363a5aad7d7b4b0f3f3101927147a8bc3d7a10076dad227f524a6e7baffab70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "0b3ed40e-d269-4e9b-a1d1-9383c3acc531", "value": "T104C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "f15e9a5b-e8e7-4714-899b-b45f4ddb9d60", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeLEdWfRZrmW+IFj:Ted0W0MZQH3d6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "4ba34028-99b3-412a-9fe5-16005c67975c", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "41e058ac-e2e1-460c-8de3-37c037ac2299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "574e8f68-3068-4ed3-8954-538eef25bb3d", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355b736f-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807874, "uuid": "eebc6f94-e2e6-445a-8e24-31f51e8aaf7a", "comment": "Malware payload (BlackCat)", "value": "e9995272325fb5fac037294eb9345eab", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807874, "uuid": "d97bf55c-17c7-4cc4-94d5-daaef549fffb", "comment": "Malware payload (BlackCat)", "value": "99c71640bc985654db23b81ecb00e4d0cc160a25e1c58b6a90e379a559ea3440", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807874, "uuid": "be1f487b-9bbd-4571-afe3-5d5c9b532611", "comment": "Malware payload (BlackCat)", "value": "c952f1b6368f48e865905f19003090b800f4ab93", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807874, "uuid": "af78a3f8-48b0-498e-aa2c-38fd3e4de694", "comment": "Malware payload (BlackCat)", "value": "6a5c3d786a6b88d152d672aa27e4e698ee852f67b7ec2610f34a52e00e796e376a3ffe172476105b6b70fb42ee1b11f2", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807874, "uuid": "3bd5321e-8389-4612-9e36-176077881cff", "value": "T19BE58E4BFA8393ADCEA71571305EB33AD5304919401B8E63F7F49E74BD2E7212948A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807874, "uuid": "c76eb725-b4fb-4bc8-854b-71d2da9016cb", "value": "5cfa80280c095d8ac5899898ce966027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807874, "uuid": "6de5f020-ce32-4196-be9e-1d1b6b1caf7e", "value": "49152:xl/fF1A9+kgykCWtusDBMFR6WrRNACffilvoY4S+:/F1A9+kgeIusUD/3ilA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807874, "uuid": "d4b12166-8fe1-4782-a0c6-2f46fcd407b7", "value": 3111424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807874, "uuid": "00b73fdb-ccbd-4555-bf83-fee2fa37d127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807874, "uuid": "66b7db8e-cbcd-4fbd-b17c-9c29d164000f", "value": "99c71640bc985654db23b81ecb00e4d0cc160a25e1c58b6a90e379a559ea3440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7be10-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655807890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807890, "uuid": "72920540-b535-487b-9f6c-d9d29e7a9aef", "comment": "Malware payload (BlackCat)", "value": "5cb4a7637851571660a605ddfc153409", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807890, "uuid": "34c07b34-6961-46c6-810a-dd2e2b883cca", "comment": "Malware payload (BlackCat)", "value": "99d09068ac1b9d6db4f8bcff698ffff8e112a506c0f01afff460c5a3b1393ef8", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807890, "uuid": "9d131a54-23e5-4ffd-89ff-d450e6d8c68b", "comment": "Malware payload (BlackCat)", "value": "4ecef77bff0b5a8ece89b7fe5f85b014a0018539", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655807890, "uuid": "880fed5c-acb4-42ac-b7ac-8dc009299dfd", "comment": "Malware payload (BlackCat)", "value": "084e571e798b283ee09e9d868b6240da1d1887e31ea9eb5474deda648f52f6f9cf9faba42476b5d5f529ff0dab728509", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807890, "uuid": "44aac2ff-ff68-467f-8098-9546da62da0f", "value": "T102E59F95FB83E2ADED6B1470345EB33ADE34481C01199FA3DBE45D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807890, "uuid": "a2bd98b6-026a-441a-bab1-8ee1f7527894", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807890, "uuid": "23d05b4f-b719-4b05-a56b-b107d20ee95d", "value": "49152:aQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuN37inKFgNcKAzQmy78:tO7xei83ksPBqanmnegNcKA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655807890, "uuid": "239e2246-14d5-49a1-a1cb-5ca3d6652721", "value": 3077652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655807890, "uuid": "aacabd4f-57c9-41ae-8709-83c633aa1fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655807890, "uuid": "8c721956-43fc-45a8-8ac7-aa974cfaab37", "value": "99d09068ac1b9d6db4f8bcff698ffff8e112a506c0f01afff460c5a3b1393ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cd6f95-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655799662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799662, "uuid": "f948e3c9-ac44-4193-8b79-5078204c6f10", "comment": "Malware payload", "value": "8999f5e8dd6966a485198789952b782d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799662, "uuid": "57ad9afa-af65-4b6b-8e76-d6bea3a228a2", "comment": "Malware payload", "value": "9a38d5e0cd29c0fecb5a342d5aacf3c3a1b198db51cdd19dc699180a784498b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799662, "uuid": "623b123c-5044-40d8-844f-3e860db6f2ea", "comment": "Malware payload", "value": "7c1eda192d9bf552ed1b35b11e21541637372a0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799662, "uuid": "5b88f4a1-7bef-4ac3-a040-49ccdad27a9d", "comment": "Malware payload", "value": "880a7c88b519c0e03cd5b82c8f535404c1ab5d60109b75f731884aceedb860a8414e80305fcc054656568ecfd542de1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799662, "uuid": "4324f9b8-5401-457f-a639-c8563663f093", "value": "T173914C2BEB4668CBEC6B541741027DAE44F731A30AC74497B3DCA8C12F8E6312F26464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799662, "uuid": "7439e784-2a54-411b-bf51-10a02e1c3e4d", "value": "96:5Yxc3qZ6Y5Qeyuiw+JSgQcwvA+YmUhEBVgF6pNx9ue3klUqFCHclr/zbNbOCc4wt:qf5Q/uihSsSpx+FxekoHclrVbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799662, "uuid": "b9fad723-9ad5-46c7-a552-114b8bdf4d9a", "value": 4295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799662, "uuid": "4831bfa2-849a-49da-acda-bfda94a4ea60", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799662, "uuid": "c0ce21c4-a436-4d93-b5d1-1a082e7fed0f", "value": "RFQ__TE00038319 Offer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de08a1a3-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (Babadeda)", "timestamp": 1655809446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809446, "uuid": "d727d81f-9716-415e-b98e-8afcf1a163cc", "comment": "Malware payload (Babadeda)", "value": "7a34dd70e7d6c70897c946d316c301e4", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809446, "uuid": "6d056323-826f-4022-8449-96787fdc7d34", "comment": "Malware payload (Babadeda)", "value": "9ad58bd8f68d5e5636fed5c6c40a74da574c042f38bc1a4fdd23c3d40f9c4770", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809446, "uuid": "b61ea3ec-7bfc-43de-b731-85d9264261d5", "comment": "Malware payload (Babadeda)", "value": "62a9993725ddc559d78aacc6a84c0278f7e8cbfa", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809446, "uuid": "19b5b1d3-d44a-461d-9f65-9771db2e5bfe", "comment": "Malware payload (Babadeda)", "value": "f627f51cc256284ba3a83477e3255794fbd57bbbea6150e28e59361851e1a1616cf9f05aa8e31e89275ba056bcb2e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809446, "uuid": "a0e20b70-5330-490c-a1bb-313b3d7a15db", "value": "T101937C45F3D602F7EAF10A3100A6712FA73666249724E8DBC34C3D829953AD59A3C3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809446, "uuid": "f0a5e103-df3c-4b97-9114-d2ec5f3655cd", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809446, "uuid": "770e988a-fadd-488c-80d5-904904c84e25", "value": "1536:z7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfIx0T:vq6+ouCpk2mpcWJ0r+QNTBfI2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809446, "uuid": "6feffd6c-8bcb-4ae8-9b1f-2efe746ce565", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809446, "uuid": "ed9ed005-6af2-48ba-99d1-3d6bf938ee6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809446, "uuid": "aea626d5-c7d0-4978-8c65-aa6e58d9bb2b", "value": "DanielMEMZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c99b4a4-f115-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655783405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783405, "uuid": "f5a3e39e-7102-4545-aa6e-dc6f95f06762", "comment": "Malware payload (Mirai)", "value": "92cf47b11f9f2548ab8dd5332df70f3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783405, "uuid": "fff50902-2459-4b15-859d-2cb3878eafdd", "comment": "Malware payload (Mirai)", "value": "9b03b2316bb4d268c6fee00c5bffdc3c256a10a6a7fc1df8afdba364bddffb6e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783405, "uuid": "08d79f57-38f2-4aed-ac7a-e866e25fd93f", "comment": "Malware payload (Mirai)", "value": "8378068f53a17efdff3b17f8b346d9c1f2547de6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783405, "uuid": "77508410-26b4-4da9-8a7b-71bda14176cb", "comment": "Malware payload (Mirai)", "value": "a762fdadf7f15b2fde1a19607e0b9002da3e935f52d0ccea74798b07d79793b821b58c92c7cf2d55df401a4d2609e155", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783405, "uuid": "0d7618f2-ff9e-4e2a-b757-c936d9e6c251", "value": "T1D5B33A46E7808F03C4D51779BAEF42493323DB51A3DB63065918AFB43F86BAE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783405, "uuid": "92fb60e3-05ae-4bd9-ab5e-656b1a185694", "value": "1536:tJnR4OT+ixP3fwAZE69XDTXULLNlotcllfVi2nrCGGS+xe10XUTzw/9k17kkqOyW:qI+CvITkXXULLNl/BnrRl+w04M/9sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655783405, "uuid": "31b4509e-2dd7-4efc-9402-def3005da66e", "value": 109512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655783405, "uuid": "96ef4cef-1477-4f8c-8e42-2f4d857f178f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783405, "uuid": "69419bdf-e327-4578-a9dc-7c64f2cb4bf0", "value": "flow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f0f9f7-f14a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655806182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806182, "uuid": "fd4ceae9-46ff-4cf4-b7e0-263c086f5526", "comment": "Malware payload (Loki)", "value": "8299e783af89ed3b4ebbc4bc175f257f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806182, "uuid": "388a7d18-870c-487c-9434-b50a90fb4da1", "comment": "Malware payload (Loki)", "value": "9b44c677587d3cbd6eeb546e50011fbeb5e7e5ed5768d25858be6da683ba5bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806182, "uuid": "b89ee7a4-4d0e-4932-9f46-d71435580160", "comment": "Malware payload (Loki)", "value": "56602e93e5684e085c0a504937436bdec9cc221e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806182, "uuid": "be51b6d9-0c7d-43a5-872f-2aba7454255d", "comment": "Malware payload (Loki)", "value": "892fcce8b5bf58f5569974c245e5b55a76c00a04664b92008f8037c88e8f9cd7b3a8a142f57d0298268bf23fdba61a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806182, "uuid": "07851276-cb4d-4aaa-9d90-3449981d81ee", "value": "T1C7D4F1F58FF8BE62E06521B374A4617C77D24D1CDCA5E53ADACBF04A38A16C160E0A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806182, "uuid": "f419c82f-6c7a-44e7-8546-71a9ba871583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806182, "uuid": "e79c7465-4a2a-4185-93f2-ff8a79029bfb", "value": "12288:GnvTmijUohtH6R2Cn1mOI1CHDrJR9OJmF72+IXlyDcWqtI:gvDCx1mPSR9OokRJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806182, "uuid": "89128bb0-8bf1-4198-bfc7-4bbd897cd5e1", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806182, "uuid": "bcc1e887-9db2-4d7c-a0be-cc7486db2ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806182, "uuid": "fcd0319a-a2f6-4e23-b447-7551383f2664", "value": "vbc (3).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ccf6d0-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655803721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803721, "uuid": "6f8456d7-5f02-4193-b524-d24deff8b5dd", "comment": "Malware payload (Loki)", "value": "0a132a014d8ecb8821874f40eeb498c2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803721, "uuid": "7b3a3ea1-5dfd-4fc3-ad4f-06a4f9a18dc1", "comment": "Malware payload (Loki)", "value": "9be4c2db7fb366da843e9e4009a048975de66bba520aadf67679853864fda8c0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803721, "uuid": "527ccda8-a7c8-4113-bb24-b949b82c9955", "comment": "Malware payload (Loki)", "value": "ffa69b001b1e9ed0ceaba6bfdf1affa70899460e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803721, "uuid": "1db75b5f-8bfc-4a44-af1a-d412437b7276", "comment": "Malware payload (Loki)", "value": "fe6c47215b7595161b3ebb6781992ae7cb5ebdccb934333013a1107b635e6ff6fba9abf7c06987946d49c0bcd525c466", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803721, "uuid": "7533ca72-95f3-4c39-ac84-cad10e969fea", "value": "T16483E13D2B2D8056ED6951F5097E60B6822A6E48C50B701BECB0F6DAF3757607F30693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803721, "uuid": "4dd85b36-d80b-4ab1-bf2d-d42104c170b5", "value": "1536:bmK4yqCp+v8/uFEaI76EucdPhQEO5pPI9T6NQ5tD3VhKo+wgmoYsLs6uRY1awUaN:bmID/uF8eCynIEe5tuMgY2s6uY1avaZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803721, "uuid": "f251ec0e-efc9-4d97-aca1-188b8df5c75c", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803721, "uuid": "09b5cbd6-75f3-4ad8-a23b-8487c0415334", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803721, "uuid": "58b3d45e-3b27-43f2-a9e7-bcd6ff1217dd", "value": "Transfer Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f714a7-f11a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655785867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785867, "uuid": "02e23a83-b347-45b0-8192-cb69bcb6903c", "comment": "Malware payload (Loki)", "value": "73d44faaec04ddf3b2022eb8012070d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785867, "uuid": "fa1a91a8-7a76-4089-aec2-d72485b103c7", "comment": "Malware payload (Loki)", "value": "9c07eb3951365acd0bdaea4b18d59bcab34b2e9a80a115ea9d50bb159aa3b9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785867, "uuid": "79fadc5b-71d4-42c9-b84d-d8c2fd734982", "comment": "Malware payload (Loki)", "value": "38565fbb033472805e685f0259cdd38d321c5653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785867, "uuid": "d86a3fae-5c2d-40a9-9f9b-26a1dc0a42f4", "comment": "Malware payload (Loki)", "value": "a15dfab63cf1cab1a651f412436557351b69d2bd322ffd1f9595cd1a1ded44b5f653dea2b2eb098d09356ba9cea66da2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785867, "uuid": "e778e27c-0e1d-4788-9654-7f22c4f5388c", "value": "T1EC04E11073B0D573D0B546359C3ADB7B6AA7BD2269109A0B27907F4C3C72A92C51FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785867, "uuid": "a273315e-ae20-454f-865c-b1ba1d0db9a8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785867, "uuid": "5abbdb0c-56e2-4035-9981-24ec357a3a1a", "value": "3072:gbG7N2kDTHUpou/Bwl/i4O9jboP88kuiJIm3bCXRGclk0ybdt:gbE/HUHBjJoU8uzCBGclmdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655785867, "uuid": "559d4a5e-5f01-4dc0-a963-d76e55bd1742", "value": 177952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655785867, "uuid": "c1720064-6a3a-4bca-8041-6fb9a0dadb4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785867, "uuid": "8817ccdc-84f8-408d-8cf3-dcb7d16ce38b", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.8472.9222.2733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c13e40c-f194-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655837923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837923, "uuid": "6b5f1a06-2dbe-485a-bf97-425d6f98f686", "comment": "Malware payload (Heodo)", "value": "ba7ca05b7a77fce110f4bfa33e528941", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837923, "uuid": "e9edd1c5-c6c1-4473-9906-552fb0f4cdf7", "comment": "Malware payload (Heodo)", "value": "9c534e3c75d80d8f3f16e0034b07d1014377bedbd57af465d787e902e746ec6f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837923, "uuid": "bec89911-9f20-4a1a-8bb5-c16cf9fda6be", "comment": "Malware payload (Heodo)", "value": "c5a7473df1bbc93d833b8b4c911ba8e089135045", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837923, "uuid": "82954553-6a6a-4861-a808-363a1d0ca205", "comment": "Malware payload (Heodo)", "value": "8481d12ea497b8b6ca67b31f6950dd92d7a382e5ea5d5a76e685c54c11d14bbb3dda389a19ef3f8cb092622f760364e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837923, "uuid": "d1844348-c954-4dbe-8587-c339249ac405", "value": "T19D64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837923, "uuid": "eec4edb0-7625-4242-9cab-1646778794ac", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837923, "uuid": "c9669a35-cc1e-4c3f-97fa-40131bdd3c4e", "value": "6144:3MiSTD2He3kjHfNsQnKzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3tNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655837923, "uuid": "974db2c9-ab56-4f0a-b4af-ab8182217675", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655837923, "uuid": "4f48eb34-de83-4a73-8b25-0b14345d7109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837923, "uuid": "1d37f72f-8e13-4231-93c0-77e78c66a5eb", "value": "ba7ca05b7a77fce110f4bfa33e528941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874f7845-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655835929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835929, "uuid": "17ce7c75-bcb0-424c-b15a-fc57f5359ad8", "comment": "Malware payload", "value": "71bff1bf8e679eda1d700ca37d2e39d2", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835929, "uuid": "a2cc8483-bf00-410e-8012-e9d9e396088c", "comment": "Malware payload", "value": "9c70db00982d802a7e76594c3fdfa8fb300a74dfea669caeaff8aa1a7cefd65c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835929, "uuid": "f1d328ea-19d6-4519-8497-3cfa7cc6ff59", "comment": "Malware payload", "value": "533a8c65b97206f979c5c5ad55b9dde52aa68e34", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835929, "uuid": "0dc73312-7806-437f-a610-e61a27ecc287", "comment": "Malware payload", "value": "f6ba0445aa93e5970e15d1823df12cb8df596790947b683c3da7d3a1f8aa7e029e8de0587fba8dfca062355f31e3d941", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835929, "uuid": "b2a65d1b-296c-46bb-98ac-b64f61aed7fd", "value": "T11F61093C55875C448361A539C97A9440ACB1CD93AA06C20E77CDF65A3FE038DDD978CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835929, "uuid": "f2c0c1a3-160f-4e8c-81cc-d4b42fb55108", "value": "96:zCEYugAuqvm8PWTg+h9BnXMNu1gg/oitcYX:DgGvsT/MNu1g0tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835929, "uuid": "829f7be4-51e7-4c63-bc12-a04ade03a60f", "value": 3180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835929, "uuid": "e197a915-6297-4554-a64b-777970a6cfc1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835929, "uuid": "7f5b5db5-9576-4bff-af89-50bf72e0972e", "value": "Scanned_985081690.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc68b7f2-f197-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655839508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839508, "uuid": "7d6104f9-af74-4da9-a858-ca474c181ec7", "comment": "Malware payload (Quakbot)", "value": "6a9d4ee8fe3917d9f5fad8380372637d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839508, "uuid": "8cf2e446-35fd-4a2d-94f3-c748e689c06a", "comment": "Malware payload (Quakbot)", "value": "9cfc5f8eecf8f5e91f6e7151f759f4708010139a2597b69a2d47ce24df97f74e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839508, "uuid": "40488a40-123f-4dad-bd6d-879c9ecff506", "comment": "Malware payload (Quakbot)", "value": "7b775e2e60c3e7413b07628608f59e1729669c29", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839508, "uuid": "e593940e-21ae-4e42-91b1-40eac4ac9b62", "comment": "Malware payload (Quakbot)", "value": "292c0dfb1728c942a25c70269416b4516c4b9f12c5ba75c29669f8abad5c8dc87ebebe6d356f30dcf1d3b3fe41812ea9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839508, "uuid": "0a11675c-910d-439a-8000-24a6c50667ea", "value": "T10EF49F72B3E04837C1771A7C8D1BB76898297D113E3C988A7BE41D4C5F3A78136A9297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839508, "uuid": "f78c9a73-88c9-440a-831b-4d61eceaa79c", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839508, "uuid": "0f3e4a4f-bcf6-4884-be73-b3d8c5aa6a59", "value": "12288:pSHEVZKP1O+hamzhv1fm3R7qxZF0WGNY:eSi7NvEdkeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839508, "uuid": "8c40fb5c-a47c-4adf-9a0b-f934dec54daa", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839508, "uuid": "eb810b18-b8a0-4f02-bcda-8cec8cbfde06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839508, "uuid": "010bc800-0773-4122-8faa-9817bcdea593", "value": "obama190.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a57c5b-f1b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655853529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853529, "uuid": "0e4806b3-aa07-4e62-9111-a33906d04013", "comment": "Malware payload (Mirai)", "value": "327cf719513c0124054752337bfe59f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853529, "uuid": "e05ea9a8-02ba-4c48-a33b-2daeef2ea208", "comment": "Malware payload (Mirai)", "value": "9d6319577d8130c24cbb035174894fe6cf56a31d8bfa2ad115a1b6271360d848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853529, "uuid": "e507556a-4213-4d02-97c4-a68666ce59f9", "comment": "Malware payload (Mirai)", "value": "110a4e2e71e6303a8bee338cfa307277fb361b23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853529, "uuid": "43ea63d4-5916-416f-bbaa-4bc7fdd4e754", "comment": "Malware payload (Mirai)", "value": "82462968a8f73d761a1aae8e5b0c7fbab5e98cf19afc1f8ba17be06b4e457a1a121e06a629ad2ad4e14e0cf4d71a57a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853529, "uuid": "c08c1f83-7d9e-4b5e-b847-ede5afef0b7f", "value": "T184B3BF5084A0B8F8C779993069E4ED3DCF87A24452131EF2AE0F8B9501AB7A4F157F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853529, "uuid": "7b65c5e5-3603-4442-9550-8214e472b602", "value": "3072:zhAmpInfX/0rvr02Ja9NnbAd3ZeceERBIdkF37rO:z9pInfXII2JaaCEn5rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655853529, "uuid": "922224ec-6968-4576-a4c7-f2d35b19de7a", "value": 107516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655853529, "uuid": "b06a1af7-4b44-4488-96be-780396cd0f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853529, "uuid": "38ae1e56-0b1c-413d-a033-2cbada4e2561", "value": "327cf719513c0124054752337bfe59f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540391dd-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655809644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809644, "uuid": "de4c4b11-c664-4a30-a4f7-8fe896423496", "comment": "Malware payload (ArkeiStealer)", "value": "1192652fdf3bb6a05003663be827d8b6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809644, "uuid": "02f0d94e-94d5-4d58-9b25-3159ce5b69db", "comment": "Malware payload (ArkeiStealer)", "value": "9ec16b7ad0ac9eb821c6c037451d127e652cde49c6881a948503bc98f5f51111", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809644, "uuid": "0af50a18-3d22-460b-aed5-92c4d80e165a", "comment": "Malware payload (ArkeiStealer)", "value": "0d7eb41d700f2885d6df1cef8ad4ccb52333c37c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809644, "uuid": "f4911602-6f95-439f-aef9-c9f93a71927e", "comment": "Malware payload (ArkeiStealer)", "value": "6c023d2d96fc39f0d96ca19e5fe0dc64401a38187cc42dbec0a3b1d07e8f4386127bdc6f7a175adad50c9f6eb8b65045", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809644, "uuid": "da1f017a-6ae4-4067-9ad2-6ecbd30f3d94", "value": "T1FA94CF10BE90D034E5F712F84AA5936CB93E7AE0977850CB92E416EE57386E4ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809644, "uuid": "6a705ff3-3fd7-4868-b146-104af1e26efd", "value": "aa1d842c09e4e41d9b0bfd7b3276b5b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809644, "uuid": "3850b6a4-a217-4f36-9ab7-875ccefa2713", "value": "12288:Z9QBwRE9p90rz62BrVL/nA6Kuplmm/ze:cBh390npt/A6lb/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809644, "uuid": "d2760014-797d-4595-8279-fa57f3e697cd", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809644, "uuid": "d3bf1126-7032-4cc2-8e48-cf53c981667e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809644, "uuid": "c733a302-a637-4e55-9adf-0df93e3c3060", "value": "1192652fdf3bb6a05003663be827d8b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e63b637-f17f-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655828961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828961, "uuid": "5d0e17ab-2bf1-4b77-91b1-1e562c85e0ef", "comment": "Malware payload (njrat)", "value": "f298602b915658f7de4f44ee1e321b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828961, "uuid": "45a5af35-ea21-4066-b285-b3f0380baa54", "comment": "Malware payload (njrat)", "value": "9f48ea81b204ce837648509306ab5153f952ad07ebd7d8e884de844a8f7910fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828961, "uuid": "e187ec33-16be-400f-bc89-fbbb74a54f1b", "comment": "Malware payload (njrat)", "value": "415e3b04704a3e37c5bc141e779c755828b3c0af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828961, "uuid": "aa300f11-f87e-40cd-bbe4-eb787d552cc4", "comment": "Malware payload (njrat)", "value": "c307d1bec71d3089903c442009ae4322e5b887dbd058338f3c04b2054578c3ddb7e2d8a8acc091415bcbbed046643c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828961, "uuid": "4390df6e-9389-4a59-a5f9-81f83fec5802", "value": "T1DC033A4D7FE18168C5FD457B05B2E41307BAE04B6E23D90E8EF564AA37636C48B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828961, "uuid": "9283c903-48e8-419f-b6ab-ccbb1716b351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828961, "uuid": "179bbc7d-2e4b-484b-a111-bb0b16b660d8", "value": "384:neAa1TgiG1CZZfursvO6ysz0dsf76TvMb8rAF+rMRTyN/0L+EcoinblneHQM3epP:eP1F5Wpsz0dsmbMIrM+rMRa8Nux8UPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828961, "uuid": "57e249c7-4f20-41b6-b55b-5c8eca5e2b35", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828961, "uuid": "66a3cbb9-b7ec-410d-b72b-c954534e8303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828961, "uuid": "cafe33c5-232d-4af3-8990-91476eb497f0", "value": "ratnik.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d02320c-f17c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655827590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827590, "uuid": "bfbb8d6c-1070-4fbb-af11-98a2e094d7df", "comment": "Malware payload (Heodo)", "value": "a47e5bdd1fc2ded9608c9c627ab2d47d", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827590, "uuid": "cc2bebc7-6a48-4d54-b035-0188148bf27e", "comment": "Malware payload (Heodo)", "value": "a051d201dc87b9301f98bd53de834d111e0d9d7edc325331ed75f1f3a5ef24fd", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827590, "uuid": "0776ca48-7533-4718-8f25-30863b3e56bc", "comment": "Malware payload (Heodo)", "value": "95962c0a49e35bf19b946d989eec3bc4d8c38df0", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827590, "uuid": "7b82af1f-7fc7-43a1-9b5c-ef09a9ace93b", "comment": "Malware payload (Heodo)", "value": "9882be92ea4a9eb7578ee5e0f52f451e8572b9fa0bf04cf988b5808ef8ab8bff411f84dd61727af8d4e9bdd0a741416d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827590, "uuid": "fd1f2560-c3bf-4bad-b2de-c4019b650961", "value": "T143648C0236A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827590, "uuid": "702364e6-57b2-45f2-8ff1-12163e96c7e6", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827590, "uuid": "c3f37e02-9844-4d8c-9f83-ce906eae57d1", "value": "6144:JqdSTDcHe3kjHfNsQn9XYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf39IyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655827590, "uuid": "93ef788b-a1fc-4861-a9c9-df10af9a6018", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655827590, "uuid": "fa4e4d6c-fd72-4a3b-ae28-abfc4d401156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827590, "uuid": "5b01c3b3-0e92-4842-a855-27f7a8b7c569", "value": "U0iQQGKsQEb.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea09c77a-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655831800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831800, "uuid": "4cbe7014-2370-4b08-9668-468fe3e1f611", "comment": "Malware payload (njrat)", "value": "208584960250a7cf41009b675815606c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831800, "uuid": "03aa2aa8-51d5-4aa8-acfa-eb4e2c84c48d", "comment": "Malware payload (njrat)", "value": "a0520a0faf43ae8e393534f6b3969ad4918813be0908135a28e0e186943010e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831800, "uuid": "fc2b6750-a1cf-462a-819d-2a41528ff2bb", "comment": "Malware payload (njrat)", "value": "ed5d8a948244056689656b9c17316fbf6bae4137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831800, "uuid": "df567f6a-6012-4e15-bec1-4c2b0999492f", "comment": "Malware payload (njrat)", "value": "2d5b312191e3baaa8f86cdc073d80c6480df5483dc4c4a066b6a42bb73ddf0fb4b040bc217af3f49b8992f3cd899948d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831800, "uuid": "f215edcd-ca2e-4210-92ea-4127b18d3438", "value": "T120032A4D7FE18168C5FD157B06B2D4120BBAE14F6E23D90E8EE1649A37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831800, "uuid": "6f8c8a7b-a319-43d3-a1fd-c9f7e9d62f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831800, "uuid": "0214f182-3fa0-45a6-8c4d-2d341969fcc2", "value": "384:NOick7sgwi+tx3+j/NSyszg8QPBI3mmTlrAF+rMRTyN/0L+EcoinblneHQM3epzF:Q5kQLCNhszg8QeWmBrM+rMRa8Nugi1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831800, "uuid": "fc7bea6c-8ff5-450e-b138-7849687dc445", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831800, "uuid": "b78ea45f-c4fb-44b9-a047-da78d97b30c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831800, "uuid": "e0003fdb-9d4c-4bb7-b110-ee8ad19b63a5", "value": "123.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201a2925-f119-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655785075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785075, "uuid": "65450a96-396c-4814-bc0b-60f862a76519", "comment": "Malware payload (Formbook)", "value": "9c51dcdcbb9a4cab887c3036bf8acea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785075, "uuid": "98401323-cf1e-4c12-8d6d-c1b7a9f37b79", "comment": "Malware payload (Formbook)", "value": "a12973c256e6565a0635fb0febaed5ed56f613d23b864df409f32f832a3af19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785075, "uuid": "777f1761-fbe5-4609-a2ce-e97fb729821d", "comment": "Malware payload (Formbook)", "value": "7f0a99049ce06b600a89516d77adf3649593be21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785075, "uuid": "4021da89-6d3c-4faa-98b1-ba227f5dd0e3", "comment": "Malware payload (Formbook)", "value": "bb4906addb5e087aaf08d6e465dbc43aa4ddf93c2d6f77113f8b815cb5e104561743977b4f40f18c4363914fdb9bc405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785075, "uuid": "38c66e55-f78a-43b6-9811-14d4c8ff8903", "value": "T140C48D9CB22C74DEC85BC2729AA84C64AB50746FB31B5117A1530D9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785075, "uuid": "07a8b5f6-1173-4eeb-b1b6-b587a97b5b2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785075, "uuid": "bb8935f7-fce7-48a9-baea-f19c3e53b569", "value": "12288:TkXCFZSlff5KqOX8wFNgLBNCRhYa0TTAZQ1Jqw/U1Ex:PZYnET8a8CRyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655785075, "uuid": "4d926f40-913b-47ce-afa4-639955210244", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655785075, "uuid": "df7d8340-ec2c-4c0b-a198-6ba4fdb899c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785075, "uuid": "6d05f6c9-a626-4af7-88da-b9521460b452", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8c9e6f-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655802516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802516, "uuid": "f06406ae-dff3-4176-ae31-0bb54408beb5", "comment": "Malware payload (Loki)", "value": "7aa0546815163ea1415c51507362e714", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802516, "uuid": "19bb62b5-163d-4ac6-9ba2-78257efa515e", "comment": "Malware payload (Loki)", "value": "a18a2724ef67ea73d05a221fd200096b85ba01592f21ced4e598cc14db9f1bf7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802516, "uuid": "6a825d35-ac3d-43b0-a2d3-005b2f48607a", "comment": "Malware payload (Loki)", "value": "0c2014edfc69b25562041a83d10deddae3fe58b4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802516, "uuid": "ed2617da-ca86-41d5-8637-d3575ece46a4", "comment": "Malware payload (Loki)", "value": "24b06d67b5750c449649d676f190c86122cd2d8c90ffb48ebd75f708f6d87716b14849fc3c58355d32b2e72b193920d0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802516, "uuid": "5e871d50-3161-4fac-864c-a9cc1e4b6655", "value": "T19F73D043E584D3D7DF9336F38880FA129968FC35BCE952089E463ACF9870E45C3A5A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802516, "uuid": "fb230f53-cdec-4ccf-96bf-00ba44883ac0", "value": "1536:GDI5xfqqnb5a4yAmHx3SuqwBBi0ytjSnOPnL0u0e7/tRrXvNsyuCuTOI2/7X:GDuqOb5a4Lm5c8HytjTnIuZtpXvNXuCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802516, "uuid": "e142564b-3d07-4254-b50d-320a63f99593", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802516, "uuid": "06af24d4-0655-4426-b08b-320d040fa33a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802516, "uuid": "c02c8168-1e74-41e3-bbee-abb284447d91", "value": "247878.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fdabb1-f199-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840004, "uuid": "8e3ea1a8-29ce-48e9-824d-db28e2f61232", "comment": "Malware payload (Mirai)", "value": "e960d574f01b61d0d89cf8e9f8481e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840004, "uuid": "64abe078-c6ff-4a98-9f47-b056c1167a06", "comment": "Malware payload (Mirai)", "value": "a1b55de595cfd0bb1cfbc5f890a0b2f94b19d4d3e9bbb470c412549508a91d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840004, "uuid": "21b0a33e-88d1-4648-ac34-4f274e173af1", "comment": "Malware payload (Mirai)", "value": "bb6a0a0d0e3a1e519f27b26b098e43e9ab9e0f8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840004, "uuid": "a36c6d9e-2932-4298-85a1-eaad5dc49fdf", "comment": "Malware payload (Mirai)", "value": "7e5c6748620eb2d431e5c3fabf6cfaa718fa1c2e1ce748b2ad28de88fd244fc2fcc1d8c9ad78c1d3561b2f55d96a6c39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840004, "uuid": "91d628aa-8bb6-4aa5-a74b-566e4e66479e", "value": "T10F2495553A22BFFBF1E8C77007F3CA2046E5259637A19745F2ACD7585E2428D280F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840004, "uuid": "64976bd8-251d-48df-9c30-a2debd98fab5", "value": "3072:li0TNUJss6s/OJx1TyZWkboK8QMFAzvRmLG8XYIS0Hrn05HU:linB6xJ+ZWSeAzvRmLG8XYIS0Hrn05HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840004, "uuid": "885e07a8-68c5-4ae9-b3df-09da026342c5", "value": 223265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840004, "uuid": "6719f1a7-c854-436f-916d-0ea5a191b882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840004, "uuid": "4b457522-9084-402f-b366-c851e31a0004", "value": "e960d574f01b61d0d89cf8e9f8481e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d76b0d7-f128-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655791701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791701, "uuid": "f60108c6-d0f2-4e05-869e-84505f19ea7e", "comment": "Malware payload", "value": "968477d7fc82cfcf3a126b229c810a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791701, "uuid": "7472f4a0-931e-48cb-a7e0-42acc5ed1a33", "comment": "Malware payload", "value": "a26a5841f101873e339f76c8577d262a8a0f626e1f964b8753040f3b4f61197c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791701, "uuid": "708ef29a-e5fa-45c2-bad7-0e6499965e34", "comment": "Malware payload", "value": "8767802faad38dbb3ac6086e173a83b70e1a0e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791701, "uuid": "252e4677-22a8-4ac6-bd95-f954bd0ed7bc", "comment": "Malware payload", "value": "b11dcff23b167b1b520e6b7d345522141b9638af84c838bf7cf7034e516505b8a87615dfefbaafa5a82e68f17d4c4bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791701, "uuid": "c20d5ba9-4a58-43c7-acab-34f8a2159f50", "value": "T16E64BF81785011F1DBF84172D16FAA2B0A269D3C46461E1763F0BDB63FEE2A3D52F621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791701, "uuid": "aa6900ba-29d2-44ab-8b58-20d3a1294aac", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791701, "uuid": "d07c8403-1597-4eee-8dde-4eaf1b432ddf", "value": "6144:FbE/HUaMy4gI5GC7CZ/MJQ93CQ7LfGMfNdIGakLGcEk:FbGMyLC/Ju3dCed8cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655791701, "uuid": "3d7bd75f-c47f-4d9c-8b58-ab5b68c18bea", "value": 336656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655791701, "uuid": "b78ddaa9-d0e6-4e9a-9b91-622cb65235d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791701, "uuid": "dd32ff68-e8f9-4970-bcbb-05c7e8685575", "value": "Demanda Judicial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3703d2-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655803807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803807, "uuid": "893a28cb-8418-49b2-b8dd-71e765a3dd75", "comment": "Malware payload (RemcosRAT)", "value": "d91edd7fd8dd4cb85f82afa717b43275", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803807, "uuid": "0386b9f8-36f9-4fc5-940b-a1794ed5f69e", "comment": "Malware payload (RemcosRAT)", "value": "a3418fd16b5a31086f9ce94a754fc1204eeea6efefa3de6ff5c169a6a9071862", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803807, "uuid": "25e4c1db-d384-4268-b7ec-86bae9711099", "comment": "Malware payload (RemcosRAT)", "value": "48999844bc023cc4b7a13d25be75060016f3f017", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803807, "uuid": "4f25697c-49d8-4c0b-a29a-f07a23a732ce", "comment": "Malware payload (RemcosRAT)", "value": "188e36dfe80dd8bf03510f1cd5bda4c0493403dead21a903b01e521a80af17fb54b573ddec388804038e281f3aea5572", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803807, "uuid": "ae89aa48-97d0-4fb4-9fee-cf1f9638c4b5", "value": "T1B855F6318508B82B9EDF1F8724082FE37CB408FFCE992154D14F37AAA9645765C7AE64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803807, "uuid": "5e8338b1-a9e9-40f7-a0c1-94284262b406", "value": "24576:vr68XziHdTZieGGIQc8paqZS48CUJK22HNlrFqD9:VivMQ58W+hiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803807, "uuid": "903ec09a-87ee-4a73-8cfb-99efbd5710c6", "value": 1320556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803807, "uuid": "d6c08be2-2a0f-4aed-b024-5bdd26ceec73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803807, "uuid": "7a71ed0e-5707-4507-bc84-166c9c0409ea", "value": "Tax Challan.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee01145-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655823191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823191, "uuid": "9d6f3ce9-1091-4e62-874f-e9dbeeded609", "comment": "Malware payload (Formbook)", "value": "7ce1eacdc9623f88184c21c0ded22843", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823191, "uuid": "743af7aa-7b46-4a7d-a0a9-72154e70c358", "comment": "Malware payload (Formbook)", "value": "a356ee0be15f6a96b2176ef792f7da05dbe83bb3a8cfe3c31ba13d5402c5e638", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823191, "uuid": "c7560c16-e4a4-496b-ab70-90b04416a264", "comment": "Malware payload (Formbook)", "value": "c0ce2e493cd2e59df8df579e3fb6f78f40addb90", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823191, "uuid": "8631c4f5-4b15-4144-8c4f-cb1b06801aee", "comment": "Malware payload (Formbook)", "value": "649917d4d4ba63a6ce3802b2484d06f266bff4fa64d852814af7dab7c781091b0552f3ccd07aff209dec62909c9ca413", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823191, "uuid": "fa4620d9-d564-4e55-a14e-0e7e5905d1a5", "value": "T18683E1EB724459B4F4F163B458A7809E0F133FA97244A89331E43B1A4776F4C34E9AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823191, "uuid": "d4bf4170-e0e0-44cd-b6e1-e80750eabdd4", "value": "1536:shWp5YCtVFZq+NTUvyFj2vg9L6NScw+Bw5RB11cuO4YX7o/lOBORY:skpyCtDs+2aFj2m6NScwMCPZO4Ys/lO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823191, "uuid": "74757833-47e2-4c6c-96d3-70fa92bf2876", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823191, "uuid": "804ccb18-4cff-48b7-8219-a3dbdcaa0c94", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823191, "uuid": "91f74440-a755-44db-a0c6-0f34dbb763e8", "value": "Shipment details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cf5024-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655830239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830239, "uuid": "e8fe6eab-7741-4749-a9ea-15dfb71179a5", "comment": "Malware payload (Quakbot)", "value": "eb3c3444fbcaeed6902e9bf50ee10d47", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830239, "uuid": "480af4fc-9e4f-4526-89b5-49f668b553d5", "comment": "Malware payload (Quakbot)", "value": "a36c0298f193030753cdadef0a7f78afb02f25244d6ef552bd4afaa4550a8254", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830239, "uuid": "29b2ecc8-6b6b-44bf-b691-5572170b1fbf", "comment": "Malware payload (Quakbot)", "value": "cbca482150c3dd28031f7c223a9823c2fe6b6d8b", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830239, "uuid": "f657eaed-92bc-4f28-a652-eeb0617d6d6d", "comment": "Malware payload (Quakbot)", "value": "4d67cb08d466641f0999408ab83e55a29a58ed552daff34238b0470bce6adc7a51b6f306331a2cd3012b5f3ecb63282d", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830239, "uuid": "467a0cb8-d822-4748-baaa-7db635c0885e", "value": "T110F49E72B3E04837C1771A7C8D1BB66898297D113E3C988A7BF41D4C5F3A781366A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830239, "uuid": "739e8925-a135-4680-8387-5bca76ba8793", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830239, "uuid": "c3e8bbb1-3ca0-4fdd-ba86-32d7567fdc12", "value": "12288:0SHEVZKP1O+hamzhv1fm3R7yhZF0WGNYW:xSi7NvE9EeYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830239, "uuid": "5d4eec80-0558-461c-b741-b996d1926ab0", "value": 752129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830239, "uuid": "f8b6ae4d-a2b0-474f-a3d8-bdfe640f0e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830239, "uuid": "b45a45a8-7180-42ac-97fe-f2c174e30acd", "value": "a36c0298f193030753cdadef0a7f78afb02f25244d6ef552bd4afaa4550a8254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97155c2e-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655823070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823070, "uuid": "c7c93c3a-e47f-4036-9f3c-f80f15f6eb07", "comment": "Malware payload (SnakeKeylogger)", "value": "05c52d6ebaa3956942b94901d1658dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823070, "uuid": "f818a02d-e32c-4eb3-829b-5faeb46c2a1d", "comment": "Malware payload (SnakeKeylogger)", "value": "a3a70532b005564bebcecd911383b2664805178a98dc28d20044c4e6e710995a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823070, "uuid": "b64e4fd7-b35a-437d-9651-354b21d5266a", "comment": "Malware payload (SnakeKeylogger)", "value": "70fbe66b84abae8966e6a54978941f8752dcb070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823070, "uuid": "ab99b7d6-9776-44bb-8673-b6cd11432feb", "comment": "Malware payload (SnakeKeylogger)", "value": "071dec92525443c04ab7825f208d099ba3b6c1dadaaa9d5c49785bc50000463463b7a6eb32f5a8e8b2d6c2401fc9b9f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823070, "uuid": "8adc241c-29c1-40c5-af00-e9f85705ea8d", "value": "T1CEE4BF643A5CAF50EA7EC77D1161812053F0A85FF763EA1A7EEA14CD5861FC85332A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823070, "uuid": "f3475286-637f-4849-8cc2-36728d0bcc2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823070, "uuid": "f313efdf-2c3c-4e4f-80b0-192cdb6fe24d", "value": "12288:nyWpnKKIKoPuJI9utANx46XDenuxCmy8iG8w9y4lJTsDv2iNPf+B85FrkbgD62YR:xv1B+B85FU2midpNqVcrTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823070, "uuid": "bc7aad58-e498-4413-88db-995638afe93b", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823070, "uuid": "249b53d5-6d60-46fb-942c-d8f475c613a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823070, "uuid": "e3482d98-92d2-4506-a3e8-2ba7cf04b1f3", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6da1aaf-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802535, "uuid": "51c4c540-eb6c-49ca-8307-3829568a47aa", "comment": "Malware payload", "value": "d54b92f364fafc14696e85f94a36c9f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802535, "uuid": "423e969a-7978-4d06-8e06-b7569a311d13", "comment": "Malware payload", "value": "a434013a20232375a9a46dcc6629ebedb01fa130e73e429848ce7d14449c628d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802535, "uuid": "a73b3ee3-d53d-4e0a-b087-38883b59510d", "comment": "Malware payload", "value": "75bc2df9881ea2e251665a79f20c232ae27981dc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802535, "uuid": "df0f5d96-e4dd-48c2-8bf5-917599139a50", "comment": "Malware payload", "value": "996b01bd7bf44ecf34d732fdcb0e70264c64953891f9e0f249b6cfe7e43a68127d06b241c2c82499387c93c69f5e057b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802535, "uuid": "556d3e31-6079-4ea5-89e2-967ab658c27d", "value": "T1C0412CC7109606F36C90D937336A5480B5E1E196A4CA6F46AEDC3CE54CBEDFC79446C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802535, "uuid": "5d406e16-b011-4cfa-8304-3e6ce8d916fb", "value": "48:vid8jVttQdMsYzRx76T6oC0IvL1N5N0I/x+T:vid8jVttQdMsYzRx76T6oC0IvBN5N0Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802535, "uuid": "3a37a328-bea6-4785-a7ef-1f79a65205e0", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802535, "uuid": "b6c15ca0-2133-4e64-aa57-4f66668ef4e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802535, "uuid": "c63acc3f-18d2-49fc-ac36-61dae4d1580a", "value": "brokeskid.sh.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8737fea5-f147-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655805005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805005, "uuid": "9dc702ba-1ba7-4cc3-b176-ece62c283f3f", "comment": "Malware payload (Mirai)", "value": "1515c4edc47e4cb24c96a54de392f7f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805005, "uuid": "86b8e621-6f51-4af9-b040-537a0afb523e", "comment": "Malware payload (Mirai)", "value": "a4a2d1c4fc47ba8e8d6ac39ec53395a8217b3285cab8239168331e9fb56a7ad0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805005, "uuid": "5e43360f-a65b-4679-90ed-d92d9c7142e8", "comment": "Malware payload (Mirai)", "value": "da1201c3e48271b20a0bca4cc4f099169dc13c4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805005, "uuid": "49cd437d-37b1-4500-8d22-cf6e927de672", "comment": "Malware payload (Mirai)", "value": "b26be58e27366cf8aa6d5de637ed1a5585191bf3d4915df7949a2858ba67fca30fd64e92d0bfef1f9cca1868358a104b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805005, "uuid": "e88a9cba-6f3f-4e76-a43a-1ff342e54797", "value": "T1ACC2F16421489A74E47044338BA4CD53B73B8E75DBF5B2A20B5C8BB49047483E9F0AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805005, "uuid": "7d0c50a3-7436-44c2-a6a0-532cb44eddcd", "value": "768:yF+B2oXXjcUzXbrCc3RFGlrpxKms3Uoz/:i+9XgWbd3qppxoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805005, "uuid": "d5cd2f6e-42b1-4129-9db5-eb3d2e26563d", "value": 27700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805005, "uuid": "113e5d22-bf34-4f02-8731-a527a907314f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805005, "uuid": "2857e09f-973b-4919-8524-995e90114a8b", "value": "fuji.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc1a0b6-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802362, "uuid": "aff634e1-feeb-4b06-8e37-2be0d1e98c6d", "comment": "Malware payload", "value": "f725e066ca59a4ce035bfbebac204bc2", "object_relation": "md5", "Tag": [ { "name": "Discord Token stealer", "colour": "#D4C788", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802362, "uuid": "1384b224-c219-49cf-bcda-c6ace6c78d4b", "comment": "Malware payload", "value": "a4cb09f588132226fd702a06daf58696590df6136d6c50cb90fa28874b6e6b88", "object_relation": "sha256", "Tag": [ { "name": "Discord Token stealer", "colour": "#D4C788", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802362, "uuid": "33a128b9-4010-493c-849e-fdfc3ba1491c", "comment": "Malware payload", "value": "297483f60837678729ff2d35247b80045db05374", "object_relation": "sha1", "Tag": [ { "name": "Discord Token stealer", "colour": "#D4C788", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802362, "uuid": "f50e8ff8-4742-4400-ab94-6f373d8c1fc2", "comment": "Malware payload", "value": "a03376cfb2b0ae2fd1c231f09887c7e8b4b0d774512e9d4d4aa42d727333bd91c10fbad549036b3580ea5ae49cd513a6", "object_relation": "sha3-384", "Tag": [ { "name": "Discord Token stealer", "colour": "#D4C788", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802362, "uuid": "f924956e-474a-4d14-bd00-27cbd882ba0e", "value": "T10194349D726072DFC857D472DEA81DA8EA6174BB931F4203902715EEAE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802362, "uuid": "b80c65da-0d20-4eb6-9a8c-2d3a1b3e950a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802362, "uuid": "1258227c-388c-4d74-9e43-5b3f23c1e8a5", "value": "12288:IHFh9UtMJST01plxQTJMOY8cMjbHNs7DhZm9Yqf6lioHxSllQEeRCZ/QOZccwIie:ah9GsSTYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802362, "uuid": "7964f558-dcf9-4176-b33a-bdad1d51ee8b", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802362, "uuid": "78a3f4bc-6bbf-4f27-9e71-2f1edd916d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802362, "uuid": "a6ad880d-b31b-496c-a345-01c2dcbf055d", "value": "build.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18048544-f138-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655798376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798376, "uuid": "09b9e632-8435-4c4e-9e3e-26971953c007", "comment": "Malware payload (Formbook)", "value": "069b35a3b7caaf656b30b6a2e8ec004b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798376, "uuid": "c9e9fcd6-f38c-4da5-a653-4dd78d1c502c", "comment": "Malware payload (Formbook)", "value": "a4d4881fbb39f3c33e4cca9b4b3d129e8dec8033cf37fb291eacd909e40bab80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798376, "uuid": "8c417836-3c63-4afb-a702-53d8c44fc132", "comment": "Malware payload (Formbook)", "value": "41e3c2fbe92986681811d0ae1e18930d3da66c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798376, "uuid": "d152b43e-b14e-4eae-8678-4643196fa287", "comment": "Malware payload (Formbook)", "value": "7875751d7f911f4823681be0101eed46300272611caf4d7f4eaf008d903973c1be32d81c9b68c85bbdd849ab6435d578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798376, "uuid": "35b97a20-ed9c-4feb-af34-76f8894a1c31", "value": "T148E4F1F48FF4BA62E065227734A1603C7BE35D1DEC11A53BC69BF05A34A2AD115E0E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798376, "uuid": "41f7f851-0be6-45ff-9e0b-f1e87c06f5b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798376, "uuid": "53bef288-f3d3-4412-a94e-a3b35ac5e8e6", "value": "12288:VBv87lK/460sEZTFIpm304QaY88hArgz5ZLPqyigEIgI8cIjU9l0H:vv87l1taU3EJ88hArE5ZLP2Ib94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655798376, "uuid": "968bec7c-e2e8-4e97-9a56-78b5f9eb9da1", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655798376, "uuid": "735e5ba1-dc62-4ad4-a1c8-7fa8f7251cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798376, "uuid": "375eb2f1-0c0b-44a7-86b7-03f63de0cf71", "value": "\u0422\u04e9\u043b\u0435\u043c\u0434\u0456 \u0440\u0430\u0441\u0442\u0430\u0443.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c2c08b-f154-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655810554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810554, "uuid": "06b88f28-292d-4f11-973a-d9342ddb153b", "comment": "Malware payload (NanoCore)", "value": "36479c341b1fd3e88b97800c781896be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810554, "uuid": "3fedc1f9-0af0-4f54-9bd4-430c3b37a322", "comment": "Malware payload (NanoCore)", "value": "a5f5c1a21c06fbe88875ced3d13c1443bb522fd6866a2f02a3dbf95abc9781a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810554, "uuid": "e79ebadf-4d3f-46d4-8e41-b22e22fd95a5", "comment": "Malware payload (NanoCore)", "value": "54e24b26a0fb49c34ef5b2a9c57fd55d7dacf61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655810554, "uuid": "c928524f-bbc6-49fe-9179-e6f68242cee4", "comment": "Malware payload (NanoCore)", "value": "a57045a0847003d34ac54b6a3d773fd817c4898bd7f2da26939661199ec7af793101428675858eff4520405684161e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810554, "uuid": "b935ebec-fc87-4e3f-ae6c-4e325d24b276", "value": "T1DEF401F0DEF5B91AE12631737061513C3BE25D1DCC51E939DA9BF08A38A2AC660E5E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810554, "uuid": "22e31efa-64d7-4e01-843a-8fc09c474b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810554, "uuid": "3d3216ea-1ed0-4da1-b770-4ea9c4f28423", "value": "12288:RDvURTuHDmLqZVITwfJFaJlAoW9gtQZqm8h6QJVgxSGej3BdBgMNC:FvmcvZi0JFaJlJigtAqm8hnJVZ/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655810554, "uuid": "e8c27883-bab7-4469-be85-e040d33d20dd", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655810554, "uuid": "64773cf1-4444-4d6b-94ab-5583c6c84f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655810554, "uuid": "8e4daad1-cb89-44f6-ad97-14b3ad98de14", "value": "36479c341b1fd3e88b97800c781896be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c10bbd-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655841746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841746, "uuid": "d9602ca2-6097-4e17-88c3-801c6f698cac", "comment": "Malware payload (Mirai)", "value": "0ee785fab84761297363769b9fc2ff76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841746, "uuid": "85003efe-4fa0-42d4-a4cf-a2fcfa5395a0", "comment": "Malware payload (Mirai)", "value": "a6336689695deb43c3f1374b7da55423bcecc15587016f0566306d1a5054ecb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841746, "uuid": "cfad5fb6-0155-476c-92dc-825499acc697", "comment": "Malware payload (Mirai)", "value": "c0f87f26a3c2a5ef801c4bf8fab688da652e137d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841746, "uuid": "415b6b04-b2b9-4cb9-bbf8-f714865e44c1", "comment": "Malware payload (Mirai)", "value": "be208697331b127dd87eab6489ff8d4cb7da4f1b15d278c9dc461241dc70b0cb200417a39bd4be20fed95de328221028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841746, "uuid": "4c9139e2-d9ff-4c79-82c7-d22d91ae79bb", "value": "T1D9C34C46EB418A13C4D51776BAEF42493323E754E3DB330699186FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841746, "uuid": "3730833b-6272-4848-b9fa-99ee84f2df7f", "value": "3072:x2ywxneKaYcav6ucJAs1R1Ob+aSHxVMRj:x2zneKXJv6ucJA0RK+aSHxVAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841746, "uuid": "e4666649-8698-4869-88ad-957e07b021e1", "value": 127636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841746, "uuid": "c36e811d-0621-499e-903d-3500f70806ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841746, "uuid": "68639189-a59f-4145-a89f-60041d23b3a9", "value": "0ee785fab84761297363769b9fc2ff76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8284432e-f1b5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852242, "uuid": "72f3f526-ccf6-4597-b830-abcaaeb94fe5", "comment": "Malware payload", "value": "80052f996e66b21fbb57357d8d9841cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852242, "uuid": "fc6a4c64-0e23-41a1-9c44-a55cf490da97", "comment": "Malware payload", "value": "a7250f3f79e7e327cfc7ac2aa8e375721b87e82e2eef4860b7cee26b42ce83b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852242, "uuid": "53a84326-a157-4c79-b687-3a0f7075c25c", "comment": "Malware payload", "value": "d990e35650e650c612b7d65af8e3e811e1962a7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852242, "uuid": "6128fc23-8268-496d-bc8f-51f44807f352", "comment": "Malware payload", "value": "97b690a428186757dc343448392ffe68239e28a6baa2e00be1d0692a664649d26306965cad49dd830793ce56ce7feaf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852242, "uuid": "7f7bc013-03c5-4eee-bdd3-ad693364e384", "value": "T187648C0236A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852242, "uuid": "095c5b4e-a17a-4b45-a4f7-23e072831454", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852242, "uuid": "e6e9dd06-246d-4cc8-a3d8-e1da97c968e5", "value": "6144:JqdSTDcHe3kjHfNsQnaXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3aIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852242, "uuid": "0b8864db-42f9-4c45-ab6a-a5d56e73cfd8", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852242, "uuid": "b1a45f3b-3e29-4ec7-baa7-070cd78b4b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852242, "uuid": "f4c32761-d518-4337-b6ad-0b848c2a00b1", "value": "80052f996e66b21fbb57357d8d9841cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4ff208-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655823561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823561, "uuid": "85d0d5fe-e359-44e7-908b-2864705daa8c", "comment": "Malware payload (Formbook)", "value": "48d4eafd1412fe11e58cb6778be9a6cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823561, "uuid": "88e222be-3338-4cb1-a766-2b4f9b6031fe", "comment": "Malware payload (Formbook)", "value": "a7492a3e2caa18c09290209462772d7356966ed9fe91f86830284d950604b300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823561, "uuid": "cdba066b-7bf2-4d1c-98b6-d39e87eb119b", "comment": "Malware payload (Formbook)", "value": "4df1a667d1c7de90a5492146b92ffbb667d689a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823561, "uuid": "c2eccdc1-d75c-4cd2-9b34-ad090ac293a1", "comment": "Malware payload (Formbook)", "value": "61ec095a5fc15df7f69ea624fa4451a3bcbe75f727023922b7f6f1198cf581940e5bffca5bfa71aefb471d6e512b9ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823561, "uuid": "4da17370-d305-4ca7-aba0-3718c766fefc", "value": "T1F554D02BB7988B00C4592576C4EF043013E9BED6BA33E3753E4D6BD85D423A29D0978E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823561, "uuid": "af93bd7a-8a60-4887-a979-73571ce39d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823561, "uuid": "50cff408-8fdb-4e28-891f-1b3bcf21aa1e", "value": "6144:F0Pd+AtHQkX9olfs+HvJ9WlNHblt5fkR9lVmUIynrbDSrFYE:q+q59oNvnWlNHpvfkPD3DAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823561, "uuid": "025f928c-e9ba-48b6-8060-19a1038da68b", "value": 291864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823561, "uuid": "fbb78a87-82c9-4eeb-8e14-47bdacf48db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823561, "uuid": "862b88d1-1f18-4276-a069-4c7daa0c8026", "value": "48d4eafd1412fe11e58cb6778be9a6cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b127ccdb-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802498, "uuid": "5bbc08a6-0c55-4dc5-a056-37f4007957f3", "comment": "Malware payload", "value": "ed50508fb37851b7145c85231d5b8e5d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802498, "uuid": "ef94c1df-783c-4378-8e87-34bb679653f5", "comment": "Malware payload", "value": "a7b131be5c8ef7e164f4e9916f455aa51918cee5740e846c50d51dc2a55c5d34", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802498, "uuid": "69b8c88e-86df-4fac-b999-535501766898", "comment": "Malware payload", "value": "66832741946713a7e74a55a6ee43ca506b70f968", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802498, "uuid": "2ed168bf-1a98-406f-b203-021b4c76f91d", "comment": "Malware payload", "value": "916d023592731e7ed48ac939ad3853a7213132fce6238cb4f6c0963d9bcf79323258ad2c2051692ac04c725a1a120001", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802498, "uuid": "cbd9fc4e-4e24-4b4b-a4d5-e38c4844b2ee", "value": "T16E83E01E0B614708F1F78B3BAEE3119C5F274E14A96D8C962133F6682F754B13960A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802498, "uuid": "32387034-315f-4da6-aa05-21400875b407", "value": "1536:cjeC8T2J2jPyoz3m1Yq/CbEIgP4cjbirXd6oGz/1XwX80:c92y22S3mu6V9XjatG/FwX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802498, "uuid": "bfacab91-ce6e-4fbe-8a99-08c65aa596cc", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802498, "uuid": "22be3336-2159-46b2-9e53-d935c4c59a33", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802498, "uuid": "0468f105-3305-4923-bea0-3979856b798d", "value": "invoice 220096.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1676d93-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655842066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842066, "uuid": "1f8aec35-131a-4085-8a54-bd1be4811db5", "comment": "Malware payload (Mirai)", "value": "7d81490f9465f8564580469ce456dd73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842066, "uuid": "1d56faa0-f844-4f0c-af3e-ccb9ba1d1b0b", "comment": "Malware payload (Mirai)", "value": "a7b92af86f644b035af3c707cc44e7688000d0b4f8ca9214631c9f6eea6f0a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842066, "uuid": "0542273f-fd02-4b82-b065-f0d4f14fa58f", "comment": "Malware payload (Mirai)", "value": "ad89e96160bb878c3a3fbf05774acc0f71838479", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842066, "uuid": "ee67cd2d-a0df-4487-bec9-90e6cf82bb0d", "comment": "Malware payload (Mirai)", "value": "caafef24451a4ece9e5cbf0f0f8e2b0bdbb666236a225839fd299857cf73a97499b42ebbe28b90e06ec67a4c3ce88c10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842066, "uuid": "54b9a277-ae5e-4638-ab68-4d62bfa6be24", "value": "T171637109BF614FF7ECABDC374AE92705208C681A22987B397934D818F24B25F15E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842066, "uuid": "bfdf62a1-a775-415f-81c2-7cb1f50c27cf", "value": "1536:fUAYr/8Xm8e4JHFdh9qCetEiD9uZeRpN:fRYr/8Xm8NFm9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655842066, "uuid": "ef4417b5-d8bc-4d56-a6fb-6f4914414728", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655842066, "uuid": "c8e215bd-6175-41b5-94d4-e48c28f05900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842066, "uuid": "59cbdcbd-4ab0-4580-bb2d-64b167757411", "value": "7d81490f9465f8564580469ce456dd73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715ac65a-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1655809693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809693, "uuid": "f9cf823b-0035-4ea1-bd3d-4a12f586e0a9", "comment": "Malware payload (ArkeiStealer)", "value": "befcb6eb1e2091b9c4a293ab3d09851e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809693, "uuid": "b0dceb15-8ae9-46ab-bab6-d6ea4731b591", "comment": "Malware payload (ArkeiStealer)", "value": "a7ed18dec986fb690b05a49d850de5cf8d51b21290f6fb13b8b7efc82374b185", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809693, "uuid": "40028586-d035-4511-8909-51f4a066b424", "comment": "Malware payload (ArkeiStealer)", "value": "89e9c2d78b869035a775bb590b46e5a7371f4d09", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809693, "uuid": "6ba0a378-cb1c-42c4-9bf8-8e0a8d9a9843", "comment": "Malware payload (ArkeiStealer)", "value": "01311e63f65392231ff5704751496414ffa31b5ad75972a07a633ff07d8e950468eabe3deb841a82ee4e71ee218ed108", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809693, "uuid": "9052e7d3-4e1e-4308-891a-06dc8aa3aa18", "value": "T1F894CF10BB90C035F1B712F44AB683A8BA3E7AE1673451CB52E566EE47346E4EC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809693, "uuid": "d44b8667-5f2f-4d2d-9a71-ee74e7edd456", "value": "6f4db70820333494fa9bc104e010dc8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809693, "uuid": "38dd3f8f-b26a-4358-9505-c7e8d1fc9603", "value": "12288:evbP4F9bZiG1OOnpf2PP5IMnA/xxfeZS/YYb:yPYEKzEJide6Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809693, "uuid": "10f31f16-de57-4024-9d9a-31d2d10686c9", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809693, "uuid": "6cf6a91a-67b1-4aeb-9bda-a3adb7db8e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809693, "uuid": "e6c3ce9d-7498-4b07-b5e5-b27f82a86b79", "value": "befcb6eb1e2091b9c4a293ab3d09851e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd42fca-f185-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655831806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831806, "uuid": "54ddefb4-14a3-44d3-8f61-a9ce5050eca6", "comment": "Malware payload", "value": "3856c8bee85c897e2b44b0a6a6f31a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831806, "uuid": "6a53fc79-5f03-4361-8f7b-5ae28eaa76b3", "comment": "Malware payload", "value": "a88a57b5d6b0194ecf94b387e181f089dbbd1bcc321a14184e3936ad43a82db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831806, "uuid": "7464a231-c974-456d-acdc-b483fd9d1de3", "comment": "Malware payload", "value": "3c8d8410da54e1f638c0582f2a7896f7f937831a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831806, "uuid": "1f023fda-9efd-4154-82c4-932a12b7ac47", "comment": "Malware payload", "value": "69c007a751f86041217e327f2d0dd811e3d6363cfa404d391d55f613e54bf6087fe31f94c51af0670e80fa1ea2e9734d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831806, "uuid": "66d88310-41f5-483e-bbb5-24b16f93f2f7", "value": "T165E312C22FC09DB5D81C093323BBE335B80B84D855EA058F5EB69947B9B3D452BA0477", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831806, "uuid": "a67a7dc2-3f5a-4133-9d2a-2d07eedb2919", "value": "5b6330039d671f450bbd3733a0ea129b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831806, "uuid": "0bb30d87-2bc4-4335-bd07-1ead89d8a594", "value": "3072:DnnHXaXeQSyqNRRueuJcyDd30K64o2h5UVIuYzeiYYq54mDOB9S27cUnDCNx3:DnnHZpy0x+dEooO5uIufNUmDO37bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831806, "uuid": "b6be91a8-0ca0-4ed9-baad-b8ec9742199d", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831806, "uuid": "e4f014f3-4494-4a3f-9a73-54bc075908d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831806, "uuid": "0a984ca1-287f-41fe-af4d-7e1fc96b6568", "value": "Broken_rainbow.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c1860a-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808200, "uuid": "48cc1b63-676e-4331-95c6-1cc6b49bcc28", "comment": "Malware payload (RedLineStealer)", "value": "42ca0faad1d7138fa5d0ff239044dcfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808200, "uuid": "876fbfbb-05f4-4a6a-a7b8-1737c10e3130", "comment": "Malware payload (RedLineStealer)", "value": "a8a3659cec7b592f5410f23735fa358c2e3c5f0e77607eacc5ab5ec8a32dbb6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808200, "uuid": "d35335b1-09e1-4a20-bf0e-c133d38b114d", "comment": "Malware payload (RedLineStealer)", "value": "b21ecb7fd8b8aabf80b31d21185297914cab7296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808200, "uuid": "56a27ad4-abaa-4ae8-88a8-e8966d101c50", "comment": "Malware payload (RedLineStealer)", "value": "9046a36077f27c1151f4ce831c72c08692963e3cd0ee7819915efc0bf5ff9d6b2042a5867354a9ea18b7821312985710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808200, "uuid": "0c8c09ab-b241-41db-ab2c-618eb32cc75c", "value": "T124A35D20679C9F19EAFD1B74B472012043F1E08A9091FB4B4DC1A4E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808200, "uuid": "7d760e3c-04c0-4f15-a787-edf3a1b77cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808200, "uuid": "5eadeb15-18dd-45b4-a152-784302a7fafe", "value": "1536:5qsIOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2vteulgS6p8l:XTuOYj+zi0ZbYe1g0ujyzdT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808200, "uuid": "8d37eede-2b1f-4069-97aa-80b02e60553d", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808200, "uuid": "726c8fd0-abde-47a2-8d3a-85cb8bd69bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808200, "uuid": "c6dbeb7f-d0a8-4e50-b618-d17b5b0a384f", "value": "Pandora.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34a7564-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806797, "uuid": "c0f2b2e4-420a-4f52-a852-d28555f0f1f5", "comment": "Malware payload (Formbook)", "value": "9e1bb80ff1f6f5181ed26c62ef3de29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806797, "uuid": "179dd991-5bd2-41e8-b18c-27ff577dd9b2", "comment": "Malware payload (Formbook)", "value": "a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806797, "uuid": "12d7b445-498a-40de-9a59-83cdbc88a5ee", "comment": "Malware payload (Formbook)", "value": "5c37096275b5947dfd68ccacc92eec204fa73883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806797, "uuid": "27f58235-a20f-46c1-b4f2-581aad1d1eff", "comment": "Malware payload (Formbook)", "value": "75b89534b5e1d2e18762e3eaffc82206684b2752423055a968135eede49ee734abf916825ecd526cff495f1d0ff19e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806797, "uuid": "076243f3-fb5b-4791-814a-4f4bcfa02da6", "value": "T136A4F102B9B95B1ADABA97F55B67008507B135AFA271F11C4CCB60EE2876F140DA0F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806797, "uuid": "8b5ef492-3666-4d15-84f3-69615d43cc57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806797, "uuid": "f3472abe-8ef7-4aca-8898-50d0ab3cc406", "value": "12288:FSFkeBazcQyiGNit5p0X3XXLhJcHMTdWKG5V6e7pe:fsiUI5p0X3reMTdcme7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806797, "uuid": "205d342d-dc07-49e2-9ea4-509ce76a8bf6", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806797, "uuid": "f831b4e4-7ea7-42ec-bda0-c1c85b36ff41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806797, "uuid": "544a0fd4-6d3d-4123-95ce-604c9c547f6c", "value": "bis.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04589cee-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801779, "uuid": "95c77877-aeb5-48be-8ddf-27f5faec173c", "comment": "Malware payload (SnakeKeylogger)", "value": "9689b9c5a9eb3d33d8b719d47093b33d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801779, "uuid": "4ffe3073-0d2e-4168-8d02-5f0f9a71f8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "a93502a8654734c44023bb51f0534bc4e4825e6cf3ed471c4c2a6dd079e473e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801779, "uuid": "ccc73947-bfd2-43a8-b276-17941d80cbe1", "comment": "Malware payload (SnakeKeylogger)", "value": "9f128ea3f93a5b29ce0730cf0d11118191b77686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801779, "uuid": "27d3e460-d92c-49a0-9fb2-1332402ec116", "comment": "Malware payload (SnakeKeylogger)", "value": "a4c0553326d14a5b5dcefdd46eeb024693797964d66b2a04cd1bcb7a23b58921e316080a644b90111e0649904c76b02f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801779, "uuid": "370104c1-94d4-400e-8304-dd434aeddb86", "value": "T1C5D4F1F18EF8BA25E12932B770A1613C77D35E0ECC55D579CA9BF04A3852AC160F1A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801779, "uuid": "1a43fc38-4cd3-4e6d-80c9-537d04170046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801779, "uuid": "58f0230e-ae83-4ac7-b9ea-8cf9f423a420", "value": "12288:FEvnfpFjb6PwPv7x6TZBrFTjcIX6gLEJ0uXtLNvzjzP:+vfbb6eOFTjcIX7qtL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801779, "uuid": "a54c8402-21c6-4a9b-8e35-66a9c720c7a0", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801779, "uuid": "e38caa22-497b-4d39-838a-8f857c418f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801779, "uuid": "e86c0fba-5e77-4cbb-8d60-5b837c7bb0e3", "value": "SKM__C20192910887888001990.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60751124-f1ad-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655848749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848749, "uuid": "55b16453-7ef4-491a-8ae3-75bc0f6c905c", "comment": "Malware payload", "value": "75ab938481111c38aeb1aa760be209a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848749, "uuid": "a9a22bf5-2ebd-46e0-abb1-d12681bad53f", "comment": "Malware payload", "value": "a93b818ad555cc3563b4e5aefb1df7c34051e1dd99df7e8e5a1966201890d219", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848749, "uuid": "f5999e2c-1c29-40a5-90ba-9248c82ff5c4", "comment": "Malware payload", "value": "2d65edce528457689d02610201fc0e03eef14069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848749, "uuid": "1aaff65b-67bd-4f41-ba2c-cdca1e182a83", "comment": "Malware payload", "value": "02abe2339abf8a732c70eee5353255ae4291174ccc91f7e460f69721d10d4c1dd5b8bb84ee28803b320222e39828f513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848749, "uuid": "6bbdae34-ba3d-4558-b009-5d51b6ed51d9", "value": "T10884CE01BA90C435F9B712F84AB6936CB63E7AE0573454CB62D456EE5738AE0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848749, "uuid": "3d2b43f3-52d3-4af2-aac7-017b57838e89", "value": "dbe7c866442b2c90ddc4d147097c4eb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848749, "uuid": "96b6a3f2-1266-4989-ba4e-7b7e5c2e575c", "value": "12288:Vb3ubQ2mq/xqEZgegAZYXvXT0LhpmakLb5:tgmmYEZzYIhQHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655848749, "uuid": "78517e0a-f361-4ed1-8e4b-d391398f297f", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655848749, "uuid": "e596adff-6c68-4b1b-b6ba-e9f0ef983f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848749, "uuid": "e5905aa3-c9d0-446c-972c-9b9d7f887e8c", "value": "75ab938481111c38aeb1aa760be209a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d21a41-f107-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655777656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777656, "uuid": "d4151b9c-e191-4c85-b6c3-033ab57cb297", "comment": "Malware payload (AsyncRAT)", "value": "c0ac938a56b000c1bf7ead77d00950e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777656, "uuid": "0a2ad401-6a18-4d9f-a3a6-bd94c49621ee", "comment": "Malware payload (AsyncRAT)", "value": "ab0b2472713c5b3b9521d4b725d2721d0fd4207cf20915bf6bd9256d45bfed5f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777656, "uuid": "09811c88-69ad-4415-aebf-4bca69d7542b", "comment": "Malware payload (AsyncRAT)", "value": "af6492119bfef878814510966a16af448b5cdc32", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655777656, "uuid": "515a8c9b-1975-4bd1-901c-a0694b4613cc", "comment": "Malware payload (AsyncRAT)", "value": "83ac4fd23b46ea826c73db9e7038280551eeaac27c0b66828fdba899550be0d4fc7f19af4839b9dd9926701b5bb7fa61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777656, "uuid": "9b200c5a-58c1-47c2-a736-d94f4ce78f87", "value": "T159C5231EB7849636C0A8B537CAEA90542774E8C77A67C32B6ED4F7AC1D33362590B14C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777656, "uuid": "3dc86261-fc6c-45dc-adf5-60a0e6515596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777656, "uuid": "0bc8c8cc-f7a0-439b-9d52-c42c96cccd92", "value": "49152:A4Ctdz4nj7RBCQY00fTg0blPcKp13q1MiElY280jgOdNMvAAWz0Ql8txx1Zv:/Cgj7qQhxAdcG3qZElY28sgOdNV50QCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655777656, "uuid": "0ee67e3e-fa8d-4e4b-b3b5-6d8370856b33", "value": 2547200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655777656, "uuid": "ccf29be9-a1ea-404f-9776-8ce8b07357e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655777656, "uuid": "083d7b2e-46b9-4a40-8697-1a733b853798", "value": "AB0B2472713C5B3B9521D4B725D2721D0FD4207CF2091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1113474-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789587, "uuid": "f605d813-e215-4c30-a622-ec6fdea8f65e", "comment": "Malware payload (AgentTesla)", "value": "c0a4fdbf1305b9dd108d7f65e24affdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789587, "uuid": "e90bebe4-55c9-4980-b39e-0259a1d26375", "comment": "Malware payload (AgentTesla)", "value": "ab216b813216917e3b8e7a5942b4345e99afdf5cb16f78faad6c9fd993271dc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789587, "uuid": "0ddacff2-7c8b-43bf-b889-72bc60fbe0d3", "comment": "Malware payload (AgentTesla)", "value": "56de701edcb65024e930b3a4c0caf2d1ef516c99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789587, "uuid": "2a8cfac6-63bc-40c8-afd3-2b818f2b1e25", "comment": "Malware payload (AgentTesla)", "value": "12afa603263272dd24d509b5b5423e92a55cb57f57b38003812264fc95ab634165adbefcf72b17cf6b2bf2bc59d2849c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789587, "uuid": "01c2c68d-acd8-4c7e-9729-35d777d8cc38", "value": "T1F9F4F1F4CEF8B9A5E164227A7850B03C37E25D1ADC51D835DA9BF04A34A26D111F8E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789587, "uuid": "3366f310-2142-423b-96f3-623e6711a78b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789587, "uuid": "cdeb3bdf-f721-43c5-b3b1-5cf1d9740f0e", "value": "12288:zKvbicJJ3Zo+0ytTvWOBcmzsSqCYHD0uRJxArL02CEPlnYTamsmQ7JWoS4A:+vbi2dZo+BVhcmzoD0CcrLHCmlaam6JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789587, "uuid": "a28ff795-d7ab-4c90-911c-d41cefa792bc", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789587, "uuid": "d6e38a6c-5cf7-4983-8a9d-02cb0c69ca55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789587, "uuid": "582d5617-c1d9-40a0-9d00-00dbae514146", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3410.210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86a1d39-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Meterpreter)", "timestamp": 1655823556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823556, "uuid": "3d10a9a5-be3f-415d-92b4-199a091e116b", "comment": "Malware payload (Meterpreter)", "value": "1b5ec02a8b492f99078b2d4b02f8a432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823556, "uuid": "59c3f599-525d-4b90-8844-7cd9fd5502dd", "comment": "Malware payload (Meterpreter)", "value": "ab58b87280367d0907b97202f33369dd6842f78664055e58adbc50c83a3ddef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823556, "uuid": "482ffcf2-0e2e-449e-9869-0b5b3d8cca8a", "comment": "Malware payload (Meterpreter)", "value": "b1992d7cca6e750ad4fd4c8d3d94997b7315bf8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823556, "uuid": "d783e43e-fa9c-4560-87d6-cdc5558ebdd8", "comment": "Malware payload (Meterpreter)", "value": "1b1b68799e5ce2629b2ac267de299b316421446ac5d61936042e2129aa6b33884737b4f193e90b42432f788357a787de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823556, "uuid": "cfd38b92-886b-48e0-8046-3ca23232d6dc", "value": "T1FA73BF42D6C45526D292127E2A753B7AE971F6BA2211C2CA394CCDE5DFC1CB0A3363C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823556, "uuid": "1656ff85-57ae-4db0-a3f5-c7323e3b59ae", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823556, "uuid": "9a54c095-baf4-4caf-ac39-59386860a5cf", "value": "1536:Ip0VuBFrFnwGc+fg6rNeFXmBZUFfPQrJMb+KR0Nc8QsJq39:w0uBRFnxc+fVZBOFArJe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823556, "uuid": "94330185-02c7-4ef3-b1bb-5263587dcb72", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823556, "uuid": "5911bca8-bd96-440b-84a3-2bc308111834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823556, "uuid": "238f1551-c80e-4ef4-adda-68950cdd7c96", "value": "1b5ec02a8b492f99078b2d4b02f8a432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad49b8e8-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655806787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806787, "uuid": "48291189-3420-4a65-b7f6-65323de2e3b4", "comment": "Malware payload (SnakeKeylogger)", "value": "be2e9ac2eab83111b8ab74d54d881b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806787, "uuid": "33af5828-a35a-464e-949c-176fdbb7423a", "comment": "Malware payload (SnakeKeylogger)", "value": "ac2f476e62ca13d4e3993027da7e7815d319b638c1aed5f0dc4f8e864b99609a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806787, "uuid": "80181dc4-12e9-4993-83b5-4a0bf37f9dbd", "comment": "Malware payload (SnakeKeylogger)", "value": "470f1dec01be3a5d222ea85b694a7398c9a1bb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806787, "uuid": "284932a3-3276-4f4f-9e8d-563541abf0cf", "comment": "Malware payload (SnakeKeylogger)", "value": "c4d5cb9fbb089539959896dda4de9a9f59c02e6104a8864a2d312802daaba037116ff293c9be1c2d83e9f9cd485c8185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806787, "uuid": "13e8193f-8232-4553-97a7-83d153ca94d9", "value": "T14104736DE5079568CEF4BDBC28F5A73A0D506D62481F8BC167583AB912F73A23C0CB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806787, "uuid": "9379a67e-9ad7-4fa8-a3a4-a799f9fe648b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806787, "uuid": "cf7ea4a5-702d-4f52-8906-65ae537f0b4a", "value": "768:bbxCpP+9XXGXXXXXXXGXXXXXVHHHg3lIFG9r:bqW9XXGXXXXXXXGXXXXXJ+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806787, "uuid": "0da99cb8-e771-4d89-b0af-0bd875023656", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806787, "uuid": "06fe9ca5-69f1-4d30-a78c-1ee775353ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806787, "uuid": "3e2bdc30-32e1-4bde-86c3-46c85faf54ef", "value": "flod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839d0fff-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808005, "uuid": "0bac090f-e439-48ec-acfb-f31e7d1cf2f6", "comment": "Malware payload (BlackCat)", "value": "305de189e8a35d4b98d9d0f45d5a8648", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808005, "uuid": "1a46a537-eead-4658-954f-9a01a4a813b2", "comment": "Malware payload (BlackCat)", "value": "acf8884a4bfb9ebfe99ed607c4f1cf625cd705ac4317c092ef6dcca3d47027aa", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808005, "uuid": "c2203aae-78f1-40ad-8a62-2c660fcd78fa", "comment": "Malware payload (BlackCat)", "value": "560cc0d9907c66b94ca007650df910cf505d4a35", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808005, "uuid": "a27ee938-4068-4498-beab-0029d63011be", "comment": "Malware payload (BlackCat)", "value": "2a37bf839b935995cc73cdf509251d690da205eb501a3889526cf6157b143fcfd5777780e01038206457b77cea031bc9", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808005, "uuid": "29b8a56c-d61e-4c6b-9490-29393ab4b79c", "value": "T1BEE5AF95FB83E2ADED6B1470345EB33ADE34481C01199FA3DBE45D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808005, "uuid": "1f6a2f24-99ed-4407-a78f-ca0758be0790", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808005, "uuid": "6115f809-735b-4c29-b773-2505a524b9f0", "value": "49152:aQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNVrC7inKFgNcKAzQmy7:tO7xei83ksPBqanJnegNcKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808005, "uuid": "d1dfe894-d85e-4fee-9ed8-cecc0e7abacc", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808005, "uuid": "7c49c43e-7700-405f-84c2-06a895ed7e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808005, "uuid": "e5afbd5d-5138-44a2-9173-392b582174cd", "value": "acf8884a4bfb9ebfe99ed607c4f1cf625cd705ac4317c092ef6dcca3d47027aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94302240-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655830367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830367, "uuid": "ba96cf40-e3bc-4a82-b02c-b3312852e53d", "comment": "Malware payload (SnakeKeylogger)", "value": "ac13d242aecd75defee8c20a1031f2f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830367, "uuid": "a7f40127-b15c-4524-9d4d-acbb5c2f5abf", "comment": "Malware payload (SnakeKeylogger)", "value": "ae240fef9bc0a045767eccd95b0de70a279917717b5c2b34143cc22a51265b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830367, "uuid": "899e82fc-8134-4f9c-8ec1-850d174689df", "comment": "Malware payload (SnakeKeylogger)", "value": "f3351d432c00fc71b4bf33ef4042352355082cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830367, "uuid": "67143846-7044-4d3c-a6c6-f1ce18f50ac9", "comment": "Malware payload (SnakeKeylogger)", "value": "c0a5d2afd10bafbd5ba8c27a0309ba9f05c63f55fdae4df8597a2561127400c17b7a5dba00a096d00c44b868ff826d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830367, "uuid": "ce4fd524-f3d9-4151-bd05-80d245237f39", "value": "T18304736DE5079568CEF4BDBC28F5A73A0C506D66481F8BC167583AB912F73A23C0CB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830367, "uuid": "331d7538-4d4f-4b08-8b61-1827ed25a39e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830367, "uuid": "4c5cfc3c-13a6-46d3-9fdd-dac2258480e2", "value": "768:2Ls/Gz+9XXGXXXXXXXGXXXXXVHHHg3lIFG9/:27i9XXGXXXXXXXGXXXXXJ+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830367, "uuid": "55b2d31c-decb-4e70-9e3a-10b5caeff2c3", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830367, "uuid": "b31c5520-6ead-497a-b23a-790ba1ed5511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830367, "uuid": "3e450579-1e67-442e-a983-6da0810b8274", "value": "CHIOS LUCK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da1b310-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655809150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809150, "uuid": "77a2776d-8a5e-43fe-8256-f55fdf2562a6", "comment": "Malware payload (NanoCore)", "value": "d4f0a1d637a96599b3b80feaba83b6bd", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809150, "uuid": "f86b9fc6-526a-46e4-bc3a-3b5a077a91b0", "comment": "Malware payload (NanoCore)", "value": "ae80fbd1adac688684db087745df83d0991f7fe004ba232c9ee37df8736f260a", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809150, "uuid": "f8f285fb-786c-4a9e-8966-f1f971dd79b4", "comment": "Malware payload (NanoCore)", "value": "5024dd4d58ebfcbefc1dbc45dfdf683491a0a3fa", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809150, "uuid": "6d6641c2-c9d4-4897-9740-5ea9cb915042", "comment": "Malware payload (NanoCore)", "value": "f1533b942131128ec1f061008e63c0a68c1a8fcb0faedef03c1b6afca32de5e59f416cfc5c4f80bb2f734ab5da30341e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809150, "uuid": "34d7cb78-3aa5-47e0-8ff1-fdc8b1d90646", "value": "T168753374ABA21158EA1599B1E37A74D141E9B1FC26CD52C02CB743081A2BFBC5F3C75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809150, "uuid": "5c378707-125c-439c-bd28-0eb74c5e6606", "value": "49152:QA6owEtsG99QoZzd7ZBTeaAJ1ujSq+sko39q53:QA6pEOG99hdVBTVa1SFJJtqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809150, "uuid": "431f7917-8128-4d2d-bb19-81e66b859137", "value": 1683996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809150, "uuid": "ddebd7c2-0232-4a45-a2a1-4b23b10677a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809150, "uuid": "5245455f-fde0-4baa-a937-90f5d7f4c43f", "value": "RFQ-PO3010DT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331bf40c-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "f5525e1f-3df9-4764-aaf8-9662aadc793d", "comment": "Malware payload (Mirai)", "value": "79fa8fb7b375d376176013756c046b26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "9242b741-89d3-46f6-aa07-815ef390b62d", "comment": "Malware payload (Mirai)", "value": "b02593e16bf36c34510caf14f5626e2d23111e5c81a15a6d7df462c94fae09fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "5c328962-8573-4136-8dd3-d301ce81efe4", "comment": "Malware payload (Mirai)", "value": "11dd226217f35a3449a6a95b178667d9d2f39f4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "4a06daa0-0b64-4ee3-be2e-a86ab3e56841", "comment": "Malware payload (Mirai)", "value": "8379ae8e6b2c4f25f274d6daf3f23078f9380f08add08e9b5d42a3c951b00a2a70721aabcd33216100fcb471601dc2ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "842822f6-a40b-4291-b54c-e26f0d3301a0", "value": "T1D5833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "cc88b0be-38cd-45cb-9a0e-b89bebcedb49", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8L7WDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y32oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "9c83fd9f-18a3-47e9-9c76-b47ba1531598", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "157eec79-2f62-4b05-9bed-0b5eb4cd5fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "3b781346-431d-45b8-9968-bda7a91414d2", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869c1e51-f147-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655805004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805004, "uuid": "e48c536c-bea8-4e5c-b1b2-97187b818342", "comment": "Malware payload (Mirai)", "value": "a9754323098aa0e7a00585569a44e219", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805004, "uuid": "0490ebf4-287e-49ca-84be-bb5dd67298da", "comment": "Malware payload (Mirai)", "value": "b0bc7cdba0eaba6f1ccb8c9b8e371fd94a8c6bad2f27350533bca87b99a5d19b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805004, "uuid": "261fa46e-1e0c-442b-b6db-314392b6b2d9", "comment": "Malware payload (Mirai)", "value": "2ee4af7ca90a9fe2549e94d5c5d62770d9f022c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805004, "uuid": "cfb4f287-ecf6-4574-80f5-00d990240a84", "comment": "Malware payload (Mirai)", "value": "f84f566e64c46097aa97a10d2d81c82f69ed273271b4b21e39bd3e5f4d8e2107ca6d5260089c1852e3d5f302a16d6dfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805004, "uuid": "ee320f8d-e224-4667-81d5-81b3255f963a", "value": "T10233F174E65CAE50E662057BD9A0CBC95D43167380CEB612C6659E3C8DD7AE013F88CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805004, "uuid": "bb75ce79-9c43-4183-b6fd-2eef0abcbaff", "value": "768:vKnHVIPHFAtC/npL3NSJVsXcHTRO5w129q3UELUxzQipMQnHu9UK3aLA5K:FfSC/R8sXelmw1bLUxMipMQnO3KLgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805004, "uuid": "3195f06c-2aa6-4ed3-8725-13dafba8dcfc", "value": 52392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805004, "uuid": "1cf29848-cb91-4f78-92c5-888009347f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805004, "uuid": "f7e2e289-dc38-490e-8604-e9a3b771af4e", "value": "fuji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e839f5a-f170-11ec-93bb-42010a9c0043", "comment": "Malware payload (SVCReady)", "timestamp": 1655822412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822412, "uuid": "63792780-3b0f-40f3-bb15-7e7554932d86", "comment": "Malware payload (SVCReady)", "value": "9f3b9999a24ab0a020869b39a8c00d9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822412, "uuid": "2f818701-ec7b-4816-a025-4ee3e105d0f9", "comment": "Malware payload (SVCReady)", "value": "b0bcd7832ba41443eac0002c7f2f0037d8293f8aa383ba284654414830cd1d4c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822412, "uuid": "e00177b6-0fe7-497c-94f4-818445df110b", "comment": "Malware payload (SVCReady)", "value": "0dce674b1bd7c3fa96eb80a71804b134bd52b74c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655822412, "uuid": "d11e8bd2-f057-4196-9fc7-5b51285e529c", "comment": "Malware payload (SVCReady)", "value": "8ac4fb4e40f74e6ecedfe0e98d20ef941701b73e831df3add51fbef67aea9d45072358b18a106738dc1adfbe0e02da69", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822412, "uuid": "ab504da8-fb17-4002-8103-056f4b48256f", "value": "T1BCD5336388E2732C6B98027173D41CEF6478E32FB45D45C5F0A167AB8D30B1A4EAB56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822412, "uuid": "645d1702-86c7-4940-899c-963d1631e889", "value": "49152:UWaUvAkyB4mOeRHryRTFp/E4z59Nals3h8nqx+EQMhlSSFNDH4/D3AB3x55z:UAn63OWQFp/jtalChx+EjllNTWbAB3b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655822412, "uuid": "edf6f88e-470d-4501-bd48-5e19fb93c43e", "value": 2747696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655822412, "uuid": "a1b93d96-ce95-456f-b23b-85e7131f6ab0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655822412, "uuid": "3c9a4cde-0fc3-4b61-bfcd-4a7ee5af924b", "value": "makieal_20.06.2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40023eb9-f1bd-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655855566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855566, "uuid": "e1b7dc2b-8c3c-464a-8fc0-73346dd18422", "comment": "Malware payload", "value": "9adf803cb409ab7ba8296e70a79cb4b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855566, "uuid": "15a24f87-322f-4d6c-addd-018fa5448d04", "comment": "Malware payload", "value": "b0f498160c68c94271cfed0e7810287c8fbd157ad43d753f5d374a94ef435620", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855566, "uuid": "ffd84e35-9d8f-4f9b-8457-144237d44321", "comment": "Malware payload", "value": "c491d53225c0757e27f4ff09d5c2054b29241fe3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855566, "uuid": "f680f890-586b-4c71-92e3-7740c50bd5a2", "comment": "Malware payload", "value": "4e4d3a72232fa44625e262b9e43026cf6043754770bb0320d565409ae217618f3d51556b591925401f6580465af24a8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855566, "uuid": "f18b7422-0c90-4377-9424-451b9f0c9dfe", "value": "T12B152345FD881F83C3594538A12BCA1C29DA7E8DC71EE0FB9B91B4C672B4BE644C7912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855566, "uuid": "39b4123c-f9db-4e90-8344-1e15b9c60057", "value": "24576:g/kDtsyDULLk9iFySeLMu/lUHGguNaUgjg+Nk:L78LkPR1Kmg6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655855566, "uuid": "89333ac0-761d-43cd-9c50-f3e0b08ac4bb", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655855566, "uuid": "2b7680c0-685e-44b1-b61d-0a9419e4e03f", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855566, "uuid": "6696fdc9-8fdc-4c2e-96ab-2aa3cc8d0c5f", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.9226.28414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1f6f1c-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802247, "uuid": "1d5dd26c-1721-499d-9d9d-6f11033ced7a", "comment": "Malware payload", "value": "520855bdec84895dd57eb97e5f30b6e3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802247, "uuid": "129a8f8f-3c9b-4983-b22a-ee42dc5f95a5", "comment": "Malware payload", "value": "b12dd66de4d180d4bbf4ae23f66bac875b3a9da455d9010720f0840541366490", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802247, "uuid": "c9cac079-dcef-4c53-a537-c452c5360fe2", "comment": "Malware payload", "value": "51428eaafc0d544da9a56ba00b8c9c774a01153f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802247, "uuid": "26b49459-eeea-47c9-9ef8-d4a455e21277", "comment": "Malware payload", "value": "40166255a0ecc8e57a722237a0c577efbc4e268ad34583bf9ca1a005e61431a270c2015241f0e19012939f2cd1c1b8d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802247, "uuid": "68ccce97-3b6c-4c58-b7c8-77c9dec0c7e0", "value": "T14406F085BAE9BE13CC7290764B4ADA36205D8D245B03C383694837BD74BBBF80E457D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802247, "uuid": "bf98d362-80be-48b0-ab80-2a5361e96a18", "value": "98304:Yc4aG4U0q90ueyK2KvJ+1uznRUGNlytq4hh4RCNpp5rbMkt:Y1P4IBH90zhQqrRC7n/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802247, "uuid": "856a3205-2455-4737-8f91-3c5abe7c67e0", "value": 3843581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802247, "uuid": "3180c717-09ed-4068-890c-9c591dfb3be8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802247, "uuid": "01d07684-f5bf-4cca-b6d3-ca6ef9a952d5", "value": "cryptoapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dd7c9b-f164-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655817458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817458, "uuid": "a1fed41c-5223-4657-a983-0f8cb45d2b91", "comment": "Malware payload (NanoCore)", "value": "a03d08a7e5f32bdbe24bf8c64f3a3f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817458, "uuid": "20081dcb-96e4-4999-8eec-360b20bed433", "comment": "Malware payload (NanoCore)", "value": "b16865b7bb5d629cb1fa700716b02b1d6d33670faa359474cb2194267d3ec2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817458, "uuid": "6239cd79-0d0e-4d2a-9f39-568113e98589", "comment": "Malware payload (NanoCore)", "value": "a1f629a4336321b86ddf82edfb10817d45f69d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817458, "uuid": "b417cdaa-37af-4dce-bf99-774ca5d398d5", "comment": "Malware payload (NanoCore)", "value": "e37db4b1268c857abe32d84da802cd8fa8bb51d18f9079713483edc532393707cbb312e2d1532a2841f3ca168fa2a20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817458, "uuid": "27f90298-3093-476a-9c12-d08c5da592b1", "value": "T154A44CACBB4D1A72FD1E913886070B08BB660F1363C0BAD267DF17C98B4E5B56D55C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817458, "uuid": "6d37dfa2-96b2-4401-b4a5-4602316ed1d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817458, "uuid": "87e8da56-88e1-4e40-8e22-f59997628eb4", "value": "12288:LkdQh9aaWvGNbodFebc+ZxCRLAVJtBNeu9hD:LRaz0odFeb37CRLA5BN/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817458, "uuid": "b7abdf1c-1828-42e1-85be-cd037d6350a7", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817458, "uuid": "6f4aeef9-062a-4b76-934b-ed3d8972b9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817458, "uuid": "be180f7e-3be8-4c52-ab5c-37e778436682", "value": "order2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28afd1df-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655825462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825462, "uuid": "0bf65288-0714-47de-90c0-6a38c1b46fc9", "comment": "Malware payload (Heodo)", "value": "e7442bd6796a2ba3053df31133927816", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825462, "uuid": "351c472f-3f05-414e-b29c-fa0538984730", "comment": "Malware payload (Heodo)", "value": "b1910acb925184da17a79176f236406e7ae5b71b7174234382b6c348da97b757", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825462, "uuid": "d57aa2c6-2222-4266-a7ee-ca8e73579269", "comment": "Malware payload (Heodo)", "value": "fb3d81e737f4fda2c97b7f4b40e5110b86874da1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825462, "uuid": "bdc30bb4-e85f-4918-8cc8-37d79ac5adee", "comment": "Malware payload (Heodo)", "value": "0cd034b601ab10b07d927b595b8d6ba208eabab7265339b498f61425fdb24beae92e2fa18bbe3ba4bbe14d50fa2378e3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825462, "uuid": "26fff407-67af-420f-88c8-dcd7667eebd8", "value": "T143648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825462, "uuid": "6a4f132b-fafd-4999-ae8a-f81045b241a4", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825462, "uuid": "59e24d74-16d3-49d4-b811-cdcd87e6acd1", "value": "6144:JqdSTDcHe3kjHfNsQnNXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3NIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825462, "uuid": "bf318af6-55dd-47ce-9441-a891d534a2d8", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825462, "uuid": "b7265ca8-31b3-4299-a8cb-7bbfb1d5e4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825462, "uuid": "0921bed7-27cd-49e0-8d40-fc9b7e88a229", "value": "3rdiFe2GsX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c0f86f-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655802134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802134, "uuid": "6671c0d8-697b-4d21-865a-0104ae885018", "comment": "Malware payload (Mekotio)", "value": "8d00e1723a9d337c545bdcf60c36b2d6", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802134, "uuid": "9d3b02bc-ef68-4684-809e-d82c45854914", "comment": "Malware payload (Mekotio)", "value": "b1ee4eb75aea658ae3c0db6fc511ae3a8adde19ef67f0ceee1cb4d81ce27033a", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802134, "uuid": "d150ce76-c0f7-48ad-bc9c-306e574da85c", "comment": "Malware payload (Mekotio)", "value": "645c5bf9b18033c79c66c15ea4ec9d245e8ff2b6", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802134, "uuid": "3b9b645c-ceae-419a-a981-6deabc2b6589", "comment": "Malware payload (Mekotio)", "value": "d677dec5cfc84a3f789abcffb80055b096e785b9065803d02b1d2f3a56f21a56511998c89b3168fc1a1c8cc8f950ef44", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802134, "uuid": "86fd8fcd-fd4c-41eb-a101-def3cb15f6a7", "value": "T173A1B62DC755E9B58DAF74278ECCDB58F86D027A514C6409D8DCEA8430A914C93F08BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802134, "uuid": "88979e8d-45e8-49b0-9419-3f0c960b424c", "value": "96:URswSHBM/A7sEFRhPqibWo5JewTBE3cRmNWB6QKqGyb78hKWz6awXG2CUij8GDEc:URswSHBM/+hwo5JewTycRmNW8Af8hKi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802134, "uuid": "baf92068-63e7-4702-8b80-df69cd0c9f58", "value": 4659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802134, "uuid": "4f049b5c-bc2b-451e-a8be-4d9841fb29d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802134, "uuid": "0df5f718-a015-4e17-b375-6991b15e52e9", "value": "b1ee4eb75aea658ae3c0db6fc511ae3a8adde19ef67f0ceee1cb4d81ce27033a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7298b42-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655803824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803824, "uuid": "323ee343-472c-486e-8591-cc116a0a7b3f", "comment": "Malware payload (Vjw0rm)", "value": "b6729d98dd353e3fb01117a8fbff2ad2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803824, "uuid": "00b422b9-598c-4c31-afa6-265127c8207f", "comment": "Malware payload (Vjw0rm)", "value": "b2130eb11c87c6da7ad89d3afa70a45d31925f8cd04f8773a479db9af61b73d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803824, "uuid": "15593779-2d4e-4b37-b5f9-3bf2b36ab229", "comment": "Malware payload (Vjw0rm)", "value": "24b39cb78707d33c189c3ce371ddea0a84f8596e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803824, "uuid": "c657ab23-83bc-43e2-8fd6-f9d4a949f903", "comment": "Malware payload (Vjw0rm)", "value": "630ed6721ed4d4c3db28015cb95fb4bfa89d2da9f86fa2f9c804c7b93145a4386883bd04d2bc98bd40ca50e4cddc1371", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803824, "uuid": "d46f89ed-8f61-4230-a11d-955d775f1af9", "value": "T18184E140D7C0167A795C2A57E0BF050D93F61386EA5570CCF76BB90B1FAFE84AA23684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803824, "uuid": "e3c0f99e-98d8-4112-a331-956e2f2d87a2", "value": "6144:TiArG85e06YfYo4vsqgL0rWkw5T3jKoSzhehiLb/JNbORtBmjUUg0cj3A36XtT:neoKcxzKTkAFNbOj4dgdA369T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803824, "uuid": "ed4daa0b-3886-4c12-a378-33eaac11c95d", "value": 388958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803824, "uuid": "575ef083-b6e6-4904-956a-3b08e3c9f4c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803824, "uuid": "fe2c31df-c723-4459-a517-21ebcdf3920b", "value": "Permintaan Kutipan P.O- 21062022021306.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fe7394-f198-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655839737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839737, "uuid": "b8067d98-7a8c-4cb1-acdb-5e9a66367958", "comment": "Malware payload (Mirai)", "value": "780c79785e550d62c0e00c7d8170e43a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839737, "uuid": "04344198-448a-4aa3-9088-c4696fa660cd", "comment": "Malware payload (Mirai)", "value": "b364a6bc7fe0c113d3b6d25b94e8c1ef9db7c05f46f084ac5d523ec5e68a2cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839737, "uuid": "c20dd651-1226-4cc3-a5e4-17deb12214d9", "comment": "Malware payload (Mirai)", "value": "d94fa329304e21408fd906fd953419041041b9fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839737, "uuid": "f7d973ef-5388-4176-a560-8526bfdf9b51", "comment": "Malware payload (Mirai)", "value": "1136ba38b289f454b9f8533c0903481b93f8650d3002356bc495d8dafe3e8ea1c696bd39e10540e4f9fbd074c5636f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839737, "uuid": "b439627b-c04f-445b-b434-45a5baac295f", "value": "T19B234BC4A553D9FDFC1A06742173EF729BF6F53E2128DA83C7A999339882702D40619D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839737, "uuid": "fab33b9b-c11e-427b-9a03-747ffa0b07d6", "value": "1536:uUQcvssQ5ULlCiJ5j/OTXhUg6jY0IMdE:WcvssQ5UlCi7j/O7ig684u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839737, "uuid": "06d25408-42d3-41e3-bf05-b8cd06599afa", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839737, "uuid": "f02b3f21-3e1c-4cc3-b39b-39577935e409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839737, "uuid": "87810e61-d200-4a59-a6e5-cc7cd044b693", "value": "780c79785e550d62c0e00c7d8170e43a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42755ad7-f17f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655828941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828941, "uuid": "581a1ecf-924a-4262-9cc3-70e12a9d53eb", "comment": "Malware payload", "value": "9a3318281cfa70cd369700d78bd840c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828941, "uuid": "4c92a75b-1b16-4681-a626-535cde0e7da9", "comment": "Malware payload", "value": "b40edd2ee87ad577b6e077be94ed1bf4a716103c6ac743ce12e067a4fa926b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828941, "uuid": "8ac57ac8-9dd6-4cdc-aba0-9f52c217a37a", "comment": "Malware payload", "value": "0cd64ea80112bf703c576d1e7337f3ce77965561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828941, "uuid": "12a79717-6563-4c9c-a531-32b0135a1b07", "comment": "Malware payload", "value": "da9bdc47c3cb401e9007cdf226601669be2e1951f85d394beb6ac3eb212c2e78e0637d224748103e739d4ddaab50548d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828941, "uuid": "e6a9fe95-3b71-4d0b-a46b-0176b7db80fc", "value": "T1B525330B0D38834BF9C9A0F44121D37E6576534019FB966FD29DF8D6B6A7790A20CB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828941, "uuid": "412f1eb2-c0e7-4097-a827-8886abec0ba9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828941, "uuid": "713ffdfe-e4ad-485a-976e-858b5f6fc059", "value": "24576:OilgoAMjOdgXYHPDpv+f34Mih3t1Jaf9LwP8dLfZy:PB2GmDpw34MO3VaLaGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828941, "uuid": "9733d1b0-f6c4-4e57-9679-95e74f7567c1", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828941, "uuid": "165c7686-f94b-4649-b440-22b6b28c6374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828941, "uuid": "45942933-ed95-4392-82eb-6483165707ce", "value": "movecheat13_pro.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54e1533-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655803848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803848, "uuid": "af553120-70ac-4cfa-a199-eb5a72fcc191", "comment": "Malware payload (AgentTesla)", "value": "0a74331331f9118783c14a258df23047", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803848, "uuid": "4855398a-064a-4f81-b5ac-4721b7ff44c3", "comment": "Malware payload (AgentTesla)", "value": "b4629fb4d969ce71bc3e0f8725243ed55f592a944a9ab43044e857d896dee871", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803848, "uuid": "41c5cb90-91ab-4e64-8c4a-4928de4f46c4", "comment": "Malware payload (AgentTesla)", "value": "bfc2ad650dcf6271a07f6eb5ce3efe82b87b7c38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803848, "uuid": "8fe320c2-e66d-41cb-abe8-e8d58d9cdcae", "comment": "Malware payload (AgentTesla)", "value": "1830ce82d52f32799726db9e9e019483dd2f6f32ac0fc6dd494aba65d552411e5fd07d3552bcfbd418ca40208bbe2e86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803848, "uuid": "daf805ec-3687-43a1-a5be-f01161d53929", "value": "T130B4E698BB44A58DE56846ABF03D3DDA67F3270AC59263CC765F32471B6AF1CD288C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803848, "uuid": "fc906262-f1b6-48c7-b36b-fab05a602018", "value": "6144:tv9GsqT+7gWsmvv5Q4GYXZnbPx2K8mqJh+Ytwf9e+kB7XVetMMzx7j:FhqTqXsmvv5JJnbPx2KOfw8+kxFebn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803848, "uuid": "c4d3dc13-d774-4557-95b7-da93ca9fb544", "value": 520463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803848, "uuid": "bbcfb486-c4c9-4236-af41-0acf3c93d9cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803848, "uuid": "fbd86fa9-db07-437c-b767-366e7088cff4", "value": "New Email Added and Messages Alert.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8444d6-f183-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655830921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830921, "uuid": "4719ed26-cd95-40c5-a431-ebefbfbe35b0", "comment": "Malware payload (GuLoader)", "value": "4c8265731cc1095cdd7772f986f58192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830921, "uuid": "bb4bc721-e679-4688-bc71-7f591510940d", "comment": "Malware payload (GuLoader)", "value": "b48aa9e3805fe0bacfa777df49455687a7b9a138c23cca9784f26a1f29be9edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830921, "uuid": "21c6efbb-ab1f-4306-b2ba-ba520088ed84", "comment": "Malware payload (GuLoader)", "value": "e2fd75d738cb8da5baf9db7925e86284ea56d547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830921, "uuid": "c5ad2c32-7931-4e6a-9f35-69d970e2e8d5", "comment": "Malware payload (GuLoader)", "value": "9500a5a4fc8a5d0cf766a22fe8e05ac7cba622273b268555156b4e085677a1201a9f29bbcf99c25833c13d9092cb8b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830921, "uuid": "e1757d1d-68bd-4178-9624-b093b0a5b8f6", "value": "T153241268B7F0D527E8A54AB10D7282353FFEE4221891274F17706F643C2A391E9097AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830921, "uuid": "d7706b2a-2e06-484a-88d6-c5ac74c74d6c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830921, "uuid": "56991239-8e44-46bd-930d-b9f6756c83e4", "value": "3072:AfY/TU9fE9PEtux5b3CXU+yevWRv2/2vLEZUNPPk2Avqcv7xIXOh0VxkikACiPTF:WYa61SXvykX2vhk2+7iWokikACzw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830921, "uuid": "f326c69f-e23b-48db-abfb-8f4afe6b8709", "value": 215414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830921, "uuid": "b90f1433-57a7-4e3a-b1d5-c18d5128055c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830921, "uuid": "76b76839-480f-469a-b72b-9288b0372591", "value": "PO 4507596885 CC 4410 LLC GcC67- Auris-Dated-6-21-2022.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b94527-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655833032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833032, "uuid": "d557720f-6eda-4327-af05-33cd7d4ca82e", "comment": "Malware payload (Heodo)", "value": "46f7af716bba0fb03b07d4964a955de8", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833032, "uuid": "1505cc59-c060-4310-a5ca-80646d540610", "comment": "Malware payload (Heodo)", "value": "b48b03e72c572782ad6ea8401e1c76b15c8e96aba55a57bf18cd2f969ca9e9ce", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833032, "uuid": "893ca2ac-54c2-492b-9d96-4dab29557d84", "comment": "Malware payload (Heodo)", "value": "81d59e70f05f2653d4d51b2ed16bcd90d83dfee0", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833032, "uuid": "41c270d2-41fb-4653-8b00-f38edad3f03c", "comment": "Malware payload (Heodo)", "value": "8e8ba9aa7b77c83bcd1232ff8ee47a4b8e9fd61159cf8b1076c12ba02a02b034350cc8ccaaf96309e424540c8d81336b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833032, "uuid": "2b0fb0e2-e6e5-464d-b8d6-192649726131", "value": "T18D64AC062240446AF74A4B708A17F9D687667C7950E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833032, "uuid": "9227ce8e-fb8c-4983-bae6-f5ee6c2044bf", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833032, "uuid": "3068d476-3ba8-452b-8eae-2b38999de0e1", "value": "6144:3MiSTD2He3kjHfNsQnRzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3WNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833032, "uuid": "0e8ae370-67ad-480e-8c00-53a791359829", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833032, "uuid": "e2658b5f-a53d-490d-8d70-d15be06083ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833032, "uuid": "86b95786-a3d7-4eec-b2e2-087f5fbd9b26", "value": "UaxvATwx1nW9e5V2.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b45361f-f190-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655836150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836150, "uuid": "09bafbb8-ad4d-4493-b655-f5f70a4a2621", "comment": "Malware payload (Quakbot)", "value": "16c21e3b780d62500492302c57c221cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836150, "uuid": "bc7a3634-4df7-45c0-973a-46a2bf62feb7", "comment": "Malware payload (Quakbot)", "value": "b5ff7b3e2e573f000fc57ac50e27bccd05baecbe72022746f7e13ad755efa4fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836150, "uuid": "b42db6a0-f94d-4bd1-8a57-7b865d1be251", "comment": "Malware payload (Quakbot)", "value": "dfc5b4dfe26ee62140b1972c117fb04f05f9d96c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655836150, "uuid": "56b4bf14-8ac0-4830-8cdd-87b1727a36b7", "comment": "Malware payload (Quakbot)", "value": "18e9f09b992e198ee4e8dfee5bb2aefaed03b5576539494138eae35a85acf13d2873fc0ad6cdf6b1f47acf49a812b4e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836150, "uuid": "a460409e-dc6d-424f-a1f4-5ff9651a29ce", "value": "T11BF49F36B3E04837C1771A7C8D1BB66898297D113E3C988A7BE41D4C5F3A781376A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836150, "uuid": "48d28604-505c-40af-8322-868b4de42357", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836150, "uuid": "84772116-5264-45cb-bed1-6a9188079882", "value": "12288:pSHEVZKP1O+hamzhv1fm3Z7SxZF0WGNY:eSi7NvEFseY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655836150, "uuid": "a6f7437b-a0f8-443d-9bf5-7eccd5b2699a", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655836150, "uuid": "85d71731-87b2-499d-8ced-600c1adac2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655836150, "uuid": "4faa781e-14f5-420d-8152-55c272646eca", "value": "1900.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb48159-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655799672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799672, "uuid": "f7d37b0f-c439-45d9-82cc-9a7cafedea35", "comment": "Malware payload (GuLoader)", "value": "0e9ca1ab993ae96e78cb4916f4595927", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799672, "uuid": "d56e66f7-f5ef-4bf1-8102-e60128e0fcd7", "comment": "Malware payload (GuLoader)", "value": "b617c20bc1022c7d145aa9c5796b78a9d6f386f56b956050c488db9fb500c229", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799672, "uuid": "fed8105a-7a06-478e-9040-de232665297d", "comment": "Malware payload (GuLoader)", "value": "bddff06333f9084ee6b85bee4bb862cb1a1deec2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799672, "uuid": "b6d69eda-f1f2-466d-a4a1-bb6db0c5e831", "comment": "Malware payload (GuLoader)", "value": "cc9705e2d6bd65f7d653c194dc7f3162f845476f18bdd867d1d009eb1b6a5b328cdf3d54e0ae59a15f5975c38ad0dc53", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799672, "uuid": "69597271-9133-4d0f-99b3-12456a7bbcd2", "value": "T1AE6533AE5AD0BF1D53F04D4AECFA10EC425FB4A13BCADD811B075E7315369C706886AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799672, "uuid": "83ce25e5-a217-441f-85e4-a593d50735b7", "value": "24576:n97UbLL7ImbEfPtt0u6Yk9uzkzdA+1hh+u7cLWcXel24Zbu/67LxRdOy5xtTU:n97avunRDYeG+NNXgj0/mLPdp5x5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799672, "uuid": "219d4664-17dd-4f1e-b59a-689ae7dc5f6a", "value": 1535259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799672, "uuid": "25e90a22-49f0-4071-a296-80c2539ad05b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799672, "uuid": "766e46fe-b812-4af2-8459-09204b47b133", "value": "SWIFTCOPY_INV50004879_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbf7e0f-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655809690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809690, "uuid": "ba1f24a9-25c6-4acb-83b0-d9bca391e43d", "comment": "Malware payload", "value": "f28f4e109dab9a1b551138a27811d43b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809690, "uuid": "e7244f8e-4442-4a79-a7e4-53089c17389a", "comment": "Malware payload", "value": "b67dbfa29b462c9486a92f7fbd0c44ffb32d21b7a7e53c0ad857baceae54c052", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809690, "uuid": "ba922946-b7ec-4d42-8be0-01922e5623b5", "comment": "Malware payload", "value": "19446b4894d6c74c55f6a8c7e94400fe73eb90a6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809690, "uuid": "931b26d2-0017-4855-90ff-b83492756662", "comment": "Malware payload", "value": "1aa4526b98ae4d076158c0581dbea11da1abf91a1930ecade55354a6cf601fcc5f1907e951fc4db376628f489b7da8de", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809690, "uuid": "b606ef98-c0c1-4de2-9848-66138539cb8b", "value": "T162E4882C2F7A67B1B145AC0CBD9BC9A81962571070942C71CD71E392CDF1CEAE92E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809690, "uuid": "27f40c46-aaa0-4cce-a67e-f7b711ec99ea", "value": "6144:dz+Zzb3umbiGTeJ1Ry6s/xiESxQ9KH+ABISB9OSk/RZbeA6NCVL4o9+6Zv/04e+5:dSbGJ1vGeSVUCe/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809690, "uuid": "7a102439-5996-4e19-a5a6-316f84c07bbb", "value": 702496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809690, "uuid": "c3d6a800-8575-4207-9c32-93ff524bc94d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809690, "uuid": "94af7776-07aa-436b-8b48-343ef65d6401", "value": "gibsonstart.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c922bd5-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655799645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799645, "uuid": "36388559-4a60-4ca4-bb36-e08045ab2583", "comment": "Malware payload (Heodo)", "value": "ca28f516e5e74a43e34e6734ffa9179b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799645, "uuid": "6dd337ca-bc14-4b90-9212-43e7e044762e", "comment": "Malware payload (Heodo)", "value": "b68e1b6fee84011405c03c68a97746e1adcbf9250eeeaf372f78f5145700639e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799645, "uuid": "2473a6b6-3956-4c65-8f6b-c3342ef82c1f", "comment": "Malware payload (Heodo)", "value": "778145b46e3c49937784b725d3c8c626ce1d6f08", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799645, "uuid": "2d979b32-2db0-4bad-bc77-bcd4ad5a6173", "comment": "Malware payload (Heodo)", "value": "921a03786b22080f5206acb64a1864bc5e4037d87a5fba9b503ff637c00dd76a4683379edfd262721313254d8cc35dd9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799645, "uuid": "274876ee-6239-4f5d-bd8b-682a312c0025", "value": "T143733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799645, "uuid": "59f8a0dc-a7bf-40dc-b8f2-2031e5e08e68", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBY:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799645, "uuid": "433ad340-67fb-438c-b202-aee44e8d17cb", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799645, "uuid": "61c4fada-fa87-46cf-bfca-25ed9e10c4d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799645, "uuid": "efa22392-c22c-45b0-b97c-a44e92beba5d", "value": "HO766474931849822K.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd09e3cc-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655808585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808585, "uuid": "667101e5-21b5-471e-92de-1c3d71c4bbc0", "comment": "Malware payload (SnakeKeylogger)", "value": "2a8138149261d23f9dec004a4b462344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808585, "uuid": "01941b4a-7cd7-4a8c-967d-de5aff9a50c9", "comment": "Malware payload (SnakeKeylogger)", "value": "b6fbfbf74cf01bbf86409c59195a9ddf3337dd438d11bf11b4d81a33d2dfad2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808585, "uuid": "01cc0e08-26b4-4715-a996-40a8754ade57", "comment": "Malware payload (SnakeKeylogger)", "value": "097edc5b71e0b483c1cf70f138c83013cd7bb9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808585, "uuid": "d6413f27-28f1-445f-a950-0faec20d88b8", "comment": "Malware payload (SnakeKeylogger)", "value": "ac8ac978ceb0b099038660243157d66094e9b41acc3f96f60bfcdce8c7aa333c81205245452e0377aa43d12517fe8f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808585, "uuid": "34f6117e-a960-4747-b94b-27f76d30eaa4", "value": "T16DD22968B67D96B1DE554B7FD8F3EB800BF5E1029813DE3A348423731903366CAA1796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808585, "uuid": "8066bcb4-2706-46fc-b06b-31ff63fe0253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808585, "uuid": "63d65b3d-f6af-4933-aa81-cfd1d845d8aa", "value": "768:WmKKpzxNUUa19WREMdqubXjycyrsR2vZl:Wm9NtU8EeqqXMvvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808585, "uuid": "0977290c-c92b-47b6-a221-84aac49d2b3b", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808585, "uuid": "41b09386-efd8-4c91-8a7d-1199e220326c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808585, "uuid": "836b481c-656c-4a2f-ac8a-cfe8e62314d6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18120.21383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4247e005-f1bd-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655855570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855570, "uuid": "9d42d4fd-bf25-4e55-a5cc-afb033cf798f", "comment": "Malware payload", "value": "4cb6dea7a13d023a47d7fbca4c7889a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855570, "uuid": "6daa9ec7-d7b6-4a39-ae11-6a88b7289cb2", "comment": "Malware payload", "value": "b7595a0ccd50ea8a1e86cfc4ef6d8847266a6be2db436455b8057a9b154b2fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855570, "uuid": "89f8cbbe-cb02-4123-94cc-ba610171ec5c", "comment": "Malware payload", "value": "a5181df675e807038cdf6acd275460b7a645dc9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855570, "uuid": "97717b02-7ee6-4c3a-b0d3-908c9d534a93", "comment": "Malware payload", "value": "f685b4e1da61a643be1b51cad371513df1e1d6d59380c562182222d893907aaab1fd4dbb0bf601e04e2e8a28fa5eead9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855570, "uuid": "295215c6-eec5-4fb9-aa7a-d0731981d8e6", "value": "T1E3A41241AAACEB22DA3EABF524D2414457B1A03A3110F31FCFD164D758E6F48C5A2F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855570, "uuid": "ae10b999-5856-4c3b-ae66-ebd0791c4d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855570, "uuid": "f609d16f-df7e-496e-9781-4933f71c7d75", "value": "12288:Erl8VrFx9deDEWAnQt9PM21OnJRS8vESqNitJ018zzmeY:Erl8VrFfwDEWjPf14vbqNit+1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655855570, "uuid": "490dc631-e572-4825-892f-c138774b7be6", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655855570, "uuid": "4ddffaa7-fa3b-4b4b-ac44-a8849fc429a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855570, "uuid": "3261d47f-1ca2-4135-9579-0c1de0f86a10", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31948.23437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893b0344-f18a-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655833785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833785, "uuid": "09acd4c8-61ba-4c72-b691-8103593af115", "comment": "Malware payload (njrat)", "value": "a6c94e3418f7b67a3c8731f1ca757cd1", "object_relation": "md5", "Tag": [ { "name": "3.67.62.142", "colour": "#C8056B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacker-is-troller", "colour": "#7F251E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833785, "uuid": "29616a89-d5fc-40da-89ec-df66edcf0e33", "comment": "Malware payload (njrat)", "value": "b79461907c052a633c4beb871bebcb137cde9a83a8c593e4fb3b95fc11a57411", "object_relation": "sha256", "Tag": [ { "name": "3.67.62.142", "colour": "#C8056B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacker-is-troller", "colour": "#7F251E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833785, "uuid": "cdeb9d94-0f0a-4048-a6d6-39a59f9ee84e", "comment": "Malware payload (njrat)", "value": "e6ae1c8f6043198a4965dd4ed441ff59bca04920", "object_relation": "sha1", "Tag": [ { "name": "3.67.62.142", "colour": "#C8056B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacker-is-troller", "colour": "#7F251E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833785, "uuid": "b4390cd5-86d6-467b-ae6d-3151367a5d37", "comment": "Malware payload (njrat)", "value": "e64ec26c3cd736a32cc031d988031b874b1c326b8772ff0bb1d0e7d6b7700d71acbf4b907ca0733ba7436f3fbc4e0c95", "object_relation": "sha3-384", "Tag": [ { "name": "3.67.62.142", "colour": "#C8056B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacker-is-troller", "colour": "#7F251E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833785, "uuid": "16d09157-d396-4346-ac2a-fc2c1b1c7313", "value": "T12B032B4D7FE18168C5FD057B06B2D41207BAE04F6E23D91E8EE564AA3B635C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833785, "uuid": "70649693-6df8-405c-935d-48ed50fe968c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833785, "uuid": "d38e8520-d514-4b3d-9c34-c9c68e9b4b2e", "value": "384:yCOKMizdJjnBhFbJ8ycPCojPjTwNsItHrAF+rMRTyN/0L+EcoinblneHQM3epzXN:vOgJlLJfcPCojPysItrM+rMRa8Nuwst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833785, "uuid": "ff878f2f-fb2e-4ec7-aaaa-0722d2460b49", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833785, "uuid": "773d8132-9ce7-40cc-84b6-8c8caa677e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833785, "uuid": "f52981de-cb3f-4901-a1d3-c6cfcb583e33", "value": "Server.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a21b75f-f164-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655817465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817465, "uuid": "2c2404d6-b24e-4ad5-b764-5fdc41976e04", "comment": "Malware payload (AgentTesla)", "value": "2878999c53a295f63a844e966f6f59cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817465, "uuid": "c32bc2c8-d0c9-4cea-bf79-bf0a9c225200", "comment": "Malware payload (AgentTesla)", "value": "b80a4390b6246b26718152a0a72a0475a6b119761dadf96f001dca7e284cb579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817465, "uuid": "b7b65ef8-d15b-4458-9d53-8406f5dba4cc", "comment": "Malware payload (AgentTesla)", "value": "7a7870e860b46e6a663ad26f805846feb9ac818d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817465, "uuid": "fbee95fc-964c-4094-9d3f-6296a1aaa5ce", "comment": "Malware payload (AgentTesla)", "value": "8156b70a476ded4d00d260f6082e6e7d055a2ca942d016cb74d094bc473b7f131c71c144b186dcd3e5d7f43092e8bf46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817465, "uuid": "8369fb73-b3aa-4c9a-8610-7b2a17639a2d", "value": "T100052AAC365C75DED86BC579CAA81C68EAA0347F931B4107A027059DAE4CEC7EF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817465, "uuid": "dfdcae33-d6f8-4ae0-83f6-0f19f64c2f8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817465, "uuid": "592bd43c-db8f-42d7-aaaa-f66bc1f75daf", "value": "12288:prL2iNPf+B85Fr3MLWbCl/8KB9YrRdIivI3qZ4dDHRorzbZURfzTbNjH8XH9+/ms:pn1B+B85FQsmOFOi+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817465, "uuid": "ca1e8d24-731d-4c31-8a76-8f5bdd726c72", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817465, "uuid": "71257a22-0947-49dc-9d14-a1e25ae6a389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817465, "uuid": "62a667c5-ce9d-41ff-98bd-167f8bb8a97e", "value": "portfolio info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c138270e-f161-11ec-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1655816269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816269, "uuid": "5c5ce62a-2382-4374-87a2-9fe0cef7cec3", "comment": "Malware payload (STRRAT)", "value": "e14056d42f0dc171f938e41784a44cdf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816269, "uuid": "8d3c5944-3b9e-4f55-8e5d-ee0e000ad69c", "comment": "Malware payload (STRRAT)", "value": "b8209bd177e8200aaf47af1b063fcacc33c48c75530f83f5c08af41e98543e49", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816269, "uuid": "1c74a734-f7aa-4885-892e-4a63b3fc362f", "comment": "Malware payload (STRRAT)", "value": "8158084df6565fdda414aca65d230b96c60dbd1a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816269, "uuid": "703b2c78-776a-4ea6-b2f0-099fe64d7df6", "comment": "Malware payload (STRRAT)", "value": "29385c00d6753794a71484704cb93532833e106e78434c5ff3ccb9a831c13645335783eeeb982e85d8953fc812e97995", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816269, "uuid": "f7fb03f1-441f-4a80-b9a1-1b7452386f5c", "value": "T18BF3F15F3EEF44FDE05BA9364012912F6A0C4699E4A4A58B36EC188B4934D8F4F52DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816269, "uuid": "e4b29734-cf1c-413d-a24c-18d65915ff10", "value": "3072:IwCxMr+YMmf4EU9Q6n0u9TbrkFgOUcx0vOM4rkxsFU60xKFJs5DY:Ib0fD1u9T0FgOUI0liFMxKLeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655816269, "uuid": "6ebae58f-8d5c-4873-b604-f943560b2d49", "value": 168781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655816269, "uuid": "e4bab0c7-4bef-4cbf-8943-dd25d7a3e560", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816269, "uuid": "5021e5f1-89b2-49e6-8324-4aa5abcfb753", "value": "Img~039873655-3987365367383.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d72c315-f115-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655783406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783406, "uuid": "0e277403-112f-4deb-92a0-7701be0ca5f3", "comment": "Malware payload (Mirai)", "value": "2d240cd23e275fc781bdbf22c6250c10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783406, "uuid": "50991b5c-0c81-4b94-8cbb-47d50babcec2", "comment": "Malware payload (Mirai)", "value": "b8bf6ff925d8ed3bcf9630c155785ba91230fe3d525587ed65a10f16158f872d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783406, "uuid": "a394c357-31ce-4a4a-a88d-b645a3c39004", "comment": "Malware payload (Mirai)", "value": "3edddbda40931d4fdda147ac8856f70c9c4eb814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655783406, "uuid": "7aadca03-e517-4570-aa50-76531d5a125f", "comment": "Malware payload (Mirai)", "value": "95462e7f138aea33180601cea99f856715558f5267cffd79cb3fd5ee68ac14ba4bc1a0e2e64ca3129f4a0620e0f973ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783406, "uuid": "827245cc-bc22-4ea2-837d-d05420acceb5", "value": "T1A8E239C79943E9B9EC1506717133AB319B37F52B2258ECA3C3E89937EC02601E61769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783406, "uuid": "14cf19d3-ddcc-47be-b916-952c28698471", "value": "768:XBNYImp4EuJ7iR1LEd6LM4g5DfgFbOdDqqd5:XrYImp4EuJ7iR1LEd6l0D6bM2qd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655783406, "uuid": "c2c30e60-c87d-4997-afaf-f79bf806f77a", "value": 33552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655783406, "uuid": "eea1fe65-9bcf-4d9f-907b-9295d6cfc893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655783406, "uuid": "b7bb2fe6-15af-47fe-b57b-7d2d39cece48", "value": "flow.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384e875f-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806591, "uuid": "e1e96ca3-c170-4b48-b7b5-361788dc62d6", "comment": "Malware payload (Formbook)", "value": "1d93fbbb1895e55356b63fd37073ef62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806591, "uuid": "ad52f852-cebd-4192-8e45-795be80dda66", "comment": "Malware payload (Formbook)", "value": "b8cef7577e09d894f2136407634962aa9574f00c3c09651cafeffbed4e9b220a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806591, "uuid": "9b6a30fe-fc96-4eaf-93f3-eb4dc7225188", "comment": "Malware payload (Formbook)", "value": "994616598f9657eac8c3ebf8ce013aa3dc457864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806591, "uuid": "dfbb9468-0962-448a-b2ce-1360c93e3dfc", "comment": "Malware payload (Formbook)", "value": "90065356f5f1da41dfe401ea4d2558cbfcafcd8bf4a618d271717c13ee4e9b7208270b0de6a177903b92bc279c58d0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806591, "uuid": "9f802742-9452-4a2a-b93e-22dfa60bd4c0", "value": "T11E84CF5BF68C9B4CC3588AB1B4BA47340391DFA725329B05BDC4FF7C4A7129D6A402DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806591, "uuid": "3fa799d9-4fc1-4184-a05d-1a57a862099a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806591, "uuid": "a3b8ec77-0234-4953-a13b-af409ccd1925", "value": "6144:q5YTETwha81zPYoyB3BOxe9O9BwP3FFpqN:CwzxWBOmO9BwPVPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806591, "uuid": "da07ee4f-8ddb-4963-bda2-b7b30adc460f", "value": 379416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806591, "uuid": "de9a0141-aeb5-44af-a531-03686c2b42a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806591, "uuid": "69e20540-1c5b-438d-bcb8-d78a582e4e89", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5eb8696-f19d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655842101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842101, "uuid": "97d66f79-2dfe-4bba-be32-cd414ec43685", "comment": "Malware payload (Mirai)", "value": "e7533999ffb23b81b1b823a0848743c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842101, "uuid": "e072783e-41c2-4541-a10d-90f744376552", "comment": "Malware payload (Mirai)", "value": "b8e71b87d505cf2e069f6fee6585a02e9165fa545e58beeb34044c244f424fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842101, "uuid": "af9188cf-bcec-4403-ab1f-99d619b2ed10", "comment": "Malware payload (Mirai)", "value": "d658c6fbc6a77cb8dcb526e9f776dc9831d9fa36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842101, "uuid": "46527c6a-95c5-4a95-9a31-f65f42c84d24", "comment": "Malware payload (Mirai)", "value": "e9eb89cfe81247aba5b8e9c95e67c9e33ff3e1480733f80448162feb5dc9f40e81b74bdfb0d1b67307a7a748307917b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842101, "uuid": "dbdb6d28-0aac-4201-ab2a-9202a4a46c9e", "value": "T1B4C34C46EA418A13C4D51775BAEF424A3323E754E3DB33069D186FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842101, "uuid": "d128fe11-7329-49e4-8734-1327df3ffb39", "value": "3072:x2ywxneKaYcav6ucJAs1R1Ob+KomM/9MRj:x2zneKXJv6ucJA0RK+KtM/9Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655842101, "uuid": "0d4351a8-3a17-4c51-9f49-1c790d653b81", "value": 127636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655842101, "uuid": "c56127b3-c495-4ac1-8f5c-b2ffbf6eea38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842101, "uuid": "d77624bd-bb97-40e8-8faf-dc0b116edb3a", "value": "e7533999ffb23b81b1b823a0848743c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f97c29-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808192, "uuid": "b696721b-b93b-42fd-ae4c-827bc8d7db06", "comment": "Malware payload (RedLineStealer)", "value": "b30bf33772bdba178cfd92cb6bd7743a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808192, "uuid": "8e7bc8fe-04ff-4100-a8eb-37bf91fa522b", "comment": "Malware payload (RedLineStealer)", "value": "b935a3631c6339c007524258c2f077eb49a0acc2691f8c7ffc041424fb7d957b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808192, "uuid": "5063c556-0431-4f0a-af22-e19c2314f99a", "comment": "Malware payload (RedLineStealer)", "value": "2f52674f7d614b42a922e829bb17424264da13c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808192, "uuid": "02efee39-92d6-4ccf-8e66-85f53f4618c8", "comment": "Malware payload (RedLineStealer)", "value": "e3093bc715ef692dbfb7da8544e289f38a1e9ce85a3e261be1aaf6ab6114cda1ccadf8046806f7ae55ba9ee2d08d48a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808192, "uuid": "c1556a09-9b33-4a7c-877b-74c34c06ed62", "value": "T152933B6863DD6A24E5FE0BB47CB2521503B0E5425C02D7AF4FC1A0DA1FA2BC19B526F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808192, "uuid": "f5afa16a-a6aa-4f7d-8a9f-da43da7c3b12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808192, "uuid": "2615acd4-4889-45fe-9b61-7285b870c0ed", "value": "1536:+lfTrT0R3TMddLwsNMaq8bjbrULa64dktAx/myUzrwQx0X/:wAtTMddLtMiPd64dktAx/mTzr4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808192, "uuid": "4d56598e-5b04-44bf-8450-38acbc5f681e", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808192, "uuid": "50506df0-48e2-4c02-bfee-2dfd0e78d2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808192, "uuid": "07c6c80b-f2bf-4978-8281-3e59cc909184", "value": "LOGS SORTER.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec1a7f8-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803756, "uuid": "bf2b9ac7-f89e-4a8f-820b-35a192be3487", "comment": "Malware payload (Formbook)", "value": "80af3afaa92ab3ff88c01aeb2311226f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803756, "uuid": "1bec10c5-5cbb-4e8d-afe3-e9b116cef326", "comment": "Malware payload (Formbook)", "value": "b94931148a55c469c2f0c4b9a9dcabe5728b0d59401c2f43a3019e3e12341d28", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803756, "uuid": "8880f118-1ecb-49a1-b8f3-bee356a662b5", "comment": "Malware payload (Formbook)", "value": "c06c6780ef0995dbca0d65acd5ba93c063adbbcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803756, "uuid": "bc3cfd07-deac-4dd1-90a4-221b9ee38dc9", "comment": "Malware payload (Formbook)", "value": "0bb7b65145b700c6874c880e3433128a1179494620c13d546a360eb373846e162a5ef27edcd5001523b926e3724bd034", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803756, "uuid": "43671353-dd11-4c8d-b0ad-1ec662a30001", "value": "T1AA73DF65249E7104E14216F952E7E2DD90036E632D09570F2DEEF2F40B70E76ABF2297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803756, "uuid": "68923ecd-a768-41aa-a2ec-7be229812563", "value": "1536:gkMgB2S0cMoYfYBe+3qwEhC3gbbDNETa1MqQmb1HS66mMQba8qJ:gkUcMtfw3qDye3uW1YSHS6jad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803756, "uuid": "7e4f9bbd-9195-4f24-8eb9-6ac3abd0140e", "value": 73464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803756, "uuid": "759c69c7-f2b7-4894-8d59-512331bdd879", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803756, "uuid": "dfd6319d-b2b8-41b5-8b67-4920283c94d0", "value": "SCAN_INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378135c4-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801865, "uuid": "95b7b6a2-4a46-4142-a7d3-ef198976d268", "comment": "Malware payload (SnakeKeylogger)", "value": "ce1c3a0c0fb059b3da30b4f95832d50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801865, "uuid": "9d77c845-7b54-4e55-80bb-70295324957d", "comment": "Malware payload (SnakeKeylogger)", "value": "b96bb2719d6bd8552f6469dcf83bcc1373540ba26764596c32f0da7bf4315b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801865, "uuid": "93f90b27-8583-446b-96fe-dd4879b61f53", "comment": "Malware payload (SnakeKeylogger)", "value": "3973a2600851470ad3a40e6e0deb544fb093671a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801865, "uuid": "c3148b08-a59d-4cd3-a1a0-ef4a1296edb8", "comment": "Malware payload (SnakeKeylogger)", "value": "a7abf1d182b0d44533e990e333ccc3fd422cbbccf6673a254ab1795cf89bd9250ad565dccc9bd86e74c7cf879d057687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801865, "uuid": "7f9a4b2c-9fe5-4125-b77f-99de894f4fb5", "value": "T173A46C9CB22C74DEC89BC2769AA44C64AA50746FB72F511790530D9E9D1CB83CF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801865, "uuid": "28ea574c-6d80-44ff-b857-381a3255ead4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801865, "uuid": "843157e6-671f-4b77-83d6-789321490566", "value": "12288:kAnPIPyRhy/svbHfeGy3KnuKTqdwnM9N6k5EZoXSej:5hC4b/LUwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801865, "uuid": "3d70128a-30b5-4b40-919a-5414959874e0", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801865, "uuid": "f2472731-e7ed-47c1-8589-d2377bc05692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801865, "uuid": "d1cc37d9-d489-4094-a68a-03391fca8126", "value": "ueh9gg8Dil3Pb64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd07c91-f12b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655792935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792935, "uuid": "ef784806-2954-43ad-8118-303a0748a46b", "comment": "Malware payload (AveMariaRAT)", "value": "c71448ffcc5f907700eaf11cd13091a6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792935, "uuid": "bb6d35f4-30ca-44c8-8002-0f0a3f5ced67", "comment": "Malware payload (AveMariaRAT)", "value": "bafe9293adc71f4b1ee5554ac9fc84df77b89697e9abe2476ed6d3c11a3b56d2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792935, "uuid": "5ecff33b-1a51-470f-a29e-e8f279483f9b", "comment": "Malware payload (AveMariaRAT)", "value": "6aff95dda65d6a1b44e5e41578635b2c42ed7e32", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655792935, "uuid": "4891c08b-bce4-4f57-82ed-80ef65b3b79a", "comment": "Malware payload (AveMariaRAT)", "value": "ce97a2080eb1e621e479ff0c9b3f0e7e9dce13a32679e450a8dad02c21d8f666e470445726123f2e8f932c4ae39ec515", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792935, "uuid": "29f460f1-c446-421a-9c35-58a0d12b3f09", "value": "T13324CE81BBA38940DE082B33C16A09491736FF9239B3A76F7D98713D1E733D63A15946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792935, "uuid": "ce635904-0d23-43e4-bc82-bda44e0b67fd", "value": "3072:x04Ok/pUeLZJ9/HNQVgJMmjt7XkKraa21lmysv4c3ivL6rgXn9SE6H9+DmS8:ckx5Zb51UYaaECVyvL0g39ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655792935, "uuid": "6053a67f-8724-474d-89b7-7c4510154e22", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655792935, "uuid": "f43ce97b-dd7c-4d56-ab3d-7e558776e918", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655792935, "uuid": "532748b0-6f1d-4f03-954b-2a189ec28dda", "value": "A107 Amended Contract Prime power Logistic facility.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4b5ab0-f126-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655790917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790917, "uuid": "111b048e-8060-4af7-9154-f5d3033950fa", "comment": "Malware payload (AgentTesla)", "value": "46423822778fe795befd714ae9f44bf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790917, "uuid": "db45b35b-e2e7-43db-9f46-f050b8c3b0aa", "comment": "Malware payload (AgentTesla)", "value": "bb2501afef978abe94defdf1b67201f6dd8202e98dcb480b162f30ef0d2891e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790917, "uuid": "33eb3eaf-d3e7-4520-a2c6-2dbb1e2ea942", "comment": "Malware payload (AgentTesla)", "value": "cfac8236a112a2b6b25bd4237ec651b1afe9e75c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790917, "uuid": "f8ef393c-4426-4a49-a521-23e534885ae9", "comment": "Malware payload (AgentTesla)", "value": "6e64447d06db640086e69c35708afcab5215bd904acd2313aae784805a31ed07bbfbe842d8ab90f8bc34f7dba838a17b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790917, "uuid": "6df5370a-d633-48ef-a37a-53e7774d2c6e", "value": "T1CFF4F1F0AEF4B961E42431B370A4A03C37E35D1EDD61E836CAC7F44A34A66C556E1A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790917, "uuid": "aa6c2b9d-6066-4597-ad4d-3bb2f0c6bfd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790917, "uuid": "3092356c-e14b-4050-9909-b8a49f9cc405", "value": "12288:AZvybAQrP7OKaJ+JnecVAqkBriWvd3VgY1FPRRrUx5nnUfMrAvXhUpSv1:Ivy/rP7OKewneA0bm6jUHUfGmxrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655790917, "uuid": "822ef54c-f472-413f-a54b-bfe931820947", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655790917, "uuid": "de4da7ea-134d-4b64-854f-1f3103418fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790917, "uuid": "67efedda-5f64-4cd5-98ad-7be66d39bce8", "value": "009333.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a011ca-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809698, "uuid": "8ad0bd5b-5639-4c16-92fa-b53edbf0c9cb", "comment": "Malware payload (AgentTesla)", "value": "85b7ee3924df709b5c944960dede88f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809698, "uuid": "4d690106-e7d7-48b2-93a3-38be0a953f85", "comment": "Malware payload (AgentTesla)", "value": "bb344a756fd33cac2dc491df9b48d80ec0b8229be6633e7a9eb2b98353dcab2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809698, "uuid": "2217f075-1ddb-4a2b-80c9-dd9a5c26aef7", "comment": "Malware payload (AgentTesla)", "value": "d24a1eabdc9f2aeb2400d04fee0a7c11e1539b5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809698, "uuid": "833642b7-ce91-4892-b3db-0deaabbe1065", "comment": "Malware payload (AgentTesla)", "value": "3ad323eaacdf1e8788e777b382bd6b2b0e1be6fc97bcbb141e2b43a2a002d50285379dc81d8b2bb32e5d0f065aafc272", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809698, "uuid": "ba547d63-a428-405d-8c1d-2ac7c9bce296", "value": "T11EE4A83C2F7B67A1B145AC0CBD9AC9A81562571070942CB1CD71E392CDF1CEAE92E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809698, "uuid": "5349a46c-3952-4638-8ec9-afac5d0b988d", "value": "6144:dxXvpXUmIoHVbKbgz1U1RyQEpplxQ9KH+9uISW9OSk/R+7eUrqj2XiX86/D/m4em:dxXOmhz1/iez2Fce/Kw9GhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809698, "uuid": "0819f644-ffe2-4202-9e06-8e3f78677935", "value": 713385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809698, "uuid": "db1fa3a7-4956-4faa-b93b-9f6796cf0699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809698, "uuid": "a9008b50-fc76-483c-a585-cffc75d93e58", "value": "nanastart.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88053744-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808013, "uuid": "012f67e3-13d4-4511-986c-76749c703b39", "comment": "Malware payload (BlackCat)", "value": "bb894b37728d740eefae61bcf764f451", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808013, "uuid": "3a6284db-6843-4c4d-b6a2-db21db32f31e", "comment": "Malware payload (BlackCat)", "value": "bb6b249336cd7001b1c55d3724b5e35a150e752ed795c36e0d5dcba00eedb62a", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808013, "uuid": "6dae32d4-039c-48cf-9d9e-aa54731fd0db", "comment": "Malware payload (BlackCat)", "value": "097341af552574417e3f0d639655f05d1eed9af0", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808013, "uuid": "88a4a9b0-5ed9-4002-8747-8bca99940c05", "comment": "Malware payload (BlackCat)", "value": "46295580f22fe2b775ac0b7ae64aaf7b4058dd96d71ccd57378aa7c35e41ef259241a6558149aedecb84dd1d83216135", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808013, "uuid": "895c7760-037a-4e9d-82d0-ef16d3eb5641", "value": "T165E5AF95FB43E2ADEDAB1470345EB33ADE34481C01199FA3DBE45D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808013, "uuid": "08d7653f-56a2-42ad-b4b6-cd2e5136bb79", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808013, "uuid": "bac8951a-d5f6-4bf7-8aba-8930099a0ac9", "value": "49152:oQMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNlz5JkiHKAzQmy7:PO7xei83ksPBqanNz7kiHKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808013, "uuid": "104cfdcd-204d-4d95-bd78-a2cb7b8393d3", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808013, "uuid": "46c18b5b-a3c2-486c-ad61-55507d120bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808013, "uuid": "65262d48-4d7e-4304-8cd2-69c81a13c155", "value": "bb6b249336cd7001b1c55d3724b5e35a150e752ed795c36e0d5dcba00eedb62a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75089ca-f123-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655789597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789597, "uuid": "aaec1b20-3989-427c-a864-22047a5b86ee", "comment": "Malware payload (AgentTesla)", "value": "fb6fc6e3b30d6812dfeae16cce8c8515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789597, "uuid": "3d354640-70ee-4112-98b0-06bceb835668", "comment": "Malware payload (AgentTesla)", "value": "bbe68a460f86f18698d303d4150103c9c964acd4309f74d640dd1f9117615608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789597, "uuid": "f52f568d-72ac-4ecf-85b1-9d17865d78cf", "comment": "Malware payload (AgentTesla)", "value": "587574ed396e67f6d3094de637e890d068720c50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655789597, "uuid": "269247d3-b045-40f1-8485-0b44f66271b4", "comment": "Malware payload (AgentTesla)", "value": "146f32771d61145c21a45f77f36b554fd0caff13d2eeb5fb345ae1f023cefd950a777d64221f7858778c0bb70bff0daa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789597, "uuid": "8518e217-1791-4258-9995-688840abac07", "value": "T111F4F0F49FF4BA65E025213770A0A23C77E24C2DC895E539DBCBF44A34A6AD121E1E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789597, "uuid": "0d4c2c61-7513-45b4-b05a-37275076b7a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789597, "uuid": "5299c0b5-921d-4bda-8225-2b3a875c38c6", "value": "12288:yW0vo3YsmDLFJv6uQ6b2KF/bhxZJ51d9kR+CUfVuSLndcrAtat:yfv6YsmPFJra+X51ELfid2jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655789597, "uuid": "33a479a6-4481-4a30-b0e5-459590d065e6", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655789597, "uuid": "3c53e1bd-eb53-4176-8505-56ef6f415541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655789597, "uuid": "e558b6e0-7bc6-4ef0-b464-b580a8bfc35d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16859.26894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f8630b-f17c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655827605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827605, "uuid": "2934ec03-0ce1-4ddb-8653-f1b522a59245", "comment": "Malware payload (Heodo)", "value": "aff9f4db1e89178797e12399ece84417", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827605, "uuid": "ce194e79-cbd9-4ffb-a942-e2ad676d710f", "comment": "Malware payload (Heodo)", "value": "bbfcace2db32e33128a2b1de097c73b82ed132ba58016c86ffee2ff55e03bdee", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827605, "uuid": "568334da-ff86-4b61-874e-9f3bf1f9386b", "comment": "Malware payload (Heodo)", "value": "31aaed8fbe702f57b1ba4df395bbb1c816c795c9", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655827605, "uuid": "a237063d-8942-4778-bfab-04ccfaf9a2d5", "comment": "Malware payload (Heodo)", "value": "8c9e08b0f1c2a5a48eec36ac01dc62fcef6e0fcc4c460b2cdfab0a1e8df541b3cc49a9052138a41fdb04113fe0b4cb07", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827605, "uuid": "a2cce446-bd8e-444b-a343-3a0b66f20a72", "value": "T167648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827605, "uuid": "b64ee430-dada-4043-90ec-9a444f5002e4", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827605, "uuid": "7a1a5ab5-6efe-42a1-8971-87a60a112ba1", "value": "6144:JqdSTDcHe3kjHfNsQnwXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3wIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655827605, "uuid": "47c5d2fc-2bb7-4c49-8017-aa5f081a0672", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655827605, "uuid": "9a66f38b-4bb4-4628-977f-3811046f2cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655827605, "uuid": "c687dfb1-0d6c-47af-a33f-d1f649013eb2", "value": "z9MrftvbloX0Daniqv1ql8bBvrCBUgGrhE.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4c7f3b-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655833015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833015, "uuid": "5774eddb-2b73-4899-acf7-5e535264601f", "comment": "Malware payload (Heodo)", "value": "81df6885ea1237a019624a2f047f33e9", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833015, "uuid": "6b0fff10-7102-4a35-9aec-33d5572f2f11", "comment": "Malware payload (Heodo)", "value": "bc6d7b7c88d46a22fa0ce4cb21adfd4237fd4318983e4e271c3650cedfd92e7c", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833015, "uuid": "7b17fe86-b54f-4727-abf4-734baf0e9317", "comment": "Malware payload (Heodo)", "value": "3f32e185178e882d76d69f694a8fbda22c79263b", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833015, "uuid": "390b3bbf-9092-4ccb-a697-afd24b3a6e57", "comment": "Malware payload (Heodo)", "value": "0b5e237ed4826aa5083e6c9da053954952a63bdcf78907d3ceba2a853f714d79dd81425611313d634ed3f36316097009", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833015, "uuid": "3809979d-bff5-490e-ba3c-f8ab00edc87d", "value": "T15D64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833015, "uuid": "90679959-683f-4b84-9eb4-4e52823a53b9", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833015, "uuid": "a6d1f263-0c90-475c-ad48-b70bdd8232f3", "value": "6144:3MiSTD2He3kjHfNsQnAzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3XNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833015, "uuid": "93870adb-05a5-493b-ac7d-1f895454038b", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833015, "uuid": "faef6592-e4e2-4e4c-89c4-d8d9632cc526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833015, "uuid": "bedcaaee-78ef-41d7-a398-366a20bf218c", "value": "R1du.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14cbaea-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802042, "uuid": "c103254f-43a3-47ad-84e7-58462c694e84", "comment": "Malware payload", "value": "b353bbb1e921e32db59e483bb38f1e05", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802042, "uuid": "535db401-bf0b-4c61-bfef-3a9c1a900cac", "comment": "Malware payload", "value": "bd2bfeab82781780f389950717dc9b3be6f0b43bfc763311a2b99b13a70cee68", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802042, "uuid": "2a04e90d-17da-45f5-9fb4-5c3d4cae8009", "comment": "Malware payload", "value": "04409dcf16f974ab76d7b14163e73606f1235ab7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802042, "uuid": "46b84e83-64ee-4b69-956e-2e4f4da8fe7f", "comment": "Malware payload", "value": "387d75a4b904e78adf44e4ce702a40da9090ff7f63eb8be36cdfd76d155245bbefff583928e5836b75b49e7744a74664", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802042, "uuid": "5bee5ee3-6f2c-429c-b07c-e12fa89305d2", "value": "T19E367E22B284A13ED1AB1B3A8937E759993FB7712922CC4B17F4494C4F359803B3E657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802042, "uuid": "6637479e-3624-48d4-b618-adba0e9d126f", "value": "98304:syDwA/+uXjOFVhQY0bYtVp8rNGs9kdxcOY6A:s0wA/+0iFgY4YtH8rNj6dxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802042, "uuid": "5e1ed565-53fc-4fed-b313-c33e639052e4", "value": 5181440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802042, "uuid": "6b40966e-6808-44d9-b4ed-ff403caffb2f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802042, "uuid": "be02faf9-08e1-4d9e-96cb-a35ad58f0cf1", "value": "IDfac-t.165.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a885f31-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808661, "uuid": "77348ccc-ee62-4b0d-be8b-3a3ae42bd9a4", "comment": "Malware payload (BlackCat)", "value": "af6096f39f8235b25f55bba878f73c56", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808661, "uuid": "64e077db-5dbf-4967-a795-0fb1cc871a1a", "comment": "Malware payload (BlackCat)", "value": "bd4e603e953d8c7803f3c7d72cd7197d996ab80ce80b9da96a4df7d10969bb55", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808661, "uuid": "78918020-041c-4da7-8264-e101d82fb04e", "comment": "Malware payload (BlackCat)", "value": "1cf1ee9f8e6bc593364705747b4f4da6c024f457", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808661, "uuid": "70e4e53e-9184-446a-ad41-550dcd345f26", "comment": "Malware payload (BlackCat)", "value": "5ede7941e32847ce6d291386f09d2d7bc6ad8da4e877e5540bde68853279569375ff3cb6ba5650b012f5562f62f97266", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808661, "uuid": "4171f89a-7d28-4a19-8974-cc4c8da7916e", "value": "T115E5A095FB43E2ADEDAB1570345EB33ADE34481C01199FA3DBE44D71BA2EB101E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808661, "uuid": "09bd1116-882f-4764-b8fc-e607f8f599ca", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808661, "uuid": "d6550e71-a7de-48f7-bcac-d8981cf2e436", "value": "49152:2QMCsLWDIxeaBzz82uJ6sPBO/syljUnWuNDmnr2hKAzQmy7:BO7xei83ksPBqangr2KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808661, "uuid": "6769c5ff-96bb-405b-b12a-704c031b1939", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808661, "uuid": "98be1f57-5ad2-4c56-8760-9b25cae2104b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808661, "uuid": "f9905c5f-d7f0-4342-af95-cc1c66fe561d", "value": "bd4e603e953d8c7803f3c7d72cd7197d996ab80ce80b9da96a4df7d10969bb55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db186ca3-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1655802139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802139, "uuid": "065d9b5b-dadc-488b-ac94-e466f1025ca5", "comment": "Malware payload (Mekotio)", "value": "8560f7f38a13c676a72b708baad53359", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802139, "uuid": "7a0f6fed-b0bf-4750-a32a-b1979b11b53a", "comment": "Malware payload (Mekotio)", "value": "bd4f721c3e163f0f569b0ee6053a60a9904f6b0005bb3c4746737b21bf4eefdd", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802139, "uuid": "0102b1b0-ac09-4df3-9d66-bec07f2e7674", "comment": "Malware payload (Mekotio)", "value": "0fe9b1237784592df181634edefb4ad02687d842", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802139, "uuid": "0e64a608-1233-42b4-a124-9c611f825463", "comment": "Malware payload (Mekotio)", "value": "5737e6a47283624971c4883f1c27efc2f656839ab2b8b430219b4b4b8d81710bb5a281c19bfac5e86adac3d9a8e6d6e7", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802139, "uuid": "662d0efc-0e71-48cb-bdfa-3953e63c70e1", "value": "T149A6339E62B01213434DE97E88195D3C7A8FADEED7DBA4173404B66A4EF7C4E3B50248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802139, "uuid": "375c2813-31b9-4221-a105-73dc279535ac", "value": "196608:7WLTD2Z2mgVAdh8kkGGLfcJDoYb5QOvwd0XhqscLqDgb3Trey:7qDC2mAGkGroYGxd0XhXcWDYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802139, "uuid": "7543d7fc-7837-4752-8614-0d92b95dd28a", "value": 9651123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802139, "uuid": "c045ff9d-71c8-41ae-a2b7-7d0ee39b82cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802139, "uuid": "455ae988-c164-4d2e-b8a8-99cc7eea35ff", "value": "bd4f721c3e163f0f569b0ee6053a60a9904f6b0005bb3c4746737b21bf4eefdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557c6b1c-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655808358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808358, "uuid": "ac74b5eb-9df2-425c-801a-a3e4225a55e1", "comment": "Malware payload (AgentTesla)", "value": "9ed95993400eac1f5dae5bbd2488c8d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808358, "uuid": "c8c87132-f2ac-4722-9dec-8010b97b4be5", "comment": "Malware payload (AgentTesla)", "value": "bd512ff9c52942dba120322e971546a06ab9608154e0cc32a6430838956a6a3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808358, "uuid": "49c57dc6-ba2b-4a4d-86fa-6e64a99cf327", "comment": "Malware payload (AgentTesla)", "value": "37fa2cb8773fc2ecc2e3d5b7b2acf473c085c168", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808358, "uuid": "d170b1d4-9693-4af2-bcf5-1b978543521e", "comment": "Malware payload (AgentTesla)", "value": "dbe8056175f0e553b619464c3e958b69f57f28ad04f1c7be716561bb471f97bcc29d323b092adf71e56b626444697ae1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808358, "uuid": "b0ac4efa-2b83-4293-bc2a-61c42c36c68d", "value": "T106E4983C2F7B67A0B145AC0CBD9ACDA815625710709429B1CD71E392CDF1CEAE92E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808358, "uuid": "6e398fb0-3a4d-47d3-beeb-1224746b5876", "value": "6144:Q2NuzTTdbbeFgCqrv1XZ7+Wuas5DxQ9KH+SwISV9OSk/RlseNrqO0FjwDu6B0/a1:Q2N8dbv1T1eaoTe/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808358, "uuid": "89f5ae1d-1575-453f-ae12-157d1d7fd4bb", "value": 713277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808358, "uuid": "f4ea7d65-a3cc-4a9e-a0ef-d0b7b3b55dfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808358, "uuid": "17123b72-1e76-48b9-84f1-23ca05ddebc5", "value": "stanstart.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ade89c2-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655802300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802300, "uuid": "565ef2ed-bb3c-4be8-b269-7830790cb79b", "comment": "Malware payload", "value": "40b1f04ae9382c432b8b3ce0b7e9444e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802300, "uuid": "d912d270-65c2-43e1-a47a-0de1973b3b96", "comment": "Malware payload", "value": "bf48d2f27790889444f1f8d252a29b5c43d443fb4f8e04fa18a74da922f02485", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802300, "uuid": "d6ea472c-1f2a-4c51-a72f-1e4537dfe974", "comment": "Malware payload", "value": "20c66c15ea2c6f0b6a42d829064fe94d86153fa0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802300, "uuid": "894fd12c-c677-4f56-8600-5945f041109d", "comment": "Malware payload", "value": "968714d1829b070e3f16642c8ea99f9fcfcc8b96e974e7691e548a63bab6d93162b54357739fe50abac9f2c886ed9ccf", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802300, "uuid": "d2df48dc-fac7-4eaf-84fc-69b1ccb3cd06", "value": "T1AE73DE0D8BDDA34CD0491FBB99B5CAE01AF5BC72520A751A3280FBF90CF2F4918661B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802300, "uuid": "9b8943fb-78cd-4735-9e80-df96e7115173", "value": "1536:diVoDlP9+9K7n7XCNMgMqrw3iVlEAUr/Z2emMxnlbcKEG1VJQTMhgU+t:dz59+RNMgMqrw3FZ+SxdL1nQHU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802300, "uuid": "bfed6f01-d8c0-41c5-9f37-eb299fb50ba8", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802300, "uuid": "64008851-c903-47fd-b48e-a4edad0a21f5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802300, "uuid": "a32806d7-5cea-4d94-b6b1-fc525049a0e7", "value": "BILLING INV#_JUN0017.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96dcc0e-f18e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655835691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835691, "uuid": "5cd3cfea-01b2-4414-a9c4-aadc7fb46a00", "comment": "Malware payload (Heodo)", "value": "873cd021abf2fbb7cbc590e111171c97", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835691, "uuid": "1dd96cad-5834-44dd-99d7-534a5c4d061a", "comment": "Malware payload (Heodo)", "value": "bf533cec392bf8bf8a0770d3ef5f3b9e8ad546f565e668b14b31c8eabe57b004", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835691, "uuid": "4384a8d4-e6e0-42bc-b2da-33ef4f715345", "comment": "Malware payload (Heodo)", "value": "a4565bf47e168cb42e4fae4a56ec6e489573e449", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835691, "uuid": "49a88486-78d4-4aa7-9e2a-68ef49efd768", "comment": "Malware payload (Heodo)", "value": "1333037991db051d2845a70923c615919bf275551a85445785dd3917ce705be79910b94ac0baa8cb271c60b8f0f224d3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835691, "uuid": "7c395a84-c89f-4982-82af-135fc65a0b99", "value": "T1E6648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835691, "uuid": "6b6363e8-d50f-497e-8fd6-4f5e7446b5b0", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835691, "uuid": "532d46f2-4b4b-4c7d-8e2c-9b321fd2fa0f", "value": "6144:JqdSTDcHe3kjHfNsQnrXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3rIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835691, "uuid": "bd4dd09e-6c82-447a-b753-4020a697ae3b", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835691, "uuid": "a72bae40-2362-42ff-a187-0748e5f9f801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835691, "uuid": "2acec979-1c2a-437a-8870-eddecbcda7eb", "value": "873cd021abf2fbb7cbc590e111171c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f399a486-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803039, "uuid": "372efcbc-cbc5-41f8-8765-6c274ffef031", "comment": "Malware payload", "value": "f418c75d5a0eb0186f5111770180e6dd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803039, "uuid": "4fb09ce9-e974-4a7a-8b4c-0a599b0efb12", "comment": "Malware payload", "value": "bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803039, "uuid": "f133baf3-844c-4857-9811-f3d3571a1ade", "comment": "Malware payload", "value": "f098f8a8f7a195e2c16dc2127e74237a65dbf024", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803039, "uuid": "e83b8669-e741-4da6-a03b-76ac1c97a4d5", "comment": "Malware payload", "value": "10567da617acea385f9daf662c15892951e17461a7e55aa79ebbb638108dc2f67f5f996d2ebf99e3f47695b814988de4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malibot", "colour": "#76EF4B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803039, "uuid": "fcf70eaa-cd9a-4733-ae9c-07b536d2494d", "value": "T1B626F145FA95FE53C8F2933A053AE675E4098D249F43C287690837BD34BBBF40A852D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803039, "uuid": "c89117db-cbff-4f24-a1a5-bc3b5fa127bc", "value": "98304:fzotv9v3ySQyg13eIrdTO8buHsbxOx3PuEBFjv0jzMLoo2hyjkj/Vz4R1xCca:bXyk35rd1n9OZNWMLyhSkj/mXgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803039, "uuid": "96c206c1-a1c7-4f58-a435-319ffee488d3", "value": 4827233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803039, "uuid": "8ed3a27a-ed8a-46d5-8abf-e9c9ea73b525", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803039, "uuid": "3b27b9e1-3af3-4886-8a24-284a99f5017b", "value": "bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0953dcdf-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655851609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851609, "uuid": "c41478e9-1732-449c-8425-df99fd76c542", "comment": "Malware payload", "value": "9083bda9e608a440320ea165bd2cc5a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851609, "uuid": "e7d0ebbb-2139-4f27-b4fc-ee6e13578c56", "comment": "Malware payload", "value": "c0b483db178c827da049412903494593c97d8aab30035dd39b65c9618157726b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851609, "uuid": "78727ffa-e055-49d0-bd69-aa5e9c8a8a9b", "comment": "Malware payload", "value": "64b74b5e795247f243bf32b3d0abf3522956ce31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851609, "uuid": "d304a550-1f16-4614-b24f-bb6a6a680426", "comment": "Malware payload", "value": "d8edf912dda2e197e4a032b809d5a24c804c55e4d5acd19613f19d0c602ae038f5754848a95db567d9f606cc97f3921e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851609, "uuid": "dd0bbabe-a8fd-4594-89cb-be8ba9807595", "value": "T1D2F49F76B3E04837C1771A7C8D1BB66898297D113E3C988A7BE41D4C5F3A780376A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851609, "uuid": "9975f8aa-e28e-4e22-9799-91ec3b5c07cc", "value": "c7f3e11e6f6fe8a9de8b31827060af69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851609, "uuid": "c56a7e14-4df3-47d5-a108-dead8c98e6bd", "value": "12288:pSHEVZKP1O+hamzhv1fm3k7yxZF0WGNY:eSi7NvEyMeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851609, "uuid": "082c2c1a-b65c-4548-b4d2-38b3a09c3e0c", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851609, "uuid": "7e5aa1e7-8a5f-4ca3-8bcb-c7121ef03844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851609, "uuid": "b5f94bea-26a0-4bb9-ac37-00e5dd5fd006", "value": "c0b483db178c827da049412903494593c97d8aab30035dd39b65c9618157726b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e6d279-f162-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655816782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816782, "uuid": "524aea2a-d666-4f5d-a46e-74221ab59ef4", "comment": "Malware payload (Heodo)", "value": "bc801ceae6b85b6cf378d1b3ce6961d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816782, "uuid": "aafdff68-4f49-4ac9-87d3-8a3953f9ab09", "comment": "Malware payload (Heodo)", "value": "c0b609b0a994f32dfd5188ab8ba02e71b8acd30c95c4573c6a5aeebd4e6e01e5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816782, "uuid": "db4b4cff-74d8-466b-9aa9-22af988711e9", "comment": "Malware payload (Heodo)", "value": "f2442f1dc9f12220ce6f36e1d926d75308c76520", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816782, "uuid": "8f390c0d-716a-4915-b258-d4bc0858babc", "comment": "Malware payload (Heodo)", "value": "69f41ac8a7c1f246fb03b6c77279da3fe13a33d87c02d16cbe5a7318bb023be88d88588e7f408fc1a5ad9012993873ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816782, "uuid": "0330f3a0-3072-461c-824c-81e6dcceeede", "value": "T1FF43B646B65AD85DFA29C73548E747A9B323FC208F6B07833349B3656FB49A05E0311B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816782, "uuid": "3810c6d9-59a0-4416-9a87-fed203ecba84", "value": "1536:9+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dghQvCCVQO:QKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655816782, "uuid": "2871377e-78a2-4d30-9901-f8c740a42903", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655816782, "uuid": "56c26f87-49e3-4bfc-a524-3b776208ed6a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816782, "uuid": "4638acdd-6959-4639-8055-8d99aada4925", "value": "INV 2022-06-21_0853, USA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94cd0c5-f164-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655817518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817518, "uuid": "6161b36e-5233-474b-84dc-8a8ddcf3df9f", "comment": "Malware payload", "value": "4c66517e703cf9dc28dcf913e96e2fc9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817518, "uuid": "7bd7cf96-3087-4a62-a5bd-00e569dd47c1", "comment": "Malware payload", "value": "c1011f916f1812fb6d5f35adbd8e202c612d964e262dc545940680b87dd486ed", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817518, "uuid": "ab454a8b-7954-458d-9ff1-1b8dafc884c1", "comment": "Malware payload", "value": "780a322170c91ecc4aca873e47022325b4b8342e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817518, "uuid": "7ce91023-3a84-4fa3-b9a7-75b31d0556f9", "comment": "Malware payload", "value": "430c7320f9df385bec63c3b245f193a143c67e0d7aaca2914fb8d7bdde3bc4340fa911638bfac93f8528c895817acceb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817518, "uuid": "afee4402-f1d4-4e02-b2c4-d7c1ed708c10", "value": "T140624BBCF6884FDAC789B3F16705BA1D018DFC2953C2D6E36ABC73606B691AE5103460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817518, "uuid": "7caa9c6c-2602-4c5e-8521-8c2fb792d9f9", "value": "384:eUh/yt3+inh6YJBfjpJowJF7wOhNPQXRar7D:B03+inzDfV6sxhNPa+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817518, "uuid": "48bae750-b79b-4ce6-864d-92748ce9e561", "value": 14599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817518, "uuid": "07fdc24d-ec0a-4159-9374-60e905215ece", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817518, "uuid": "002f3811-40c8-453b-9b94-bd5ad96f0be6", "value": "CV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a36c83-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808257, "uuid": "4fc3b7f3-0c62-4c89-ba39-a52ec0bec66d", "comment": "Malware payload (BlackCat)", "value": "d0ecb14c0a4471fb66c6486c15d42ea6", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808257, "uuid": "b9041c02-0f2a-40fb-954e-63cbd61bef0f", "comment": "Malware payload (BlackCat)", "value": "c124dc2c4f82b3258f1538656de8cbd2c5133137cad2d6c7b874de8232763d95", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808257, "uuid": "f63e2778-0411-4241-89f3-6d03f50fb0f5", "comment": "Malware payload (BlackCat)", "value": "3a65eec2ee58ff18fc8c89f05f390b689c65250a", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808257, "uuid": "6c6e6e1e-bba6-4df8-9025-fe500862e5b3", "comment": "Malware payload (BlackCat)", "value": "ae4e46fafb99d20694bd41ac8e16a0b963d21d6536132930dcaabd56ab2b0aec4fcb7ef00c5a87f03f1440042c50228a", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808257, "uuid": "3a340fb8-c9c5-4d74-b998-e0840896f6a4", "value": "T1F9D59F46F693A2AFCE5B1570306E733BD638481E0219CE63EBD85D217B2E7315E44E1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808257, "uuid": "11b1eae1-04e1-4ac6-8a2a-056126d270fb", "value": "676f66b42797477a467945daedd979f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808257, "uuid": "aeaed506-ba86-471a-91b0-c97ad3a4cf73", "value": "49152:H0z5TqmuGSSJLiqwRrYqFrjsAkJxyNO/RgaJ2wp4:OVh/xGDCbJBvwwp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808257, "uuid": "2f52edb1-6233-4f0a-aa1f-799bbaa1a499", "value": 2994688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808257, "uuid": "97ac8968-8775-4978-afdd-fe7fa151506d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808257, "uuid": "bda11323-67c5-465f-8668-9189419208dc", "value": "c124dc2c4f82b3258f1538656de8cbd2c5133137cad2d6c7b874de8232763d95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9e641a-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655832015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832015, "uuid": "45b29c3d-d3f2-4cfa-b97d-1fb06a4b4467", "comment": "Malware payload", "value": "238b3f180184b7754efb0cd3778027c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832015, "uuid": "4b53ece7-e3d4-4269-b3c9-ebad5baad3fa", "comment": "Malware payload", "value": "c21ed59b191b35a4dcf3a5c611c38ddbbccd5cdb5e19d17fd19126ec249a6a96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832015, "uuid": "771238d8-6219-442c-b7a4-fd7f5eb014c5", "comment": "Malware payload", "value": "de3419e176403f36bc5b680d760076c2900df8c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655832015, "uuid": "72ed17a7-48c1-4d39-bba3-37a7d6da5916", "comment": "Malware payload", "value": "d9139dc3ad41c65433c3f1dc3c7623c43ad90168e46e3cb9a40c0349974b69f56fe923a7a91aa4a7972a7284a1fc3bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832015, "uuid": "2e5caa5a-c964-4514-bf5e-253c4921fa2a", "value": "T1EF25221B6AD0C772E53B02B9BDB25B4243716B295853A7EC345E644E3FB27200E537B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832015, "uuid": "f4e22365-f6ce-4596-bf6f-ebf0bdb6b31c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832015, "uuid": "b4cf71dc-3640-4528-99a4-7076ba40daa1", "value": "24576:XJgDXgGGj8CUbwZl9lVrD2YJqKGVmqBnWC2aR/wr8Xg2xf9WCT:ZW0Tn7rpsmqBnW3J6xf9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655832015, "uuid": "3420fc1d-86a1-49cf-b73c-4a684c32ac24", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655832015, "uuid": "98c98c48-a603-4c4b-94fa-cfef1c421ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655832015, "uuid": "29cb5faa-d1d2-4442-9e08-05ba4ec233ac", "value": "WannaCrypt0r3.0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4063d48-f13e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655801268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801268, "uuid": "3a6ec8ef-9027-40d1-b539-728c2150c431", "comment": "Malware payload (AveMariaRAT)", "value": "f890317fa129658a359bb44e3d68316c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801268, "uuid": "19b772ec-3191-464b-b5ab-99c56f9d5d1f", "comment": "Malware payload (AveMariaRAT)", "value": "c25d71266bb1f81af0184439ed01cc36d50714fffb84cfb7a717a8491dd96678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801268, "uuid": "7ca6c515-740a-4236-bc8f-7c6289dcb600", "comment": "Malware payload (AveMariaRAT)", "value": "9e271f3d33f788257b7399b3e7bcb30b1f6d59c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801268, "uuid": "dec6dbf6-b9c8-46fd-8d38-88eac9cb95d9", "comment": "Malware payload (AveMariaRAT)", "value": "83e245e7c7b506ffb9e67b3347fa2bc79c33022c0b7bc3594b5b93af9906ca923b25363fb771f8c552ad123ff23a2c68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801268, "uuid": "ef6bd5d4-bf73-4380-ad09-4a03157578cc", "value": "T133E48C4E16478DB5EC447BF1EEF312643A59EBF06DAA630B2299352EC0373A07E24751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801268, "uuid": "90780c7c-442f-4c6a-9e88-6cf2365bbbc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801268, "uuid": "04a23113-1ea0-404b-9efa-30682be6eea8", "value": "12288:fplH22qla5w/yXbxBjMdVjPEyyMCKpIyurKsIuX:rH0MW/IbxBjozEhMs1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801268, "uuid": "1a2d6904-a672-4e39-b6a6-c899f7cd669f", "value": 705192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801268, "uuid": "2de306e4-59a1-480b-88b2-f30613dcce2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801268, "uuid": "4191f6cb-926f-49fc-b341-e7abf8a076cc", "value": "donexx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9a4270-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801771, "uuid": "fc003da2-6ee8-4d69-be60-da6402117300", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b5b7e4c391373f30fc13755c3e04d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801771, "uuid": "a095bbcd-9cfb-4565-9aab-5aebbd3dca36", "comment": "Malware payload (SnakeKeylogger)", "value": "c25fb05bbc4bf99aa03b6de0c16dc97f681b27d31c2a79e05eeb537e473b236c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801771, "uuid": "1c5d4483-b866-46c3-90e2-8ef946555cf7", "comment": "Malware payload (SnakeKeylogger)", "value": "90a06fd7df9076521a534df01e556218295a3eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801771, "uuid": "a1354b6f-6b3a-4ee1-9477-2dabaf20c2d5", "comment": "Malware payload (SnakeKeylogger)", "value": "608bd690357a3ad6b0b7b8da122d9f941ab6fe8c6455987101cc499e5e2cd20f1b5544c096cf6e68208e68df8e05b495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801771, "uuid": "db7c090f-1ac1-4919-b687-d6673190dfb5", "value": "T1E8F4D0E87AB0759EC427D432B9A42C3CBBD2682ECB0BC217D187609D654D9C7CF509A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801771, "uuid": "e635e1a0-f3fc-4c47-9d32-4e92ba3066eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801771, "uuid": "d812fe82-78ea-4e90-94c0-5b480001d2ae", "value": "12288:iLvEiqEDpaaTGAdjQLBspPc0jwdaRwrUb6X71NyRu0eXLOMKWTxWD83t:SvEiqE2Ad0LBspPbJRwAOX770o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801771, "uuid": "f6d5bf29-15b4-4bb0-82ad-e88b7d7edcfc", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801771, "uuid": "3792a2e0-2372-4061-92dc-aaf77dbb7f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801771, "uuid": "7e57492d-0a2c-46da-83d3-32cc83d9d4f6", "value": "e2b5b7e4c391373f30fc13755c3e04d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0af2144-f13c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655800457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "bda60a7d-25c1-4e5c-ace5-706763e09a41", "comment": "Malware payload", "value": "bd019c9c84a4997277119e96bd17c9cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "2e83211c-a78f-415a-a9f2-46d93f10be22", "comment": "Malware payload", "value": "c2fe1a7a1cab92763c6652f5dc46c8a7597219aeba0bff262d4f511f2dd130e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "cd20eb58-4d23-47da-ab8b-3207da398caf", "comment": "Malware payload", "value": "2251988c8e5daa477b418353ebebb191c1abaf19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "fca046e6-cc57-4940-aa3a-3cbd5da56830", "comment": "Malware payload", "value": "9250c47aeb13383ba7fe0998f75b78bca6f4f9b1de026ca884be6748014272326eb0ae2f6253662a5c9953760da5214f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "1fe600da-a0eb-4741-b557-b9f6a4099ea4", "value": "T1D6249201B650CA27C68805364CDBDBEE6B38FD06DE91CB1B7599332F3C7A7988A16744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "474026a5-1ab7-4cad-bf5a-031f54aaaa1a", "value": "3072:crmK5fW3Xc51BZUV6/ALU2sMWsq/uhASKEYORhClGg6eObExAwh+gUcQKKOUub5+:zmZxxn56oNwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655800457, "uuid": "8d7e2bdc-6d1e-4361-a910-bf39877c52be", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655800457, "uuid": "c4142de5-9c8b-41ba-8f7c-f4b43146be66", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "04d0ae19-a402-40e2-9993-3af86cb0a947", "value": "SecuriteInfo.com.W97M.Apostate.32052.5510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebca9867-f175-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655824931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824931, "uuid": "2879172c-7a3a-416f-af30-2507cec80db3", "comment": "Malware payload (AgentTesla)", "value": "5613737a059eb1ab4d944b246fecdfc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824931, "uuid": "f9dd7901-ee29-45b3-a664-26ba61fcb2d6", "comment": "Malware payload (AgentTesla)", "value": "c3c7f3b2f8f5820339858d5e5a1965f3a20d27d85cdc8c4a377159bf49c0b156", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824931, "uuid": "2210716b-a5d3-4261-812d-f249122fdab0", "comment": "Malware payload (AgentTesla)", "value": "b28b4fe7de745674291e5c37f8c58b470765f64a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824931, "uuid": "c2071e2c-6c2c-48dc-a65d-e36a97cd2f1e", "comment": "Malware payload (AgentTesla)", "value": "c089a1c9939a9f3006ca63b88fb155107313dff0b3c90422b60d4cfa477f6adc28ea9a6afbfd2d02c0274eae4f0b964d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824931, "uuid": "2a01b99e-c369-41ce-8db8-60c4a68b14df", "value": "T1C2052AAC355C75DFC86BC579CAA81C68EAA0347F931B4147A027059DAE4CAC7EF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824931, "uuid": "5f3d265f-8708-4427-a3cc-bf622c02d142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824931, "uuid": "27128b9d-5710-43fa-92dc-ff6dd21f64ee", "value": "12288:jN52iNPf+B85FruQ4MHfMQzhOYKSGsh58/TMC63i7WnGEQZIyKdwn7BRXTEaGv/s:H1B+B85FlzfFzh0SIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655824931, "uuid": "1670327c-a698-45bf-b448-486c9f8d9f9b", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655824931, "uuid": "6af8f3ed-637a-4d64-928f-6370850780db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824931, "uuid": "830d75aa-a4c5-4f88-9ab7-344ecfccaff9", "value": "Bank confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbd3a5f-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801818, "uuid": "fb0b1961-8dc1-4597-b8b3-2bdd3382a1ac", "comment": "Malware payload (SnakeKeylogger)", "value": "7dbd9425ea756416c887121cd5ded79d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801818, "uuid": "1c9b6909-cc2b-4aa7-8e2f-da54bc7fab28", "comment": "Malware payload (SnakeKeylogger)", "value": "c3cb0ff8e108ac4b0846f07165cd9ab8d2c99cf3486fab221d02fd4933a2be0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801818, "uuid": "cf544add-2428-462b-9ec9-c98c83b8c965", "comment": "Malware payload (SnakeKeylogger)", "value": "ad13437beee46bceac0d097bb10bbf319f74ede4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801818, "uuid": "07b626fa-2b74-4594-b01b-e8524a77e9da", "comment": "Malware payload (SnakeKeylogger)", "value": "8323b329e205454bcd026378e128ad9b7fe047d2aba76988ef478eb53640fd27b847b180210d2667dd8c30e0a78703ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801818, "uuid": "d0f7af86-7e0b-43fb-9a78-39fb03805a17", "value": "T18AD4BE9836A0B69FC42BCE76C9941C5096A0A4B7531BE307D98711DAD94EBCBCF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801818, "uuid": "9acde7b3-e52b-448b-9b90-f7d3b95b6ec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801818, "uuid": "caf0af7a-ba79-4ebd-b210-7c50e616c8dd", "value": "12288:fK+PA4Bn2iN9KnEuhMP0czi9EeOowRttM7hDvbAqU:iUjBn1330Oi9S/RttsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801818, "uuid": "530f8a43-32bc-4847-ade4-dfd8c231cbc5", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801818, "uuid": "7de0d091-c530-410d-a48d-ddd05b35d2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801818, "uuid": "aa3ae6e9-fbd2-4d06-bc76-114e266329ff", "value": "AWB #5331810761doc.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bced5300-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655782332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782332, "uuid": "00c04db8-2d7b-4472-b6bf-375d78814296", "comment": "Malware payload (Formbook)", "value": "de2cd109f695b88d742bdd5bec722e2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782332, "uuid": "60786f32-515a-43ec-af07-4fd5241b87f5", "comment": "Malware payload (Formbook)", "value": "c40aa321d68974fa713dc4818c3fece5046dd2bffeddfe6227435a4e6eab954c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782332, "uuid": "fc57d767-f967-42e6-8920-690032b43c4d", "comment": "Malware payload (Formbook)", "value": "ab6369cfdf4ef8269208f76c0363d22eb0cdb039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782332, "uuid": "eb160922-25bd-44f2-ad15-ec7260fb7ebf", "comment": "Malware payload (Formbook)", "value": "9834f5de59dd33d0801cae4dbbe60b4c8ef7bf0b34bce086c204a0ee7c018bdcfc3936f87b340dbe9f5e97609b7671e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782332, "uuid": "f59dacc9-d725-49c7-8150-b598b4c8b6f7", "value": "T166B4E0F18FF4BE61E0252277B095607C3BE20E1DDD55E939D69BF04A34A1AC514E0E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782332, "uuid": "88a67d44-3ec1-4197-8964-3e1a3feaaf15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782332, "uuid": "c91d30ec-1e7c-41a9-8ddf-40cab47a081d", "value": "12288:f2vPYMGXDHUD2TLV3UA6R/f2OYZSbo9p:evPKXDHUKTLij37YZIo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782332, "uuid": "d22efb79-d0b3-4e1d-b804-92cfe265afcc", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782332, "uuid": "97c190f4-8fa9-4461-9c85-dcab9a4eb547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782332, "uuid": "a999e22d-cb8c-4bd1-8461-63fe6a043245", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31306.12386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581a89e9-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1655835850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835850, "uuid": "d3b77f46-c0d0-478f-abc3-325e64577672", "comment": "Malware payload (Quakbot)", "value": "8263867f88acd4db8ced097f5f3bc210", "object_relation": "md5", "Tag": [ { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835850, "uuid": "a1389299-72c2-4675-954f-ac0de36cb3e3", "comment": "Malware payload (Quakbot)", "value": "c4d37795635439a50a0f1c917a15107a4cf5e1d27d96d6d44644de68f9c0024d", "object_relation": "sha256", "Tag": [ { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835850, "uuid": "e70af3ee-4174-4150-b773-c8830258286d", "comment": "Malware payload (Quakbot)", "value": "c7254f83879796c35a1efb37a7ec1cbc2a38746d", "object_relation": "sha1", "Tag": [ { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835850, "uuid": "5aeb7552-4c2a-4b99-9d38-85fe967a65ee", "comment": "Malware payload (Quakbot)", "value": "86dc4d6f17e8f6e2630fb61073defeafdf48cb40119146beda583b8012e9697d384c46c55cbb229e193cf82366936547", "object_relation": "sha3-384", "Tag": [ { "name": "obama190", "colour": "#38FCD4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835850, "uuid": "9d233b48-9c1a-4cfe-bac1-089a90f1a98f", "value": "T168217795B7DEC89ED678713D56964A8D02EA6C0D8D066BEB13C289C04AFFCE1198025A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835850, "uuid": "3b912017-cabb-4a24-acd8-2e51308cefbf", "value": "24:97r3kkapFdHlx6i3UzJROL9XCJpmZeJmHCiTq/xBWgcetdu:97cPHTEFROLh3MYHCB/xBWxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835850, "uuid": "f7397c41-8c8e-493a-a86a-518a8858add8", "value": 1229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835850, "uuid": "ce351615-b1c1-4a12-9f8f-b677c13f8473", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835850, "uuid": "7e517fec-31d4-42b9-accd-3214b3cad724", "value": "Scanned_75678968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0f0c66-f11b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655786278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655786278, "uuid": "acf5de1f-5ae9-4ac5-b481-e93b1c779a56", "comment": "Malware payload (RedLineStealer)", "value": "c27f62165ba43b6e1bdfde864a5823b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655786278, "uuid": "c8e7edb6-0beb-4019-b26c-72c2eedcc76b", "comment": "Malware payload (RedLineStealer)", "value": "c53c487a8015ebab2abdd41c3f6c4f649a7241d591be150b651f02307675cab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655786278, "uuid": "4412083d-cbee-4d37-9067-38c59853b825", "comment": "Malware payload (RedLineStealer)", "value": "2016d3f8637daa765bf7bfd92c862363ef370f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655786278, "uuid": "45172bb7-73ec-4da6-ba4b-427391c6545a", "comment": "Malware payload (RedLineStealer)", "value": "d2b932fa38bf126f2e7df3f33b8fd8dc5e1b2c308d77821525f1f1aeecad1fd5f6d3e9aa283010647a2a8bb5040da53a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655786278, "uuid": "0660d3c6-fe7b-4531-80e3-58425554b79e", "value": "T1E0A41262FAE4D032E475563204B11132673B3C416770ACDF2F9827A62F616E1AA773DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655786278, "uuid": "ed2adad3-4081-499d-b158-0a2f7aec825f", "value": "95f4e9ca9e20b4b46fb87b6036610cc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655786278, "uuid": "8b357307-2b9d-4640-beab-01f5b052bcfe", "value": "6144:qOgSWGdcPCprRwf/mdd9PzrKFtzYF+ia5vLFDQG2JHG9CF1eh7GcktkN0YLcYaQe:a/GuFY2M0iMvdB9zMckqdGQLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655786278, "uuid": "54f16163-2ecc-48c2-afa4-ca40b4989326", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655786278, "uuid": "4f14d1ea-6498-4307-9613-4a174b0c2828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655786278, "uuid": "c3f64ebc-3337-40fe-a6af-d9ea5572fdd1", "value": "c27f62165ba43b6e1bdfde864a5823b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe72cc0-f143-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1655803375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803375, "uuid": "515dc3be-8a78-450d-a901-9b98e960e7b0", "comment": "Malware payload (CobaltStrike)", "value": "e5cceb42d02cd466ac16c74038f88529", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803375, "uuid": "b02bcbd9-e5f6-4f4e-9d72-9c9385a6f880", "comment": "Malware payload (CobaltStrike)", "value": "c5c593eb10459255fb0fa5500d3f047a44e5995fe6fd43e3dcc49f55501be30e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803375, "uuid": "c6876fcb-ea61-4fe7-9004-75cdd955031f", "comment": "Malware payload (CobaltStrike)", "value": "90a63aeab574f35c29560774a150f39a39703ea9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803375, "uuid": "f74b77ec-36fb-4e9a-9e7e-bba1967af308", "comment": "Malware payload (CobaltStrike)", "value": "3080eb7ed1078c026bc88ea3e0dd53d96c2fe28b4717d4c2c4fe06dfd3bb5230fb6353cb8e663701ed492c50ceb75d4f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803375, "uuid": "b6a482eb-c617-4c34-9317-aa9140ac12df", "value": "T1AA54CF64DC5E3953FF8887B91607A73E2A3CFED102459D152619850CD8FBC28C9C7EA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803375, "uuid": "5bdfa21a-f0de-4537-8406-08ac8e363691", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803375, "uuid": "0deaf2f2-e8a6-4d0e-af3b-0ba1a2458aa1", "value": "3072:GR0OPSy0WTW4cpwQ9kaXkug8nWQmkOiFnnn1xLoztnoIse:GR0OPSy0YubkOnWCOUFoBnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803375, "uuid": "91e8f7de-0db8-44ec-98c9-edd60bfde9f5", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803375, "uuid": "9fbdd727-15fe-4acc-a055-dca4940eb2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803375, "uuid": "1a8f3411-90a1-4db7-8b77-686712cad89d", "value": "111.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f0c538-f147-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655805003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805003, "uuid": "61992e6c-1b39-4eed-82c7-2db63a257c82", "comment": "Malware payload (Mirai)", "value": "63a4a99e6363b28585c18bc612597409", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805003, "uuid": "5aa86305-5bca-4e05-b3ae-3ffaa275a434", "comment": "Malware payload (Mirai)", "value": "c605e0b18a96308d12162612c4d9daeaf868a5324a6f51bc719cf94a9883c5bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805003, "uuid": "976f41e3-1e13-41e6-9bf1-2fc5c1eddeed", "comment": "Malware payload (Mirai)", "value": "30ab3968f6d143958b27055261ba0ff6e4fd14e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655805003, "uuid": "f95f92fb-d0d1-4ee9-a1a6-e4d3d20d2882", "comment": "Malware payload (Mirai)", "value": "64501dafcae14480714c6e587dfed86eeddd1d34832870788a14583de4c4b64f66912008ea702effaad6b174a68bf00a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805003, "uuid": "73d254fd-afe4-4afa-895f-07354d1fe0f3", "value": "T1FCC2E1EBB419AA96DDB1E53F9379DD218253EC0094321AB8EADE5286333253DC130ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805003, "uuid": "9a5e3afa-8775-4b20-9f66-445458d2f362", "value": "768:yx0AflXD6tzQdm9MViP8f++qeDNNrMRRT69ewNbpKxKn:00A4zMqrP0qeDNaYRrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655805003, "uuid": "660371ba-5449-4665-a2da-110dbde8e386", "value": 27932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655805003, "uuid": "897a6c2e-f9af-47f8-aad5-38cdd1f758a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655805003, "uuid": "4e02d9dc-359d-4eb0-8986-63a5ca57aef1", "value": "fuji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832ec17c-f1aa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655847518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847518, "uuid": "28aadd96-4783-486d-81d3-83cdf2721b27", "comment": "Malware payload", "value": "d8bfaff09f2c9aede378f5796e4fbec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847518, "uuid": "5a9d213d-27aa-465a-b1b4-21d33fa01864", "comment": "Malware payload", "value": "c66e6a45dee2a8b16e4aaabd32a71b6a0b88d3d97765e60b0e0247faae6f975c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847518, "uuid": "51f1c1f4-ab55-4cc9-b2d9-eeb8a1899444", "comment": "Malware payload", "value": "cb37beeadfc858ecf4a4fc09bf846d6915a59525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847518, "uuid": "654fe11b-f8ca-420f-b922-c24533a56285", "comment": "Malware payload", "value": "1f358ac14237e7ba0a35e82744b76cdca9275b1b691d4adc9bea5c9489795de49f863b137d5e919af31899658f7f9e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847518, "uuid": "c9138311-1691-4345-805e-8eb643e52f4c", "value": "T108648C0236A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847518, "uuid": "3f2c5ad6-1b43-45f0-bf3c-35ad741a94e1", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847518, "uuid": "0505d44a-f687-425d-8631-6c7609c117f9", "value": "6144:JqdSTDcHe3kjHfNsQntXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3tIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655847518, "uuid": "22c2b58e-e349-4802-9939-f0b303a0249e", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655847518, "uuid": "f8cae1ed-827a-41ed-917b-a98c7123c47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847518, "uuid": "349b4e7e-5f07-487d-8c88-e053b763d4c7", "value": "d8bfaff09f2c9aede378f5796e4fbec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ecd36f-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840540, "uuid": "eeea044f-80a3-43bf-b95c-3ee170825730", "comment": "Malware payload (Mirai)", "value": "ea0458e07a7283f6081755772decbe80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840540, "uuid": "cebbadec-c4d2-4c0a-9825-e9f3a8f8cdad", "comment": "Malware payload (Mirai)", "value": "c7b9e3bb49fbdbc5190ab1675d4d855a93a7507d4988626238480c40c514d7f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840540, "uuid": "37019210-8265-4e1c-a5cc-e44e045053dd", "comment": "Malware payload (Mirai)", "value": "5deabd6e0dfd25654a165203a86edc15a1bab01e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840540, "uuid": "586417f0-49dc-4701-9ad3-b87d4ac8adaf", "comment": "Malware payload (Mirai)", "value": "410693ca24c1da0df94a84aecab7d8e3c8e1baef529e3a4e1aec7e80cc1545475a608e22f38b2cca66171e1d8dc63530", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840540, "uuid": "b53a9bde-d4ba-4f43-994c-72ce501331cd", "value": "T182A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840540, "uuid": "5243ffbc-efaa-4432-9f36-ab244a0286fd", "value": "3072:Vgdr2vIBAxMyAOLRcft3hOemuxVqDr78fz1e:Vgdr2vIRyAYcZhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840540, "uuid": "ac8d50b3-f478-40ee-bcae-2456c8489240", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840540, "uuid": "0ad20f3c-138a-4d3d-901a-78074948ed62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840540, "uuid": "ff584e6a-ff2c-45b6-9f71-91d8e2c1eb66", "value": "ea0458e07a7283f6081755772decbe80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5006f505-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840561, "uuid": "7d7e0ec1-63aa-4d52-a98f-493ec4fde757", "comment": "Malware payload (Mirai)", "value": "1efd365d0ba7f9de47ef5e033949d565", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840561, "uuid": "fc38c772-75b8-4e62-a3fc-aef8766e6fc3", "comment": "Malware payload (Mirai)", "value": "c8624bef245bd431194f1b873825c6be8d6a66b23e459a06d527ff6ed25f4bc1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840561, "uuid": "b5a7ebce-764d-4e30-b699-e4c5ee0ee322", "comment": "Malware payload (Mirai)", "value": "59951291ca9b2fe41b3eeb88cff24d289a4fcb66", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840561, "uuid": "6aaec105-b343-46fd-80c8-b82e60ac0b2e", "comment": "Malware payload (Mirai)", "value": "32030cf806fe74a316b3e3098c642ca654df69c6dc4ca76af03cc816c32a828fe4522202e102d5a1a15288b378efbe71", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840561, "uuid": "b0addee4-4e9a-477c-a2c1-d53d2036f057", "value": "T1900418836991BDFBC5C6DBB957E7E12145F3F8351B222206B3D9ACA50B1DEC86D1C208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840561, "uuid": "5137ef0f-64a0-4f6f-9c08-941f05320ba2", "value": "3072:9rwdzBgNL4+6/nZZ1psRIhz3nPPNv+ah8ifvJgGKJa3NpHAxP2hgt:9rwgGzt39eifvJgGKJa3NpHAxP2hgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840561, "uuid": "891e2a06-3d03-4788-a7cd-64fc22027ef9", "value": 186409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840561, "uuid": "aaa796b0-4b01-4396-b323-a872f5bf54f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840561, "uuid": "18ba450e-da3a-456e-8f1c-8ced22abf5f7", "value": "1efd365d0ba7f9de47ef5e033949d565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c276fa-f195-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655838342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838342, "uuid": "1300be83-7ca0-4299-9c18-d452885d582d", "comment": "Malware payload", "value": "a09f93f7606aa64851c9a8f82317b72f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838342, "uuid": "268e2665-2ed7-4e20-a126-eeaea56eff06", "comment": "Malware payload", "value": "c9777cb78779de98104f1a01584f9df07e39b7ace7d5e6686d225e7261bd9447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838342, "uuid": "822a3b49-b7b3-4d4d-9d52-f1c619e87eb3", "comment": "Malware payload", "value": "c33ea2eb219a088610847905251e5e2c3d2c87a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838342, "uuid": "6b9f0cd0-8ab9-4def-b128-9de0b746aaa2", "comment": "Malware payload", "value": "048cb918e5aad715b8862a793a88dd670101cdab23a9e346eca48552c59fae0f338b9f834db0405c710c74e2a6588259", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838342, "uuid": "6e644926-b6f5-4ceb-883d-9878d88950c8", "value": "T13BB4C09C7550BA8FC86BCC7289A42C60AA606477930BE247D49716EC9E4DADFCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838342, "uuid": "cc82c73e-518b-4e3e-850d-fed91d64742e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838342, "uuid": "951529bc-bb99-4df9-8ae0-09dad590339d", "value": "12288:ML6RKFDBJG4SYpxCqFVADHJgFOYs6y0WUu5douHwXOTSC7yLcYfIt:ML6RcJG4VCqDAVwtvu5doV+WC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838342, "uuid": "455c178f-6993-474e-92ff-c23936ab6379", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838342, "uuid": "62e08432-0100-4412-8f8e-f7de583152e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838342, "uuid": "51a4bcc8-4503-425c-b935-d5a0245e1e8d", "value": "a09f93f7606aa64851c9a8f82317b72f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3197593b-f195-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655838362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838362, "uuid": "c8e1ed9d-c738-48e5-be6e-48a312d9f17e", "comment": "Malware payload (Heodo)", "value": "58387ed7a02bc9e747ba7601d64a2362", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838362, "uuid": "bb7d8318-e5ea-4a5d-a0ed-463fa9ede7d4", "comment": "Malware payload (Heodo)", "value": "c9938721ae8bc2024407b5a5ee7040cff38690424db0b80a08cc3dee5795c7dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838362, "uuid": "c836205a-41a6-4a47-bd8a-1375c36df489", "comment": "Malware payload (Heodo)", "value": "5c54f4007f5ee9ae4bd81bcec4ae2dfd2a416ffb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838362, "uuid": "fc79eb26-95db-4928-88d0-ddbaf29ba6a8", "comment": "Malware payload (Heodo)", "value": "2eccba6bb01a6167a6b3f2b8372d8f32176c6b3bc2ffbd5407b48b8439eb8213c3fe4574f84aceeccba216110dbe5241", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838362, "uuid": "e09380b9-30d7-43a7-bd88-2d8249cee347", "value": "T10C64AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838362, "uuid": "0e337720-8220-40fb-a87d-46e02c6e785d", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838362, "uuid": "1ca68f72-8b28-4080-977e-0637f0e02787", "value": "6144:3MiSTD2He3kjHfNsQnRzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3WNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838362, "uuid": "dc8e4701-86ce-4d85-bc5d-fcaeeca49c1e", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838362, "uuid": "62136663-f949-4382-964d-b7e1088a9bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838362, "uuid": "56c418f3-7be3-41a6-8d75-6c6fce999180", "value": "58387ed7a02bc9e747ba7601d64a2362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb6cd87-f146-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655804640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804640, "uuid": "aa841d84-66de-4bad-b6af-acf65773fadb", "comment": "Malware payload", "value": "6d806a5b0390262b5ef4687ba10c540c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804640, "uuid": "c1a8343e-21a1-4505-abdc-67d43723df3e", "comment": "Malware payload", "value": "c9d0d65ece17239b50f97dab502ddb34ada08ef2f1f9c0747e30fb4ba3ebfb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804640, "uuid": "2d4efb1c-fd7c-4b10-86d0-d02f10e7738c", "comment": "Malware payload", "value": "2ce90ab46c620f84dfb36a3e97ae8f27122b142a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804640, "uuid": "fd1cbdc3-587c-4914-b8df-a8cdb0c83ac5", "comment": "Malware payload", "value": "b3e8ee99dc26983b83e5fae45a7c6ed8c16508b2438f26e8e8765cca4988d2f0d4e919e06f1e179798d9163629ed48cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804640, "uuid": "646e68a2-655d-4167-9fa3-804301ca940d", "value": "T1559439343DEA502AB173EF6A9BE475DADA2FB6733B07685D109103860723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804640, "uuid": "903b9a93-15ae-46e4-9ada-4c3ba9a20519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804640, "uuid": "5f3debf3-2123-4736-9622-21adf362e475", "value": "12288:YDasZ7ZUnxT15axosphrM2taKZKIty98Fch:YDv4nFDyy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655804640, "uuid": "4643c3f0-3eb4-4a1d-a2d8-ceedbea4a393", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655804640, "uuid": "052501b2-b914-4a6f-82a2-5b6fa3ee09ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804640, "uuid": "7540ce89-8797-4d7d-90e5-4490d5da02a4", "value": "dilemma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e646c77e-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655808171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808171, "uuid": "4260563f-9db3-4141-b6f5-d8fc71ebe727", "comment": "Malware payload (RedLineStealer)", "value": "ca309b19800b29c4b869ba125717dfae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808171, "uuid": "11ebf5c0-a273-4598-9c3d-4f79f93a1d37", "comment": "Malware payload (RedLineStealer)", "value": "c9d44c7b2808aa1e02fc0bf862408b77a6c53a181debff02bfa26d9b23628448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808171, "uuid": "262f89c8-851f-4680-bd37-835b5bc28fe6", "comment": "Malware payload (RedLineStealer)", "value": "b7b614bbedb06f8e70767330e06d6c986da46b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808171, "uuid": "3012b66d-61d1-4bca-a4be-a7be884d702b", "comment": "Malware payload (RedLineStealer)", "value": "b4415f7e84843a3bdc3ec9a2efcbaf3f7ffb8ef7bd4f33bcf4819d4895b87f85b2700ec13d3e5d592a04843bbf204aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808171, "uuid": "4c1fb9e1-ef3b-4557-92f7-5324c957a3f2", "value": "T12CA53303B8449726EC466CBD537DEE006ABC365C7DC0406AB9B56EF70E918977C688BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808171, "uuid": "ff202544-4e2f-4f14-9b70-831a0585c4cb", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808171, "uuid": "e662534a-d5d6-4c91-8346-035eed93d2c7", "value": "49152:jkc9y+VgV7briYsmNJKQfSQ3HtxB94vgVNaPU6NV+:u+mb/KAB6vg/kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808171, "uuid": "bc5b8307-b255-481e-abb8-14151963b675", "value": 2233728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808171, "uuid": "16a67b53-f540-4681-9be1-75ee6a805c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808171, "uuid": "8b0c27ed-66cd-4d94-a935-2b0a38aa42ff", "value": "Crypto Checker.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089ef728-f175-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655824549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824549, "uuid": "af2fbe21-350b-4473-8dd0-d9500e21478e", "comment": "Malware payload", "value": "4f4abc72019370ad09d551d363128731", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824549, "uuid": "50c2f7f0-4105-4f9c-87db-6cb5f739283d", "comment": "Malware payload", "value": "c9dfafd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c300e774", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824549, "uuid": "51c47cdf-049b-41dc-b069-f0cafc5a5698", "comment": "Malware payload", "value": "16fcb302b861704c69cfae9b6fe93ba66052ee65", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655824549, "uuid": "1031f288-745d-4265-b087-4c1fd014f211", "comment": "Malware payload", "value": "2ade1b6a1c336528015782393af388bf287011ec9e4b4200a9d31274110dcf06f8dd83b0d6b1308b3f892dc773b5fc9a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824549, "uuid": "cfdb9c47-141b-4b8b-85aa-6324d99bfe57", "value": "T1B541C11127E60339E3B3963AD971B702993BF512EE3A8A5D40D0C789A871900AC56F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824549, "uuid": "f3763355-6656-4357-9d39-eb9d7f4b5705", "value": "24:8nxptWJJBlQZ2tm0OAdwz2R9erz0/eQ6kQzTRS+IMs41656KEZ8m:8xeB7UqE2R9erz0CZzTRSfMT1y6Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655824549, "uuid": "2cf79972-f5be-4d01-9ddc-6ec8aaaf23a5", "value": 2093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655824549, "uuid": "0c6e7a3f-cc64-43dd-a50e-9a1e26bf69ab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655824549, "uuid": "01e7299e-46a5-4a8f-a8b2-d5ba55cabf0d", "value": "reiciendisperferendis.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c1f728-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655801828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801828, "uuid": "3e0ffbec-7a4c-4d64-949b-f735633351b4", "comment": "Malware payload (Loki)", "value": "c7fc4d3e8337f719a0b72789733cd4e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801828, "uuid": "1ea18979-bff5-45a9-9803-81f6b1022d30", "comment": "Malware payload (Loki)", "value": "ca0264c05d689b4a173d8829b9dab7c601e0f48a39b01e03cb545b80faf69e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801828, "uuid": "524bccee-f957-45f8-b0a5-0ae938b1fb56", "comment": "Malware payload (Loki)", "value": "71ef55da53d47e1c3f7d90458806ec4df263f25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801828, "uuid": "30d588c1-6311-4c84-8762-0167abea2cae", "comment": "Malware payload (Loki)", "value": "d88e41738b4001364db3d3d1b9b3e3a50424902c9d6c2f1aabca451555da1c6cf3380e9fb9c31a93caede8ea9e949a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801828, "uuid": "676a1f0a-1cb1-4272-8c8e-0d9029069d00", "value": "T1A0548D10BA90C434F5F712F44AB69368BA3E7AE1973455CB62E516EE57386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801828, "uuid": "898836c9-25b0-43d2-9e2f-d4922759ee39", "value": "ee3080f6667a990e42e6516a4d659799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801828, "uuid": "8ef4f1ee-c34a-427a-93fc-be26c14775df", "value": "6144:MmrTQ4/hLQkdwTs5p/i0MBAk5AKwRdxE+WZLBh8:MmrT7pQkdwTs5p/i09UUoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801828, "uuid": "0e04574e-c20d-42de-a376-e18114e5ac9c", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801828, "uuid": "c1ff0f0e-211f-48d6-a684-08673f39e196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801828, "uuid": "480820cb-df79-4dd9-9243-b2740639f1bb", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28b4b97-f12d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793964, "uuid": "f756eb74-cc50-4b4c-b339-271e2c24d787", "comment": "Malware payload", "value": "7c3c9449c46a06fb099ee6922a83b568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793964, "uuid": "31dd0801-9e06-4f39-938f-07a73e789500", "comment": "Malware payload", "value": "ca463f3895032698087882dc9a6e7fcf89a832a4f3ef5554d063ad8f01e518ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793964, "uuid": "118a2ac4-ab74-4ec2-8f15-e51376de96cd", "comment": "Malware payload", "value": "9ae5b3b1e4df2309965e22a1d736099548409374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793964, "uuid": "a01295aa-6ac2-44c1-b34d-dead0c82ba76", "comment": "Malware payload", "value": "2bfd8dc2abd60d7ffaa37001f080b2ea899cd42f733e6cdb0a29743f5c66ee057f6c431fe87590726e8318770bf40961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793964, "uuid": "112e9db4-5d63-4446-acb1-54cda5309aad", "value": "T16F46E70358598B93956883E4BE174EAC2F1A2B1CE9D239FF11531ECB3E653721C9D12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793964, "uuid": "bec3e9b7-e79e-4e66-848c-10d93b2d073a", "value": "187ff3b0f1951b397e8cbfb76874451d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793964, "uuid": "f2205c19-7cc1-4b1c-8cf5-5bc28d4eb46a", "value": "49152:tvwLgCs0aAD8zdBfAnaKTEqMifYZGw/l1XAfWnj7/e9zK3724:tIgPAD8rInaKvMaYIw/XAM6G37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793964, "uuid": "ca9538c8-eee5-427d-950c-3d4bd3c94e15", "value": 5674054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793964, "uuid": "4e439828-aac7-41d2-a96b-22be80fed7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793964, "uuid": "4c646fc8-4e67-4fc9-a3d6-94cf630f4532", "value": "istanbul.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b75cf04-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840553, "uuid": "786fe189-658b-4b0c-a9fc-2520c597505d", "comment": "Malware payload (Mirai)", "value": "1c9dd75af377f2a37b7835d542374c9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840553, "uuid": "75b87c8a-ba65-4ee7-a72c-f4ba9b6208a2", "comment": "Malware payload (Mirai)", "value": "caa554a328239b8cd07ed2487788ef5a3a2779fe08f2ff5ed1eb50673407f65c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840553, "uuid": "1f8cba8f-5950-4320-b682-5399928b98d4", "comment": "Malware payload (Mirai)", "value": "f4978bb47ee65e767c65fad60a4ac5e56871ed07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840553, "uuid": "1bd068b0-6d79-4c9b-a72a-9fb98c8b57a3", "comment": "Malware payload (Mirai)", "value": "a89ea8677f5f84ea2aa9f976f6f777b4bcb27904218ed55e786e0c5557a21e36fbbc78c53c37f4d5c33cd9377e301164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840553, "uuid": "f2fe6bed-b59f-406d-9076-3f3c4ecf50fa", "value": "T1C40409C3B901FEF7F4CAE77244D3872061B2BB614B531622B29779759E3A2C4342AB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840553, "uuid": "1bcc1b1d-1212-4117-bf05-210b9138915b", "value": "3072:HiuFhOGP3kStEy7Zs3ZcF2QlPAo2TayTpLcHFWkuqDbOovQyGFP/nAPQKNy2Wgt:lFA0REy723Zc5PALLcf2ovQyGFP/nAPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840553, "uuid": "63fc4f70-c61c-415f-97a7-555dc7a74a73", "value": 187566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840553, "uuid": "ba03fd8e-8b8b-4066-a712-0b7f30c8707a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840553, "uuid": "08981d6b-f8f2-48f3-86a4-3f76ee5c496c", "value": "1c9dd75af377f2a37b7835d542374c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13d3b9c-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1655801640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801640, "uuid": "704ed6e8-fb3c-4075-be5c-964ddf8aadf9", "comment": "Malware payload (SilentBuilder)", "value": "c667d725e0aa8fb6488d3a754a8fcf5a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801640, "uuid": "5b4d1c74-5b47-424c-88f7-c8d62f050761", "comment": "Malware payload (SilentBuilder)", "value": "cb48432812d94f5198092aef5180aae5053e62c172c7cb1f54dc7e1a1b42d288", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801640, "uuid": "8a049b1c-7e91-4505-9bcf-b34557d8cb06", "comment": "Malware payload (SilentBuilder)", "value": "01c4f7da47b49f12faf7f80f2b9ad082337fdbde", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801640, "uuid": "fe012b2b-f655-4855-bda0-6c1c5249b5e5", "comment": "Malware payload (SilentBuilder)", "value": "924ca027a16c25374f67357055fbaf2437c668080a566e6f2b2e21eb2890a4e68f20cf9dee30c89ce6a578cb09302e89", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801640, "uuid": "8f667569-f452-4d94-bf84-b70d191f2a82", "value": "T1D233D88AB65AD85DFA25C73548D747AA6323FC304F6B07433265F3256FF89A05A0321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801640, "uuid": "d647b6b2-1340-47b2-8cfe-4eafeb6205a9", "value": "1536:vcTKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHpQvKr:v2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801640, "uuid": "e938047c-a08a-4283-bee1-7dd9c3207c5a", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801640, "uuid": "ef51a016-62d6-47c0-b60a-abdebc5864a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801640, "uuid": "a081325a-c847-4ecb-9ac6-95606cf6479e", "value": "DETALLES_2006.xls.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db84bf3-f1b8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655853522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853522, "uuid": "5cc54d40-202d-45f8-b828-aa5c2ac7fb06", "comment": "Malware payload", "value": "d7008dd082c07ea5510bf6bcbd1d86f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853522, "uuid": "93de6471-07b8-41ae-a5f6-ece9423bda0f", "comment": "Malware payload", "value": "cbabaf4f3b6d9b3489609b190f98f5c5a19194fd368f1450c1dffc3cfff7518c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853522, "uuid": "309ed4f4-b099-46eb-9e92-476072707b57", "comment": "Malware payload", "value": "bfb6e2535fe116ca5c7c40e5a262470e706ba0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853522, "uuid": "5028d531-6ce4-447d-b847-bcadf713c8f7", "comment": "Malware payload", "value": "083e047174df16b54b18d1a6076fa67675b0fe9f73c1506190935c25da1e25fc081ebf4bb053150f96a54ed68b11ae8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853522, "uuid": "0d375ec0-4cc8-4d57-8370-f54a6abac194", "value": "T17CD4CFA43A5CAF90DA7ED7791121412043F0686FF763E61A7EFB18DD0955FC86332A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853522, "uuid": "835a9ef6-2b96-453a-b094-98b7562b62b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853522, "uuid": "845c11b0-c344-4b1f-8f00-1354ea0ff8ea", "value": "12288:a6yZrKGfuv0LMQ45dkB1SYqeryPEP+GkaecoE3wJtLqRQ2iNPf+B85FrSJdUxdeE:x1B+B85Fe9l4kJ0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655853522, "uuid": "d2421dda-c6d5-437b-bd96-43333fc31bb1", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655853522, "uuid": "3d5421b6-e002-4b0b-ae29-5c96696487d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853522, "uuid": "1c982047-755a-4751-9e30-b814b63ecd1b", "value": "Quotation Forms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188dee16-f164-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655817275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817275, "uuid": "ea149e4c-a7c3-46a5-93f2-8f6199dae7bf", "comment": "Malware payload (AgentTesla)", "value": "04b59545584c5e6fd7de0829cb2b23ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817275, "uuid": "cf9d150c-63e3-4985-88c5-0a824639360d", "comment": "Malware payload (AgentTesla)", "value": "cbf41123ac6e4f573803c2b021c3681accc3ed326ef359c49493fd316e45ce07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817275, "uuid": "943a586c-352a-40ad-8d77-53fb24700e9c", "comment": "Malware payload (AgentTesla)", "value": "070a2f61e555f4a68c7abbf753827734e59ccb07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655817275, "uuid": "24437f82-de27-448a-b8ba-ca4a0bc5329c", "comment": "Malware payload (AgentTesla)", "value": "a11dafe2c29dfcb87c92da0db2e722ef4ad19cd11a3de4bdcbaaea61daa72a037faee9af3078da0996403c2289640c59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817275, "uuid": "19d3da7b-819f-4f55-95e0-2180b3b7f800", "value": "T17DD4AEF0AB90D464D467657AB436A2BB76E36A0DDC68541D6983FF0B3C723C200A3D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817275, "uuid": "bb4b74fd-d6ea-4357-8e5f-58540b063517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817275, "uuid": "b188c980-1dac-46b4-b0b3-14c73381ef5b", "value": "12288:+tv5p4mauvtGZJZGXQDC4I5O3amQvldAA:uv5WmFkXD5FalA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655817275, "uuid": "49a2770a-9b77-4379-bc3d-b1fc2ea1f3cd", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655817275, "uuid": "586854a2-656c-4d7f-ad15-c6ee32906726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655817275, "uuid": "f7b7150e-87e8-402d-b0bc-ed0d2df647f3", "value": "Request for Quote Inquiry 06212022 - spec(DRV8302DCAR).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5693236-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806854, "uuid": "b76d3692-7dcd-4203-8fa5-a37542065273", "comment": "Malware payload (Formbook)", "value": "83dd3acd8f3e455bfd2c4711453399c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806854, "uuid": "af41c2df-454b-485b-a3fb-383ae43d0d1c", "comment": "Malware payload (Formbook)", "value": "ccc5f7c2dcf83d72150071b31ff3036834f0d26544e2c2c274bce95d234b14ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806854, "uuid": "d81ce029-6e03-43a0-a77a-18a1e89f7db0", "comment": "Malware payload (Formbook)", "value": "8895c917c9a3157939036647ba402f02d98f29e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806854, "uuid": "3fc13ee8-7ae8-4e9f-8f6b-c6dcdde3f996", "comment": "Malware payload (Formbook)", "value": "9bb4ce2cdf80a35333a6349df461731f63e3936963515107b324c543a9170b85119730b165d14803dc2ffba5963196a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806854, "uuid": "51b3a737-7536-4485-95ed-6c71a9397ada", "value": "T13225180366C91ED7D1BCB6352D64B51C03F6FDE61250EE8A3D81A6C914F2A405BF3A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806854, "uuid": "a77d80eb-7d8c-44b9-83df-7704bce5568d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806854, "uuid": "1faef5dc-f0b8-40f3-a843-96534a112e17", "value": "12288:7H+MQjTh7KBzmpiQjxuOsd0wj3fM1r464dFVDNVjSeUq8/a/zonbRey7Bxh:bcjajurUfVjJUq8/abo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806854, "uuid": "8379c0ca-f1f5-4624-b815-c1a1bfea8c88", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806854, "uuid": "01971ea2-b3d6-4631-ae1b-b4d8a593fb2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806854, "uuid": "c5e393cd-a305-4ead-bfc4-ca3dae644223", "value": "vbc (10).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6d212d-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803589, "uuid": "88832d10-5993-44f6-a5cd-aadb07d9a9b8", "comment": "Malware payload", "value": "61cbcbcc8e524b026bbb1dc7f7fe9326", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:1234", "colour": "#1B2F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803589, "uuid": "b2a9e88a-7580-4ac6-8e12-d90b9b096403", "comment": "Malware payload", "value": "ccf4dc39e0387f78270c492b0af13c9be265b389f207bd7607f3ddaeec4d5990", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:1234", "colour": "#1B2F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803589, "uuid": "60db2293-2845-475f-88fd-7b4279b4c5b9", "comment": "Malware payload", "value": "25ffcc221280b28b8324bee0e76cb8395f55fc3f", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:1234", "colour": "#1B2F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803589, "uuid": "8b46eddd-0186-494e-9572-126ed7541b61", "comment": "Malware payload", "value": "6f4a35d87e0e0c1d741ccc8778c9836231922216ff99f16ae16e3513f8d0e1568fc9369ace30adbeb4276b87221398f8", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd:1234", "colour": "#1B2F1D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803589, "uuid": "a4ce70b5-1831-4220-a57e-17d9e30439c0", "value": "T1F3563309879E9D3BA7FD8E3FA00AA1FD0580B0BD563CB7B7017BA145B39011A395DC99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803589, "uuid": "368f8716-77e0-4315-9fff-fb0091ecb738", "value": "196608:GZPt0ucW8Hw2jCO0sACeoMlw2MkFOPvYjpTi:GvVo9jdvAOMckcvYjpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803589, "uuid": "deaea666-307e-4222-97c6-6c7c6d840e06", "value": 6449427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803589, "uuid": "ccff3f3f-b31f-4804-a0fb-9976033bfc34", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803589, "uuid": "8921b44f-3972-4ddf-b50d-54f26fec8e32", "value": "Application_Pass_1234.rar.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac722be-f145-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655804098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804098, "uuid": "cfe0013a-c60f-4a48-aee5-339a9d291f3a", "comment": "Malware payload (RedLineStealer)", "value": "421ed51ff27bb5c8dc7696d0c1479298", "object_relation": "md5", "Tag": [ { "name": "Crypt130", "colour": "#797690", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804098, "uuid": "04502ec1-5120-40dd-ba1e-53ce7272e7f0", "comment": "Malware payload (RedLineStealer)", "value": "cd41ed86dd2b59459c6e241c5ab3d210f8bd6f12129c1ff838c7d1557797bd40", "object_relation": "sha256", "Tag": [ { "name": "Crypt130", "colour": "#797690", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804098, "uuid": "52772142-83ae-428a-b632-589ec527366d", "comment": "Malware payload (RedLineStealer)", "value": "e865419cdd49791ab1c9e612e5840875dae37b5c", "object_relation": "sha1", "Tag": [ { "name": "Crypt130", "colour": "#797690", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804098, "uuid": "836523d4-bd7f-4b3e-98e9-11acb290bef7", "comment": "Malware payload (RedLineStealer)", "value": "ddac893876bef14b6ac2078405342c346690325e4c5d7d1deaff62ad71ce4c40d37f7914c4a5ac1cbfc4a19ebd981116", "object_relation": "sha3-384", "Tag": [ { "name": "Crypt130", "colour": "#797690", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804098, "uuid": "fcc83fa0-f687-4ca6-a1bf-7bd6b7404e38", "value": "T1A2C4862A1FDBC19CC98935F981932FCC1641ED9EC5B709A97685B407C2B06B635A2CCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804098, "uuid": "607fd685-8818-4111-955b-d3abb7938fd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804098, "uuid": "983c9f0b-0666-47c4-be0d-c2231c5963ec", "value": "3072:D0nRlr9sCkllr9sCkpEj6IwnXzMMCDtDJniCG:Da99sCkl99sCkGj6IUmtDJni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655804098, "uuid": "66e9db47-11d8-4fcc-bf74-9bbb457b45cf", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655804098, "uuid": "7670b3f4-5a04-4174-b612-d8a790aeb33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804098, "uuid": "c8480920-5fb2-465b-a162-9a041638d38e", "value": "Discord Image Loger.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5ee9a8-f112-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1655782328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "692a6674-a3a8-4222-a2f3-d03bfb07c6e0", "comment": "Malware payload (FormBook)", "value": "4885539b3e4c613b3561c136ebcb0789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "6e2610d7-e920-41fb-9d67-2fdcf55f686e", "comment": "Malware payload (FormBook)", "value": "cddd7c5798303f779782f6d34ce93034647e5984f9b52f259e030201b538fc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "c918150f-13a8-4fbb-80d6-0a366f01f6f8", "comment": "Malware payload (FormBook)", "value": "5f0cc888304d12f4e59669f75bc36837b7cd5d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655782328, "uuid": "a0c9626f-2ba6-4e16-9136-ce6f43595cce", "comment": "Malware payload (FormBook)", "value": "72fdc481b29331ce562847ef791341d08e710cc80137ef27081ec6e7d7c841406adfcd193740cc5a088d2b37d0f39d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "5b71f2c2-f073-4666-a129-17797f5a12b5", "value": "T12AB4E0F48FF4B966E128317770A4603CB7D35E1DDC60A53ACA8BF54A34A2AC161E1E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "743f5141-dfb9-490e-b36a-be29ca0811ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "99461d96-d42e-465e-8a46-17e99d7ee2d8", "value": "12288:Mxv89dRA1eOZX6u2s4y8BmDYsBOpesLsYhThNI:cv89dRA1iy4y8+B41hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655782328, "uuid": "c0540e01-cda2-4134-b4c1-da57915d443c", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655782328, "uuid": "a567a079-5e5a-4e7c-8ad8-9ac703a5a39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655782328, "uuid": "052b4807-f426-4e4f-ac4c-623810359ae1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21969.90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04e756c-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Meterpreter)", "timestamp": 1655823542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823542, "uuid": "df19d38e-3d85-4bb3-a179-ffff7204507d", "comment": "Malware payload (Meterpreter)", "value": "3791d3e654c377e1fa701ee5e69c115c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823542, "uuid": "17b76772-8d12-4996-8115-b06827a8ee02", "comment": "Malware payload (Meterpreter)", "value": "ce0cc2f91f2bcfc57c2e1e10c98685827806ba025269abfe11e32d2acf645b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823542, "uuid": "c8e7b46f-f752-41a6-8ab9-6e420bc44a73", "comment": "Malware payload (Meterpreter)", "value": "513fd45aa9de77d006fc767d876599c2991709f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823542, "uuid": "19052b6d-6eb3-4db0-9252-19fa820c3c55", "comment": "Malware payload (Meterpreter)", "value": "673e2f6ec4e4c251a95f036f1bce5c57beb2cd198e6694761c6a402b78b4e2affa9b9a592795d038d2cae46eb7e4fc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823542, "uuid": "8fd17776-a97a-4a29-99c4-be0dc7fb205d", "value": "T1B673C082D5C41462D1A6127E1BB53ABA5931F1F63202C2DE3A8CCDF5CBD1DB0966B3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823542, "uuid": "e798524d-83aa-478a-bf99-5223507f5d3c", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823542, "uuid": "142b16dc-bc5a-451c-860f-dbfa5147b3d0", "value": "1536:Ilq2DYFMp6uTAvl2jdz4lCcHw6Mb+KR0Nc8QsJq39:KqUb6uTAwdz4lpw6e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823542, "uuid": "1b929acc-a8d5-4d7d-a321-de97eebf2fb2", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823542, "uuid": "8437192f-4dc6-401c-bf75-14407c1bbef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823542, "uuid": "fb6b8d93-677f-4d2f-8d14-9fb02420fbd4", "value": "3791d3e654c377e1fa701ee5e69c115c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c63124-f152-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655809670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809670, "uuid": "a1e785d2-6da9-4ed5-8ccb-41e894a1e733", "comment": "Malware payload (AveMariaRAT)", "value": "fa78ece109e579e23450df0e22125016", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809670, "uuid": "70ef50c1-dd4d-45ae-8577-4dd820fec367", "comment": "Malware payload (AveMariaRAT)", "value": "ce67dd2cbfbc22d1ee45c2429da775036c0894f72021df6ab0eb849e96e29daf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809670, "uuid": "47bb273e-ca25-4780-a181-9cbe23b8a607", "comment": "Malware payload (AveMariaRAT)", "value": "f8a67ae477d06f287c1186fae9e8c5e51ca2f751", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809670, "uuid": "29309185-6b51-4382-bbd1-81848a154b9d", "comment": "Malware payload (AveMariaRAT)", "value": "cd9125ef973bbb0cbfb7b7c0692799aa95c2a50965aec8dcaee471dc2613b2bd1190660d271326116838c577082df059", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809670, "uuid": "b00c8463-cd08-4f4b-99a4-4419ac94f7e8", "value": "T1D753AEA1B191C2E7E5AA44F15D1EC18003B26EFCD4E1575DB6CDBB2C98B33520886F6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809670, "uuid": "9ffb67d7-669a-4da3-8065-7f1bc18d945c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809670, "uuid": "9091a556-9433-4425-8c16-f827058a47d7", "value": "1536:Y8GwuEUSyH6A+SbJa6LThdSJ3LHYYfEFAX7j2:Y8/8SyH6A+Sc6/KJ3L4TFAXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809670, "uuid": "406bf282-e10e-4552-a4c6-c89889b3edad", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809670, "uuid": "894b65d7-263f-4c0b-a058-aeb093d52b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809670, "uuid": "780a4f63-7998-4853-bb86-3cc4647e5fd1", "value": "fa78ece109e579e23450df0e22125016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca71eff-f177-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655825764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825764, "uuid": "791423bf-72ad-4212-8f68-6e66261580a6", "comment": "Malware payload (Formbook)", "value": "da4899c6d6bc7ed40cb8e708a511fcd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825764, "uuid": "10eb3055-2f43-4d5d-afd1-95271302a29f", "comment": "Malware payload (Formbook)", "value": "cf6f665f23b44c9c347fc9d3fbb3f6b3ccf3ab82366959437213ad77346e757d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825764, "uuid": "c5755f41-bb5f-4f54-91e4-9249b191b99f", "comment": "Malware payload (Formbook)", "value": "a345d8f8a347445c7061ced6b39093c4ef3f1f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655825764, "uuid": "61e4df77-bde5-4524-9fe8-4e4029a92a30", "comment": "Malware payload (Formbook)", "value": "becb9107d63c4d0b1889779659122d5223da30f96e96e13aafcc6943ff9525489f16af06370123322cf846a494d9c674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825764, "uuid": "ad3f1846-208f-45c9-a876-2876950ff18d", "value": "T1F9E401F09FF8B86AE46864777060A17C3BD34D5EDC46E539C69BF44A30AAAC121E1D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825764, "uuid": "9566a229-ff0b-4fea-9448-bd96329468f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825764, "uuid": "f7d13fae-634a-409c-93a4-e497685607a8", "value": "12288:p+P6/kyM8AZ8eudivijkP1KsJjZynCA2Wq5CXo1D9w8dzDzuPUvg0pA:UP6/kAW8JdGij4jZynCA2X5MiwQz3us3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655825764, "uuid": "86196225-a625-4435-ada7-8c49912dc5f0", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655825764, "uuid": "e1edab77-0f91-49c8-ae0f-9756173bb546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655825764, "uuid": "d7f0e5a2-1396-48cf-84ae-c7ec71735488", "value": "SecuriteInfo.com.Trojan.DownLoader27.59888.32218.20715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c39506b-f136-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655797631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797631, "uuid": "a1fc5c52-8833-407f-b33b-424308709dc3", "comment": "Malware payload (Formbook)", "value": "006813c7b35bb4239a695f6ca97948f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797631, "uuid": "8457d0ca-8a4c-45e3-be72-e6c7e6e74482", "comment": "Malware payload (Formbook)", "value": "cfd7162228ba89180d8b18ff2d8c423ced49f890b32c02eccca7288fea2e583b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797631, "uuid": "79baff62-5fc2-402f-a4d8-ee055b2ea4e4", "comment": "Malware payload (Formbook)", "value": "86247cd022d2e3a76c35fe1f9cb7dfe54606af3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797631, "uuid": "518d988d-9ac6-4ee6-9a4b-337305768385", "comment": "Malware payload (Formbook)", "value": "262dbb6d0908d0fa1f674a14789b1913ad1adc3fefb24d494d23151f9f510e6a2d202b393399cabca89f960c01588536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797631, "uuid": "2586daa2-1015-41c7-9dd8-dd877532099c", "value": "T177E401F59FF4BD60E1282173B4A4A07C33D21E1EDC92E42AD69BF09934926C1A5E1F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797631, "uuid": "043b5a81-9f59-4d15-bd76-7bdc9738f1d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797631, "uuid": "cee76c0b-91ac-4f70-9a86-9abb008f85aa", "value": "12288:hOvqxMDYA8iAEUkxP5w9a9YvxZSeqyuY7Yllppc6UFZxe4/dl9db2J:AvqxSYkAD4P5Ia8fSnyuvlXcbvxe4r9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655797631, "uuid": "80c6caca-9521-4f13-8741-682794a1c834", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655797631, "uuid": "2addf141-8961-4516-82e5-4196013a7d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797631, "uuid": "0468ec0c-2f4a-4d12-9f6f-05cb7175d01d", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9733.2881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf41886-f145-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655804260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804260, "uuid": "6522f4b3-f3d8-47a6-bc40-dd82963fc0e5", "comment": "Malware payload (AveMariaRAT)", "value": "218165212db0c29115d855ceb3ee8e73", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804260, "uuid": "64762978-968a-462f-b68f-067189e97402", "comment": "Malware payload (AveMariaRAT)", "value": "d0b6c6204cb45f3c128d5c44a6be4fccd053be3a32eed746358e3cc50391879e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804260, "uuid": "044f0479-46b2-4962-91a6-2bf058c3b890", "comment": "Malware payload (AveMariaRAT)", "value": "bd113f0076ef139e7117e656719188480a40f577", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655804260, "uuid": "2ac7cbe7-48d7-49c5-b2f7-a20fcadbba35", "comment": "Malware payload (AveMariaRAT)", "value": "83c34fc542ad1c396b54f3c8461a88368a4f759691bc267b45c290d624801998d4b7d12fc335d81adcfaa984969dbcc0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804260, "uuid": "db31d100-6be7-451c-a7d2-cf7b04c549c3", "value": "T18B347DE3B0F88434E6E01CF9CCDE48E4563B9D651E6D384AA5C37E0B79788968C5D1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804260, "uuid": "d342a583-15a0-4e1b-84c0-95a6189ed745", "value": "09876ad8ac5cf1f5f38f35bc6647489a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804260, "uuid": "b396d33b-987f-4f8e-86e8-9c1bebe3b20c", "value": "3072:emyPROh4GyW5ANmk+A8jtrBaKZijSLmsgarIY/kuz01S5PowHooWYKj1iIHn2/TH:emysSxNmsmijSq8Iij0MKrpiIH27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655804260, "uuid": "844c67f0-4355-483f-a91a-d80a51144fcc", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655804260, "uuid": "f36bfb23-2f2b-4c3e-ba07-6634251354b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655804260, "uuid": "8232b25e-0f19-4075-878e-0614cafafa07", "value": "INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf793cbd-f119-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655785343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785343, "uuid": "f794c267-014b-4f18-9292-ea6dd3d6d1be", "comment": "Malware payload (GuLoader)", "value": "4362696ab88e0849236d097bc3d92d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785343, "uuid": "729def01-9ec2-4677-8975-ae1d61c794f6", "comment": "Malware payload (GuLoader)", "value": "d12aced2f179361c780e3106df5e3d7dbf8ec142ff1d45450d4c6d955cff6da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785343, "uuid": "225aefab-5579-4d85-aaa6-8bb150761e5f", "comment": "Malware payload (GuLoader)", "value": "8b4ff64c93cb53d53b739b51fd44bf3d35273beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655785343, "uuid": "6520d9fc-810b-4238-add7-9ba5e0dad890", "comment": "Malware payload (GuLoader)", "value": "0448bc97a172f22fb183b31c9f572200dc91f025d70279a0c68f42a91d08aa108a29f6cb339ede11b23fc8d562280701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785343, "uuid": "c4d8cc43-272c-4829-9b8d-98ae9d7ebc60", "value": "T12A54DF203B91CC5BC5672AB4387DD27437A86D2FA629C3034BF0FD9BBDB52816C19685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785343, "uuid": "f3a45123-70c2-44a3-87d1-8e70d4307e50", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785343, "uuid": "49261390-e1ad-4f12-b31c-5200549428cd", "value": "6144:4NeZ3mR5aRREji91iF4CsrgIawa1SO4YppC+oUnVKyr8EKcfjq:4NjRdi9RawaEONpbbnVRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655785343, "uuid": "c3042418-bf2d-4800-a08b-34c320e192ab", "value": 300144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655785343, "uuid": "6dfda3fc-b1c4-4581-b27f-68b05023db05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655785343, "uuid": "008353fb-c0ea-4057-ad02-75ab646b505e", "value": "PO_05964_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4334255e-f1bd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655855572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855572, "uuid": "5ce034d8-b46b-4410-ae3e-6a627711c926", "comment": "Malware payload (Formbook)", "value": "b1129a7bf7ea2581091326f7889b3e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855572, "uuid": "f4cdd962-0c4f-4314-8c42-dd9254edee17", "comment": "Malware payload (Formbook)", "value": "d1621fdfe9e76d0a99b0abf08ddc42c673c1322697ac1a41166acb8cef2220ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855572, "uuid": "31de2915-fb0f-49f5-a6f8-d1daf8cb5fbd", "comment": "Malware payload (Formbook)", "value": "3ad13c8aad1d35937291fced320427a80863c563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855572, "uuid": "90e15f35-2d16-4b03-ab09-5e75d8d80257", "comment": "Malware payload (Formbook)", "value": "65a49cfd03b006b2668155fdf6f414bd1d5d92e2f095858707addf5c6d693a32f05b1a22b038f4035822767ca283181f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855572, "uuid": "97e355c8-d1fc-46f2-bf2a-8d9a08ec5bbc", "value": "T1CEA412426B5C9F23E63EABF4149245C483B4A41AE016F2AECDD264DA1CE7F441A82F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855572, "uuid": "9ad33ba4-5706-4eec-8bf8-e6320a57f43a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855572, "uuid": "8ca8695e-3874-4431-8eb0-0ccd1a951352", "value": "6144:Jrl8p81vwkyOeUwd6rXYdS2ZakRmqVfAjfhiJ3jgZJTj4ZINNsirGnYfkoLUP:Jrl8CGkDeUwd5bafAOcT0BjTQirGVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655855572, "uuid": "8ecd1aca-4ea5-4dbf-a6d7-c2f56599bf24", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655855572, "uuid": "4317b66b-09c2-4268-82ca-ca2000887505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855572, "uuid": "87ebbbb4-1855-46e7-8184-b25a319b835c", "value": "SecuriteInfo.com.Variant.Tedy.143303.11815.22768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7358ea-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655823214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823214, "uuid": "425a6e66-291f-4de6-9ac8-c2b6ae8de24d", "comment": "Malware payload (GuLoader)", "value": "91c2175d5421d5f4d7779771e6af23fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823214, "uuid": "015c1929-35f0-4437-bd87-defcae71cfdd", "comment": "Malware payload (GuLoader)", "value": "d165cfbfe149c6dc190bee23e2702e4f62c528e58dc982036d3200c7944525f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823214, "uuid": "4a15318e-f931-496c-9b40-c8b0158420f5", "comment": "Malware payload (GuLoader)", "value": "6c4238e6daa3eaa6fa6ae0ccdcc871f662b9b1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823214, "uuid": "8449cf44-7149-4917-b748-917fa5a8de50", "comment": "Malware payload (GuLoader)", "value": "2e5137787a861e0beaecb2e400a984e641f28435db843f687607955b80e1255203fad93e62e14ec5d2aede881574ace3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823214, "uuid": "1934a4d2-3b85-4fe6-92f4-0605417e5d00", "value": "T13F051242E70BC483F8512930A8D693B6475BFFF0151442E27DD9370F64B8B939E3AA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823214, "uuid": "e4677fc9-4188-43fb-a95c-525cb999fa92", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823214, "uuid": "3cdf3172-cda1-454f-a856-ca8b2ce23d4b", "value": "12288:q3/AlJM6Sr1Dv7MNSLuLeNlQOWacFGMl/Nw3PwywPh25wiGJO3afX67y3xGRmIgK:q3iMXrF7MoLuL+YpJ2dGrfXAhAa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823214, "uuid": "ed3523ea-34ee-4773-a690-2f63ebeceba0", "value": 847448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823214, "uuid": "f3a828f5-3129-43cf-9484-b70673b41fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823214, "uuid": "024d23cb-443f-4139-a5bd-1361e5c46989", "value": "TNTINVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4bb1de-f1ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655848205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848205, "uuid": "74cf5f23-2229-47e7-95dd-7a5a82cf7200", "comment": "Malware payload (Mirai)", "value": "92c3584a07df4b3c8b71d3301f20cacc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848205, "uuid": "59549df0-917b-414d-b540-b82f5e5f0186", "comment": "Malware payload (Mirai)", "value": "d311a91daa034842f4f166132f250ea20c751a1e3edbe5fb2525fc84c48e0d9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848205, "uuid": "a817ef4b-ff4b-474c-b460-1905a2f20ab9", "comment": "Malware payload (Mirai)", "value": "23d69063cea9418991dfa451ed622e59795daa1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848205, "uuid": "b2b137ba-d1bc-4f78-8bb0-e4bc3b59c33e", "comment": "Malware payload (Mirai)", "value": "ca935caf390842b6b45faa030322dc509017c385416f673e32e208ddaeccdd9fe584626128296d91a7b27424ae795797", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848205, "uuid": "5ff1d059-7002-4aef-a97b-6f1341a147c1", "value": "T1CD33F1D1B13A5472EE351438F8AE475EBD0F56F882B790F114D8066C9A8324A1FFEE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848205, "uuid": "7642d18d-9442-4571-8945-de1c205350ed", "value": "768:9ljHCLE+aRDP0uy91q/KYNtNGTVU2YCHaNTj69q3UELQudgSFM8iCvJKaP8cQXVd:TWiDPjy91IKl5xYDNHLQYMtCevSqq70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655848205, "uuid": "e220f9db-c371-4b9a-ac54-6ecae0d2bed9", "value": 51512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655848205, "uuid": "bad7198f-1d52-4b96-a128-15a5306c0a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848205, "uuid": "3e0f9f8a-9aa6-410f-bd22-a3cc027f92cf", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93475a8-f1a9-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655847180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847180, "uuid": "f8942d38-3f89-41ee-a632-5e119ac6d40d", "comment": "Malware payload", "value": "fa69ea7c0649dcc24db9ece781995901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847180, "uuid": "bdf0ca7f-0865-4322-8c7a-f5e4b767bfb8", "comment": "Malware payload", "value": "d367dc6e1250655eb3e10daa9e50a5697b6dad7ca81519006ee91aacbf27ee3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847180, "uuid": "319da998-71fa-46a8-b1a0-98eac328b761", "comment": "Malware payload", "value": "5f48eb88902e7214ee046e50a8b991f27ce6a2ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655847180, "uuid": "359dc165-999b-464b-8732-7ffff3b0ea69", "comment": "Malware payload", "value": "1c6cfc768f73b3a49fb9617ba8e351c87246bfb771a682e883dd79e5d7f3a666be51c6bbb2340bfb88e9345da2e87290", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847180, "uuid": "5a5e3d10-34c3-49d6-8231-c08f3019e4df", "value": "T1D24302D01761278C4375D9753CDE304E86341A2F72E63C102EABD18AF45A622A8B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847180, "uuid": "04df0707-62b3-4842-a5a1-b3b8bfd8ab75", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAg:8D+CAXFYQChaAUk5ljnQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655847180, "uuid": "f2726705-9fb4-4f21-bbd3-cb9f682d336a", "value": 56616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655847180, "uuid": "5c2931f2-fd9a-4833-a00b-7c860395784c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655847180, "uuid": "e89bdbba-7432-4da5-b3c8-4ee5549d8055", "value": "SecuriteInfo.com.Linux.Mirai.4338.5915.2788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d23fc1-f13b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655799639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799639, "uuid": "f2c36d05-214c-4114-828c-4c6eaca2d1c6", "comment": "Malware payload (Heodo)", "value": "5d2c0684cd42be9b5e02b8ac99df55ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799639, "uuid": "682c6463-7484-4766-8a8a-26d61696b96b", "comment": "Malware payload (Heodo)", "value": "d443bbf16ea6813afd1d57b5241d90c4ee05b90a27d1282e443bc4859d55e9ba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799639, "uuid": "97f7de22-009c-47c2-b8cd-9fa0eee724f5", "comment": "Malware payload (Heodo)", "value": "26b9cd6e244e17d7b8c9e4e98507027180e86494", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799639, "uuid": "5752e0cf-904a-42e4-a691-c343e2ef890e", "comment": "Malware payload (Heodo)", "value": "038f0fb5ebf353abcc8612b6b0bbfb933eaf96062aaaa6f61998104491b13e48ce1da0f34a8f927ebd364aa690d1db96", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799639, "uuid": "3e536046-74a3-4ef6-83af-f10a4e0ce309", "value": "T142733A96B659CA9DFA25873149D747AA6323FC304F6B07433264B3257FFC9A04A0721B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799639, "uuid": "881895d4-fffa-4571-a5aa-b00cf7511d72", "value": "1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBc:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799639, "uuid": "7f5f3686-16a9-4820-b744-b9c762cec70c", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799639, "uuid": "1a7cc5f0-7695-4ee6-8aac-adbdb231e669", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799639, "uuid": "f7b506f0-a117-4fb9-a70d-da23711ad3ef", "value": "Electronic form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a284cf-f105-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655776686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776686, "uuid": "b212812e-7995-4d08-af77-c2af6115dca7", "comment": "Malware payload (Loki)", "value": "b2ed993d668b262bdc3673fee8896ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776686, "uuid": "9a84147f-b8c9-45e5-b840-677ced2daf3a", "comment": "Malware payload (Loki)", "value": "d4908b6c5e2afcca0415f48beef6c79fa09250469c4922865fabdaf8cb3d3fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776686, "uuid": "33554887-b966-40f4-bb65-17b31cadb70a", "comment": "Malware payload (Loki)", "value": "47bfe17a7ea61e741d7200fbefb8ccc146722607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776686, "uuid": "74d78823-61a1-4a6f-80ea-c755e6b5e3fb", "comment": "Malware payload (Loki)", "value": "deb603c5897cf25e5ba419c8220dcea0ce39843d4c1eadca56ce92ebddc0195df666dd032f95bf4aba72bd8805538e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776686, "uuid": "7665c939-9633-4f50-90af-c974b0f5d9a4", "value": "T138C4AE983654B69FC42BCE7689941C20A6A0A477431BF307D99711EAD90EBDBCF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776686, "uuid": "86f1fc9c-66c3-47af-ab3f-4acb4de86a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776686, "uuid": "6e5a4d82-c638-47a9-b164-c1cb97778ae2", "value": "12288:D0znmM9hPY2iNcnCG9eEGnItF3KH6rjUwoSHn3unUO2Hu8csw:Dunfg10e3ja3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776686, "uuid": "7e9888c3-f65d-40dc-b3bb-990e92140f94", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776686, "uuid": "a260249c-c593-4fe0-bc49-fb226c82cf76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776686, "uuid": "a849549b-e275-41e0-b769-f2a0cbf8c1df", "value": "DHL-20-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10570c81-f189-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655833152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833152, "uuid": "92616c0a-816b-4ce7-b235-ab1b813544e5", "comment": "Malware payload", "value": "34727db0450fb2919d70f9a73caff151", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833152, "uuid": "8a27c61f-4dc3-49a4-8391-353fe1840354", "comment": "Malware payload", "value": "d565d67e4d620093cfde9080171e06d2b351d09ec6dc606955a8820b370a69e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833152, "uuid": "fab08344-1f7d-4cc5-a02c-e0940320e113", "comment": "Malware payload", "value": "a9877fe8ca409bb2943b3ae0ab6a954946cba2b0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833152, "uuid": "8a400943-c7f4-4a50-82bf-906acf30100e", "comment": "Malware payload", "value": "20235db623349caf80e95da69b46f9e96b132b68042ca0594c2f9cef919a86358442f24534dd1af97deaf35693a0cec4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833152, "uuid": "eb3863a4-991a-4f2a-a6c0-981ea2a05662", "value": "T1FB216339D2B08249C01F95BACD1E8F8AF1B6220B17F22E46561568A1311A64065A6C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833152, "uuid": "986a060c-37a2-45b6-86fe-6cac44ef5939", "value": "24:O3QtuG6wCqwLQNQ2F6ef10QLGNssqn7NeSkbn20oUxOJrKtTl:gQ9dCqmQNR68bFbBeSkbn2FUxOUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833152, "uuid": "1b926cbe-9e4b-48c7-a143-df20e8adf6f8", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833152, "uuid": "b9ffa9dc-8451-4126-be96-cd33aef53141", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833152, "uuid": "05171108-f926-4b62-8896-489c4de68152", "value": "Dcmb1398147368.zip.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0395b611-f18f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655835708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835708, "uuid": "8fc5f108-080b-47dc-ba6e-447013d1a4ee", "comment": "Malware payload (Heodo)", "value": "3015a7705c579217920fb2be040679bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835708, "uuid": "e5843cae-b57e-41a2-b0dd-22510fef0f06", "comment": "Malware payload (Heodo)", "value": "d64e1e30cafcd7c35d086221732e1cfb8a029c53caa561c019f0351e294e2883", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835708, "uuid": "1acb8190-7b39-4624-bb4b-995b0583606f", "comment": "Malware payload (Heodo)", "value": "5ff1885227a0d605ba237f7a7a0e52be91f14c98", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655835708, "uuid": "97d07b13-6aa9-454c-9e05-d7837b389e59", "comment": "Malware payload (Heodo)", "value": "9455917ed4ed139669df16eddcaef472aee1f7542ffbedd1873ad549f857e8024160b2c761e327b72dd9eed4e4ce62fa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835708, "uuid": "1c65427e-cb48-4338-b29d-2d78eaf20f16", "value": "T147648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835708, "uuid": "71ebc489-cebf-4412-a606-46d6e7799549", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835708, "uuid": "4f4ea3b3-67dc-4573-a435-953adce08692", "value": "6144:JqdSTDcHe3kjHfNsQnSXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3SIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655835708, "uuid": "07a07913-a3b9-4eeb-bd95-37f4b15513e4", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655835708, "uuid": "8dabfe54-8a73-42ed-b2f4-81a4edfc0a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655835708, "uuid": "a0cd4e13-f87a-4ff6-84d6-b316f83a2526", "value": "3015a7705c579217920fb2be040679bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eda1dd6-f12e-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655794119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794119, "uuid": "f6d86ba9-3e98-4bdc-b16c-e2ad11aa4aa4", "comment": "Malware payload (SnakeKeylogger)", "value": "e759724d3a5e5967ab388e20f57ce73e", "object_relation": "md5", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794119, "uuid": "1a503c7b-f5c5-406f-a591-3f5fa449bcf7", "comment": "Malware payload (SnakeKeylogger)", "value": "d7661135790e5927916675193dfdff813cb810738095e7096cec5f226c4e450d", "object_relation": "sha256", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794119, "uuid": "a79cbd76-919d-473f-a5ba-0fcf28cfd029", "comment": "Malware payload (SnakeKeylogger)", "value": "a48360de0cb6340a8b89fb928dc0d3f8c1001fb8", "object_relation": "sha1", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655794119, "uuid": "09f2389f-bcd4-4c47-89fc-6cb81c3da447", "comment": "Malware payload (SnakeKeylogger)", "value": "4050b44b7274949de5553e749e15982a98e5a8203b0f86d8da690c7b88d9d9b52ad7ecfca019a5e4567772e2e8931887", "object_relation": "sha3-384", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794119, "uuid": "c4355568-22bc-4394-a8a6-bf0bbc1cb84d", "value": "T1F6D4231F0B1EDDB063A37C537BBFEB44D4D62BCEA574ECBA4056662E309131A9981E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794119, "uuid": "855e9ed2-0acb-4b20-ae0f-a3d4ed4270f2", "value": "12288:CtJSFum35cPtUJGaPHzrl4Ztf1L7egeShG+CEY8HVX:Z33mWJGabr+NxeyG+CpwVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655794119, "uuid": "bec2f1f5-e613-481c-b09a-e35b6e7dc141", "value": 597812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655794119, "uuid": "542f4da5-fea5-4913-b231-8a0efdd25120", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655794119, "uuid": "3ec1f80b-a1c7-40a3-87ed-5d704f24bd7d", "value": "RFQ 11054.eml.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9dd696-f19f-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655842914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842914, "uuid": "f7f5ae46-21fb-46e1-aa3a-0edd9588a7c5", "comment": "Malware payload (RedLineStealer)", "value": "0071435ba6ef5bf20a1cac44e55f12dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842914, "uuid": "2db64a48-498f-484c-a98b-8aec181fe3f9", "comment": "Malware payload (RedLineStealer)", "value": "d7b4bc561185f91a77ffc89b25105b5f35c4321241064a867cb8ca79d33d5bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842914, "uuid": "6a87532f-84a2-489d-a33f-be251c5dd7c9", "comment": "Malware payload (RedLineStealer)", "value": "13e18151764bb12155f843b7359e4558c7c3d636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655842914, "uuid": "6391b63f-52fc-4312-9aec-1b77092af0da", "comment": "Malware payload (RedLineStealer)", "value": "85d49c0ba2f72840eac0561d6b0201306e8221422d19d30e7cd5042c88de93e9aa26af0b43a708db4049c9b6db0802c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842914, "uuid": "94943412-1f41-4a97-b638-915498f0ad84", "value": "T10EA35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC194E61FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842914, "uuid": "b0171b30-2e8c-4ee5-98f1-a81f2b4b2ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842914, "uuid": "34ff9924-24b3-4587-b81b-82c828505ff1", "value": "1536:9qsCXqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2ltmulgS6pY:rIgzWHY3+zi0ZbYe1g0ujyzdtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655842914, "uuid": "192a518e-ad58-48b0-9f98-a6cbfa9b65ea", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655842914, "uuid": "81695ec1-dbd3-483b-a724-9955a7880426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655842914, "uuid": "fe2ebe9b-2fab-445b-b6c5-a0fcdd41dbe8", "value": "0071435ba6ef5bf20a1cac44e55f12dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5f4a96-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655851804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851804, "uuid": "dc210775-6803-40ad-99a1-7385ad9b25ac", "comment": "Malware payload (Mirai)", "value": "fa8ee743cf29e68edb16027a4108fb23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851804, "uuid": "9245dea4-a9d7-4f3d-8ae1-d74f70bc7151", "comment": "Malware payload (Mirai)", "value": "d9a4d8239c881c09b35f18b9f8d31b9de7deae3641ee840db21a6477ead9720d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851804, "uuid": "1df61643-fcba-4ae6-a751-7dab5d5edf96", "comment": "Malware payload (Mirai)", "value": "b6ebe49f73cab494bdb8d6e248337a67acb8b50f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851804, "uuid": "e6bf7287-2a0c-491b-bc6f-8a4c20ae2656", "comment": "Malware payload (Mirai)", "value": "8670c8fbfef58dee397612c036ec8fafd13dcadae8897d98ef3feff2a40032bc07a26daf1f0065e528edef1e6ce762de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851804, "uuid": "2ea5ac9d-c191-4d73-9461-29058dcf060c", "value": "T1EFE33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851804, "uuid": "0bcf9f36-03d2-40e6-87fe-7c93cfceeb73", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNx6:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851804, "uuid": "102823f2-6add-4ede-9f0c-5428ed286495", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851804, "uuid": "4ceed92c-efed-47bf-acd7-8cd936133f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851804, "uuid": "309f4530-114a-45dc-854e-4572cf32f3c3", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9458a55-f138-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655798647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798647, "uuid": "c52aa11e-1aa6-48fc-b0c3-ef01ecc32800", "comment": "Malware payload (Formbook)", "value": "bf5426f3ef54fb82433db41d5e8533a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798647, "uuid": "203adf3d-a221-4bca-9bb9-20506390f780", "comment": "Malware payload (Formbook)", "value": "d9af61c7590a4850ff8a8f021ad2b9f7536757d658b281e883e758065637bdd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798647, "uuid": "73e47057-ae42-4034-9f76-635ae9195088", "comment": "Malware payload (Formbook)", "value": "46b504f9d3b02ff66ae640167e5ae3d8737dd44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655798647, "uuid": "a7b69e10-42b0-4547-861a-32caee7a2243", "comment": "Malware payload (Formbook)", "value": "8f078c62a315bbeda90262d2521009feaba75fb9cce1a26a942840bf43df4193b30c626139d85c63466fd97f5936a2c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798647, "uuid": "1e3224e7-ea04-4a16-ae1e-475ac159aaeb", "value": "T1A9349E5338D460BAF8DA0AB7CC681460299B7D325F2D012F14CBF68B78FB5C9692D917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798647, "uuid": "2d6c2619-5f45-4b09-adce-b3819ecdbf84", "value": "09876ad8ac5cf1f5f38f35bc6647489a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798647, "uuid": "46f3cf7d-f63d-4b02-8300-bccd9e6214b8", "value": "6144:emysSxNmsmijSq8Iij0MKrpiIH2b66666666666666666666666666666666666b:ehes7jSqcSwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655798647, "uuid": "a0d3f8d0-bdeb-466c-b101-815505418cce", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655798647, "uuid": "1c743f58-e8fe-4789-988e-95f2476c0fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655798647, "uuid": "4edd8d79-08f1-4946-88e5-56f560afa2b6", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd055ac3-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854595, "uuid": "904c4f33-4802-44a9-8149-8a2e318e30a0", "comment": "Malware payload (Mirai)", "value": "c868b94e1a09d277e6c8734931f71012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854595, "uuid": "6c7a9cc8-029e-4201-bcf6-986f91fbe4da", "comment": "Malware payload (Mirai)", "value": "d9f18b1a92c001886331384431113e38dd58fcb6df2af3431e25d2b0656602b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854595, "uuid": "808ab9b4-1846-4b8e-a071-a1160f78013c", "comment": "Malware payload (Mirai)", "value": "badac104a5770a47eb169624f88378a5342844e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854595, "uuid": "b7250119-1513-42da-a25e-c629d776a283", "comment": "Malware payload (Mirai)", "value": "2c7e07e31a86b93d1868405b6ee448b06702b9cd746df9ed9899c31b73bafa186c8bf812a727b6bf6966eec6c6bc00ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854595, "uuid": "2904f188-ca33-4bfd-9301-5d2be9aba0ff", "value": "T1EDE2E1BAD681BC63DE610032FE784B1B6B228F366027780266684F147DDAE3D547E7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854595, "uuid": "a5f828bb-8435-430c-9adb-1cc1c2a538a1", "value": "768:GkWGha4HTNKWuZXtdjbVPZvqi9q3UELn2r:GJGg4IxZBZSXL2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854595, "uuid": "5da818d6-1c0d-45b7-bfbe-0772c220ba0d", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854595, "uuid": "b98bf73a-4e84-4c47-b1e4-4248f40f08d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854595, "uuid": "cfc21bdf-39ef-4ff9-80ac-499bb8356037", "value": "c868b94e1a09d277e6c8734931f71012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0c4b95-f196-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655838995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838995, "uuid": "d36a457a-f295-4316-9318-90d06aa6eb1d", "comment": "Malware payload (Mirai)", "value": "a4aa34e3645c15de79330c76f9a5695c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838995, "uuid": "fe7350c6-f63b-47a8-a746-f4e8f22ae4c8", "comment": "Malware payload (Mirai)", "value": "da7309a1f6f9412ea641b4d46c1b5db5664647ca1da088f0ad8047404c4979e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838995, "uuid": "ad1f432a-2eda-447d-9c48-92776674ba23", "comment": "Malware payload (Mirai)", "value": "17d2621e0a99e7453ea63b1c3a09a5fa492e1a4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655838995, "uuid": "9d9ce93b-9bab-4ba1-a989-95bb229d0dc5", "comment": "Malware payload (Mirai)", "value": "cd5d476b60cd278f19c18958ad5e2e3dcf922b6e64e9c53845354161726eaf98985c27b6978e227bc698872f51d747d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838995, "uuid": "a904704f-6a90-40d7-a847-9cfc5dc2a10b", "value": "T1D133F984F98B85F5D9078C3050A7F13FCB31E97940B0C66EEF9A9F35DA3B941921219A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838995, "uuid": "49c97ddf-20b8-4e70-b2f6-489d957912cd", "value": "1536:a0OrxIddROckRI1jeMG7NK6Rn2hzpXLtJDQ9:a0OIddROckROK7NFR2HXpJDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655838995, "uuid": "f82fbc77-285e-43d0-8d96-f7ae62df0eb7", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655838995, "uuid": "1968571c-2f0a-4f31-b03a-14af10434b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655838995, "uuid": "345ce713-2231-4ed5-be4d-8e4368ecafcb", "value": "a4aa34e3645c15de79330c76f9a5695c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc466ff9-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1655808208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808208, "uuid": "df0e4df9-bae5-4aa3-aba5-b78e9580bae4", "comment": "Malware payload (QuasarRAT)", "value": "7aedca401ed06f4dfa997cfa974d0f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808208, "uuid": "30d04d52-bc5f-4d8d-89ef-69e0a83163a9", "comment": "Malware payload (QuasarRAT)", "value": "da85aa63d08876e8725745414b59731d74d1129b21cbc48b41bc50d70c40c0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808208, "uuid": "0b3aad83-8b22-4ad0-aa7e-30f61264b635", "comment": "Malware payload (QuasarRAT)", "value": "e274d5a12278e5d055709424eca44d4e9a706aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808208, "uuid": "579a8a75-0484-415e-86b3-2e77a35e09b6", "comment": "Malware payload (QuasarRAT)", "value": "f2261957a751dd57acccfe2ce5bfb1932f9ca6b9fdcd5693f122b124f78112948580597abab4ef78d13f765a837918a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808208, "uuid": "051a0c7c-fe38-4c49-a3e3-9119164a241e", "value": "T1B1748D1377A8E93BD1FD2736F43206154BB0D84BB616E38B5A5846F86C233868E513B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808208, "uuid": "b9546276-13f3-4d7a-8c37-9e40e5dd86e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808208, "uuid": "b6de3ea1-2447-478b-9ab8-3b9f0d7a3461", "value": "6144:pI6bPXhLApfpsyskJrO/ERbkE6+dgE0s+qhgcC:+mhApQRMi9fs+qhBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808208, "uuid": "15e6f79e-5cea-415d-ba5d-7420aca5657e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808208, "uuid": "8ed6351b-bcbc-4b28-b4a6-7ff7eaab823f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808208, "uuid": "b8214589-5669-4387-b969-b53ece8631e1", "value": "SpammerDS_V1.3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147350d2-f10b-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655779043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779043, "uuid": "bb7f6c38-dbe1-40c7-9938-a70d191209d3", "comment": "Malware payload (GuLoader)", "value": "4ae852fc47ede19ec93d11936503f98e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779043, "uuid": "731d93f4-457e-4442-8806-f17e0b7ed015", "comment": "Malware payload (GuLoader)", "value": "da94cb63646eb208e495a185dfb0a972a1e9868ae582cb22f7d65cf0a11b80af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779043, "uuid": "3bf55c80-c4e9-41a4-bd71-43f17344435a", "comment": "Malware payload (GuLoader)", "value": "de765700ede9c8b5e54005d5d1e08ac6cc2a4b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655779043, "uuid": "b0b4480f-7585-45d8-880a-415ef3abab8b", "comment": "Malware payload (GuLoader)", "value": "226a14353c42367ba6b16cbe58f2c59c5e9570581dd34f7cd5ae030425eeee41e39d6f17efa58b072b18afbfe577c6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779043, "uuid": "bbe7f3f6-1efd-4161-ac4b-d0f070477734", "value": "T1EC04E0507260C877D4B14A314C669B77BBB2AC265A608F4B27507F0D3C72A92CA1F76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779043, "uuid": "b53baae3-6b71-46b0-b6b6-d0ee9e67d971", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779043, "uuid": "1006dfc7-835d-419b-ad74-8c607d99a242", "value": "3072:6bG7N2kDTHUpou/Bwl/i4O9jbxROPyYLZtLyebKDXMZ:6bE/HUHBjJxROaYjheXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655779043, "uuid": "173fbe68-8d86-4eab-9a2b-11bd8b19ec81", "value": 175320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655779043, "uuid": "efc1544e-a11f-4f6b-befa-0668dc71a989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655779043, "uuid": "1d17617e-7013-48e4-ae75-78b0e3fab696", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.8472.11562.19807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9b87c6-f1a2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655843909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655843909, "uuid": "0e08185a-3a93-4f8e-a888-cc31f4f4eff2", "comment": "Malware payload", "value": "c199e948f3448ecd86ab08131bb1aa3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655843909, "uuid": "81025cb4-7155-4d9c-8e1f-b9385f1db103", "comment": "Malware payload", "value": "da9c1e9509ee592f1b5a07aec954e0e656d5dadfc164fe72a3d23a3c9f364c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655843909, "uuid": "b5ad9a10-a72c-472d-af18-4d06271b3fe7", "comment": "Malware payload", "value": "67554081c2aed4456d9426a69bc78d2bf729e263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655843909, "uuid": "3bdcbc78-3aaa-4022-9470-aaaf01b486e6", "comment": "Malware payload", "value": "52281bfefe803857a3602b1ff4b4a3881256bc7abd292504b6741a23036a22ad5a24c25bf4d98e60593421c9429f63ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655843909, "uuid": "2514fac0-9dba-4262-a303-36b8bb33604a", "value": "T1AC648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655843909, "uuid": "08825739-4005-4c4c-8040-aee20d6acdbc", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655843909, "uuid": "c72b72fd-3b96-4307-aa80-7d915d2b8f21", "value": "6144:JqdSTDcHe3kjHfNsQnqXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3qIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655843909, "uuid": "bb4abf98-2028-4b7c-97bd-99bd9bba91aa", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655843909, "uuid": "68d2b78f-f113-4e9d-9a25-62d8d07b42b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655843909, "uuid": "5422f47a-b034-4829-8760-dbcc1e853a0c", "value": "c199e948f3448ecd86ab08131bb1aa3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376a43f7-f18a-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1655833647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833647, "uuid": "09721944-e3ee-48d7-8e23-decef022800a", "comment": "Malware payload (njrat)", "value": "d409895f1fda20f41179ec2bb8bf41e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833647, "uuid": "39bb74b7-2de9-42bf-9f35-15f70c216223", "comment": "Malware payload (njrat)", "value": "db3cc76cb4a1b958dd71e4ce0a6fd5233320fddd4d2ae9239de97d4ad1e25e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833647, "uuid": "17cbfabb-af13-492b-ac67-4d980d9d34c3", "comment": "Malware payload (njrat)", "value": "68ad7c276210387c122c2eb511d65a6c8cd1d7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833647, "uuid": "cdf4d772-cfc9-405e-b5c2-9c185431a938", "comment": "Malware payload (njrat)", "value": "750affac0d46b502066ddbe6839efcc644237555f696ab820bc647065a300c9bf9b1e0c458af4b5560569885e9edd2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833647, "uuid": "4ac18e43-e565-444a-8868-09a062f91a8d", "value": "T168F3D76BB684CF15DA582871C0DB953003E69DC71B33F2463F58279D1E423E69D8ABCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833647, "uuid": "53664a08-7f19-4c9c-9a07-8923fa013030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833647, "uuid": "a632c950-88ed-4fbe-ac21-ab1b33050c3e", "value": "3072:8PjOc+7qUsOvI1x8bOVzhZHZ2PdThCM12Du2/uhJ1M/AqYC:8PUsOvI1x8bOVzhY4uiKM/1YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833647, "uuid": "c1298a68-6dad-4d31-bca7-5fdb7633b3e3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833647, "uuid": "945cd7c2-aed5-4edf-8b23-4e1b99e223ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833647, "uuid": "2c7d09f0-4363-4e34-8c53-ce984d8f8bdf", "value": "last.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b80498-f163-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655816835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816835, "uuid": "8d8783bf-8ca0-450e-bda5-4a47628a5f57", "comment": "Malware payload", "value": "9bb7ce401939310340281705d797eff8", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816835, "uuid": "9c839c4e-eaa9-479a-895d-225b12f52bc8", "comment": "Malware payload", "value": "db648b7ef68a101713ea8add6a0d0e97773d06c8ca5170e0b0c48ce08da8fafc", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816835, "uuid": "443a8b49-95c7-4ee9-a875-5622a70e2de5", "comment": "Malware payload", "value": "88320e92001b75fc1f18320062038618388d7029", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816835, "uuid": "9196f80d-61ca-4262-a566-d5c053085963", "comment": "Malware payload", "value": "4245d118d9f1bdb0eaf83398c6011f525d000345e6bf25e00801f01900209f8ea45ee1525918eee97bd073c40e942f14", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816835, "uuid": "75f7048e-4eee-4180-acf7-a864272afe35", "value": "T18533A4094D89595B8273B33AEFA38459EF23116303665630FEDCB2061FB445846B2FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816835, "uuid": "d4c2c061-9fa2-4c02-ba90-8d795edd5c19", "value": "768:5rWLRSTt9EQzQvUrDAg5kCYtzEl2lJ7h4k:56RSTt9EiQcDGCYtzEly34k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655816835, "uuid": "5facc16c-c39d-41e9-a55c-6c3abe285209", "value": 51347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655816835, "uuid": "e03b3cd7-756b-4556-9147-6e6b1234aa71", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816835, "uuid": "0a770513-24f9-4828-9733-11636dfe6c7e", "value": "UMq0gekD.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d489673c-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809000, "uuid": "0382358f-24e1-4f97-a7a8-201889e825ef", "comment": "Malware payload (AgentTesla)", "value": "770f5495233f139c573d055f6b63fc7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809000, "uuid": "216cc8f3-cbf1-47b1-9f74-afd7e82000a2", "comment": "Malware payload (AgentTesla)", "value": "db7026ced4cede7a47e69e176a8c7a3f00921fc435b0ef5ea0a2fcce04e5b139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809000, "uuid": "14428ceb-ac07-40dd-83d7-524bd65f4e45", "comment": "Malware payload (AgentTesla)", "value": "fa60b2c51198cc4f6d8febce6f7e25a2487ef473", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809000, "uuid": "44f63b7c-7dc3-4674-8866-8b7ccc8af06c", "comment": "Malware payload (AgentTesla)", "value": "f0677275981cf207740807b71bb18dc118e290640d119dd70e6e6babc2f3f8e670f8f4cfa16194770d867dc0eaaddd25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809000, "uuid": "645ab333-7a10-4086-a3ed-20f0c7e20fea", "value": "T11802BF49FC816CD9CD6BE43F66EE95E90D1676017C04BB5332A2F1220B078FB228D46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809000, "uuid": "42d765a8-9b51-4c80-9990-3831a79c2319", "value": "192:xrXP/B34a7iL3ai0UKCcl3dSUvX5ftHBPxwPxtvsn:dXPht7yKzpl3dSUvpftHBPxwjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809000, "uuid": "f9df9ce9-0e64-4a2c-83e8-d435ac85a5c2", "value": 8788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809000, "uuid": "f0e7378d-e538-4ff8-9dd9-02ad1441fcdc", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809000, "uuid": "7a5ed213-2fdd-4135-aae8-fd76208bfded", "value": "RFQ HRT091321.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94424913-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655802450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802450, "uuid": "168cc614-0269-4fc2-8b93-aa73094adcbf", "comment": "Malware payload (Formbook)", "value": "939b429a57287162bc41f316f44eb30f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802450, "uuid": "af887956-59bb-4fe8-9726-3719bc523789", "comment": "Malware payload (Formbook)", "value": "db8c0ba2cb25a5ed15cdc6c5e58cffcdc276acea0036813db8824aad1ae5ca22", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802450, "uuid": "07d7f544-0f03-4312-b369-2cb3722811af", "comment": "Malware payload (Formbook)", "value": "d847f7c19c0f05eaa78c01c7f3ce870542f126ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802450, "uuid": "4c3d8ce4-b5c8-4282-b1fd-65b269cf247b", "comment": "Malware payload (Formbook)", "value": "c4fad8928daef1bd47e80075c4cdc6188eed31489cff261f747da2aa2c77cdfc7a4372041f7bc44c51a92265e2b968ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802450, "uuid": "15fcc343-57d3-483f-a893-dab682b9514d", "value": "T160F3DF65338FA43FEA21C3B128E7655946747EEFE8731F468CD1309AE2FE4401989639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802450, "uuid": "7f650b3d-9292-4584-b9e7-5c8dc5536581", "value": "3072:j5/QmtP3KJVnmwWLLNC3Wrmt4utuIY6MXD5z9yfKsKguVnKvHHaFlcI/KAMqkU5/:drP3VwWfw386WFJyfqFnKvHHecISAEe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802450, "uuid": "bc76c5e4-84b4-4cba-86e3-1285833ae289", "value": 172392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802450, "uuid": "46b3a30e-d804-4954-b369-086837a310f4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802450, "uuid": "cc25569f-21fb-4467-9787-3908eb486041", "value": "Purchase Order Sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3e68a3-f1b8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655853520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853520, "uuid": "20c1b03a-b1f9-445e-b5ed-9047cf0bec82", "comment": "Malware payload (Mirai)", "value": "0d4e85b288194bce7b1e76fa11c622ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853520, "uuid": "0475f02d-9bcc-42c5-8db6-04141e8a183c", "comment": "Malware payload (Mirai)", "value": "dd007b39b3006968a22c560f1f5c506b464f9d2b2e4760706700307e9adf1cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853520, "uuid": "dd5884e5-6040-4e0e-9534-4da715970c5b", "comment": "Malware payload (Mirai)", "value": "57b517ee252a04de7974c4e73853ff680680c97a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655853520, "uuid": "1277fce1-8395-43b0-87ef-708d31574a98", "comment": "Malware payload (Mirai)", "value": "a6230923c94d71644c699d899b6c7b7b9bc608bfd5695d3a1bec2a49a77a3eca72c952a67585629b081a45a6f61dbcf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853520, "uuid": "6bbfe09a-f9a2-41ee-98fc-730c01f75a92", "value": "T12BC2D044E3C22D32C1B4A834FE9181C72EC99DB1A6FE31A9E75407F644C691BB5265CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853520, "uuid": "ecd614d5-b159-4381-bdb1-1564c66b57ab", "value": "768:7egha0nO8oH0L8bWpK14kuO5IJRmuoRQyYzfs3UozL:7egha0Fl8bnqP54zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655853520, "uuid": "4a060ee7-c12e-4b01-8bc1-963a4627f984", "value": 28264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655853520, "uuid": "85120002-0e2a-46b1-9935-1fe5ee95c6c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655853520, "uuid": "a70d45d8-eecf-47bf-ad41-2df4e5e143ec", "value": "0d4e85b288194bce7b1e76fa11c622ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ace742-f186-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655831878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831878, "uuid": "8a01c88f-0150-4398-9181-9a08ebf90d2a", "comment": "Malware payload (Heodo)", "value": "2a88dab52405fc597026c799d8840a3d", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831878, "uuid": "0ad5ed5d-78b7-43f3-b55c-fcff10e12d1d", "comment": "Malware payload (Heodo)", "value": "dd3385017be789042dbf35d10bf18f246f4ed110c108f1858df74c7f5cdbb799", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831878, "uuid": "db70afd2-08bd-4803-b339-484efaba5c96", "comment": "Malware payload (Heodo)", "value": "ae81f7d621aa04d59420b1ab125113653f246f00", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655831878, "uuid": "deef4bd2-bd70-408f-a5c2-89ac66c16a14", "comment": "Malware payload (Heodo)", "value": "b214401af0a2e71ce707fba8ac7d00d0bb840d89637aa7c96564c55391748ec4bfeec2573b01d4df9243a9ba24e7efef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831878, "uuid": "c7107247-3186-4b89-a4de-168f6e0e2598", "value": "T11064AC062240446AF74A4B708A17F9D687667C7A50E0E74EE6387E361E333839D77A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831878, "uuid": "de3ebc91-02a0-4d0c-85c0-d1448d9d0ca8", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831878, "uuid": "7cd412e4-40be-4cd6-a6fc-558059df50ed", "value": "6144:3MiSTD2He3kjHfNsQnEzsNdzq/M+8nlC/FuIbuibSLTf:ciA2FHf3TNmCWF1bTSLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655831878, "uuid": "fb472506-e15d-4d07-ac18-51ad3f930c4a", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655831878, "uuid": "fc9247de-7574-47ae-8569-092462441864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655831878, "uuid": "7de157ea-f034-45af-b75c-3a9bce377d30", "value": "KQ46Moviw.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf92fa3-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655802520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802520, "uuid": "5f780435-0c34-4c29-996c-2c4bf5e3e25f", "comment": "Malware payload (Loki)", "value": "2bc5e757570d100c991373c394978a65", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802520, "uuid": "8226f9ee-c85e-4f42-9f3c-2c7b0e75c740", "comment": "Malware payload (Loki)", "value": "dd7c9fae7cc33d129e488b74666fae503d2decf838181e294700fb2ef39878e3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802520, "uuid": "55af328a-8063-4ae2-aa81-2bf0eb13235f", "comment": "Malware payload (Loki)", "value": "dce11ec592eb30b060d1e8074bfa08b2c7005945", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802520, "uuid": "18837f97-127e-4c68-9328-ee023f226428", "comment": "Malware payload (Loki)", "value": "26d0c82a48511cb06dafcb18906b692ab417b07d7b5b731de5a2f2a8af11d594d2bcafa3ed2278f89dc5f6877d0993a8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802520, "uuid": "d2318e87-7eb2-4588-8986-2d4e011f802c", "value": "T1BA83E0430FD4E167D478A2BC64EE6BB40E8E3C42566F402F16DF362E90FA7546E71612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802520, "uuid": "967fd4f3-71f4-4130-b333-e8b483d5e002", "value": "1536:MeA7YaKRSLObTg6YWFpenD4SBCj7Sxrv3kFg+lxLTUsHdia+:MeABKRSLic6NFNSBTxrfkPljAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802520, "uuid": "51ac7408-a09d-4da7-810e-54559ed3c006", "value": 82216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802520, "uuid": "a740f40c-6a5c-40a3-b577-979228b89153", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802520, "uuid": "d5909af7-da68-40f2-b65e-6c99db4410fa", "value": "INVOICE-JIN06212022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b2c606-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801842, "uuid": "1cf553da-fc12-40c4-bca5-c61c4756893b", "comment": "Malware payload (SnakeKeylogger)", "value": "2c21db298a22b6fca2e3ceb192c26c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801842, "uuid": "48fec75f-905f-4eb2-9393-d404e222daaa", "comment": "Malware payload (SnakeKeylogger)", "value": "dd8fefbcdeba4057c021d68929cd17b57987719c82c049de8b3536a33445386a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801842, "uuid": "49725d21-0711-4967-b5d1-bd217ba8eea6", "comment": "Malware payload (SnakeKeylogger)", "value": "da83cf44f7ae28d0e8b34b29b07c3d8ad80d5b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801842, "uuid": "de8db4db-3829-4c78-82f6-430ec220364d", "comment": "Malware payload (SnakeKeylogger)", "value": "8a3b95ea479bc082a3b575be8ae7a59aa673d6812c493ac1f2c9edcffd7145c9de8f1130ea0c1983aa49a7d85bd8bb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801842, "uuid": "819f5269-4f91-41e4-b2d9-b0255b34b0ba", "value": "T18674C6A05D1208BFD24F47BDDC4D787C255B5C7EFAA3633C09AA320B45337651ACAA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801842, "uuid": "163e7018-12d1-4d45-8fb2-40deacdb69c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801842, "uuid": "a386c5d7-509b-4a3a-b400-64f0435847b5", "value": "6144:69bFrDiGGxGGGGGGGGxGGGGGGGGGGGGGGGGGG4GGGGGGGGGGGGGGGGGGGGG+GGG/:6qGGxGGGGGGGGxGGGGGGGGGGGGGGGGG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801842, "uuid": "88b5bbde-4503-4880-921e-6d4b8ba99bf2", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801842, "uuid": "82e161b1-10bc-49cd-8259-6dfe63cd48c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801842, "uuid": "ec170f71-b7c4-4802-a28b-72b1dd26dac4", "value": "2c21db298a22b6fca2e3ceb192c26c72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11c354f-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655808135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808135, "uuid": "b1a99984-38b4-4c2b-b228-424aaed548cf", "comment": "Malware payload (Formbook)", "value": "7565784c6e2cca725b1cdd88200186fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808135, "uuid": "94dbf98e-6b74-429c-b039-e734bd3796ea", "comment": "Malware payload (Formbook)", "value": "de4c002d5b5981476ecd950c93a32496008a865c9e72d3e0ad63b218a858beae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808135, "uuid": "7f550a4b-197f-4fab-bf01-2c035ebe800e", "comment": "Malware payload (Formbook)", "value": "4e40bde881e956d839dfb2093df296ceb84336c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808135, "uuid": "a2b04d7e-8a8f-43dc-962c-a37efdfc4fa4", "comment": "Malware payload (Formbook)", "value": "85ed64e40fc02e58adf55c9155f6fd46ffdf727f8d7cd03594eb76822e4701edd6bd7a31fa4239707337deccf488e0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808135, "uuid": "1a9e4078-6475-4f24-a39d-fc7836679be9", "value": "T116751298B3E90A04F3FF6FB8ECF110549671F9179811D64E2889205D0F36B4AAD61B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808135, "uuid": "65a0f154-6797-490f-872e-c11af03a1566", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808135, "uuid": "ad5ebb69-883e-4667-9909-5df039e3a960", "value": "24576:ce3i2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnH:NSTq24GjdGSgw+W7SCRnVQTEQ/BA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808135, "uuid": "b58104cb-1063-4216-9a37-5a2f9adff1a0", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808135, "uuid": "15bf0e72-a609-49ea-9eac-4f09301c225f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808135, "uuid": "83c590a1-1e8e-4b14-8045-52edb1a75f2b", "value": "build (2).bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda3b732-f142-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655803056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803056, "uuid": "f78564d6-d077-45c5-a55c-e721d0e64b1a", "comment": "Malware payload", "value": "49bb86c2a31940b72ee643d5e3344c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803056, "uuid": "9ad63fc7-7f66-4436-81e3-52ba25a8b9e6", "comment": "Malware payload", "value": "de95f83218bd82602bb9c10c973a2223536da2c323ecf449194429a0c33f1f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803056, "uuid": "628d413c-79b8-4239-ad32-0e4a42f497b1", "comment": "Malware payload", "value": "584b815e05e3313186df33e91c6acd0cbadcaf3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803056, "uuid": "a90c72e3-715d-479a-b3f1-ad264da45db9", "comment": "Malware payload", "value": "c3eff7fa7ccefae0a3222971cf41d83ab8aaa4dc54f3957d0540c00000fda37222f107bec3cd57daf0b70423c653e988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803056, "uuid": "8e86d5ad-b009-4e57-a81c-98636277f3b9", "value": "T14604C7362D379004FEFCC239BDD0779002687ABFACCA1F86E945B6CA35A72D45270566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803056, "uuid": "77f66c7e-e6b3-4dac-8d17-168b03438af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803056, "uuid": "f7f98601-24ec-4a44-a84b-2e93299573ea", "value": "768:yERfxVr6+9vYrZjY566666666V66666666R66666666WDDYPjl9B5pJJJWHmgEbk:yE/564vMmgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803056, "uuid": "151d3bce-d77b-4813-bbec-8a30f93dcd34", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803056, "uuid": "cd77a301-5cf8-4635-aaf9-452464134b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803056, "uuid": "c65e0511-0019-4af6-8bdf-a5f8934eb29a", "value": "SHIPPING DOCUMENT PI#PI19-201171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6086df68-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1655808806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808806, "uuid": "2c82fcce-019d-4742-a793-7f413c7b964d", "comment": "Malware payload (GuLoader)", "value": "3e4f4331054adf1290897c4559212b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808806, "uuid": "29760e1f-3685-4048-9321-6d8a591204fc", "comment": "Malware payload (GuLoader)", "value": "df174300d7e4ef4ea4633a8d81e93b7462c226092981df8a67b2d3a8f6fcd1ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808806, "uuid": "44abce71-2723-4263-999f-9709287ed884", "comment": "Malware payload (GuLoader)", "value": "ab4995d8ddc21bda27871bcb4acab2547b41fcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808806, "uuid": "91cf9065-0f0d-416c-bbd0-01ce53699336", "comment": "Malware payload (GuLoader)", "value": "3a12b42c1c5aae222fd5bb9c81b43f6802fc45e3fb2432c072ab4f2acb35b12c12ca68337e96d0cf9ea4c42276191515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808806, "uuid": "2691b2f5-8c6c-49c7-9d50-de052b8117da", "value": "T1F024D0217794D817CC66067244BAD37562B0EE152894EA0333F07F5BBD276F2990B3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808806, "uuid": "a82631ea-6807-4ab5-8759-da87ee88a427", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808806, "uuid": "13670a42-6239-46fb-8761-80cfa2a094bb", "value": "3072:+fY/TU9fE9PEtujEZasvlx+LBEFxAVLSaVVglbG3gJSl3SWFWh6ZSJKZS/wiVi7F:oYa6nsvlxsB+yV9+9JSliWFVwlmJrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808806, "uuid": "cdf54b78-c5e7-4a81-835c-03af8c7fb39c", "value": 218809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808806, "uuid": "72e43446-db7c-42e2-9b37-cc7f9bb56170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808806, "uuid": "ba0ea409-b0a3-460e-9ded-38bd95b3ce4d", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff410835-f126-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655791033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791033, "uuid": "b3d743f6-4a2a-4379-ac7c-271f67fd37b6", "comment": "Malware payload (Formbook)", "value": "e7ba034273490eaf89c8ecff3e02f630", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791033, "uuid": "98f48cc8-5a93-440b-a56c-d2dab4ce9768", "comment": "Malware payload (Formbook)", "value": "dfe3066b882f8d890fa54a5dae80a91db766f6c691f108d14cf439dd69231e39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791033, "uuid": "d074be86-9397-497c-8fe3-207670580369", "comment": "Malware payload (Formbook)", "value": "157288020b3af2bacd6c12cb54a4c2fbffc02391", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655791033, "uuid": "3e32fc01-c6c7-43f2-b7e2-a7cb24def63d", "comment": "Malware payload (Formbook)", "value": "4f6cb34fda700f0bf5246e4de7cb01885d22dc523c07a4025dbe3035aa21cf28ef69122a98b8ba0f4703ff48aa780838", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791033, "uuid": "ee7675d8-c8cf-4f08-9e09-6f987ba968af", "value": "T13A63CF443052A58BF327177FFA19970945E3DCCF5C82C38FA12D36A98E719E05399A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791033, "uuid": "876be5bf-40f4-4f96-bfb9-5349cff89f0f", "value": "1536:geaQjvZ/cV1GAjOX4pN/5Cisp3LwbCRfmxPA9hCMw+ER4HO:geFvm1GAjbHERssfmxPA9gMBcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655791033, "uuid": "bdcde5d7-4014-4c3e-9e2a-c3e51808c0e7", "value": 73336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655791033, "uuid": "0c48d22d-9cb4-4acd-a193-b02aae480fc9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655791033, "uuid": "ff6bfd09-f390-477e-8a91-6015a6bd69c6", "value": "A_SGMK_SCMTON3467575436346264523525252.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc4d11f-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655808583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808583, "uuid": "42177833-99ca-43f7-8b2c-f3cc1b07be92", "comment": "Malware payload (AveMariaRAT)", "value": "16226d354e5031a4545271bc6df9e7ba", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808583, "uuid": "35055a41-21cf-41f9-81f2-e310e13ec551", "comment": "Malware payload (AveMariaRAT)", "value": "e12d32ca1f8fe95de278c8e5c4f8def1ccc112af1bb49732d6f077f08f7c73eb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808583, "uuid": "0a643623-d9f8-4f3e-867b-43424c7795d3", "comment": "Malware payload (AveMariaRAT)", "value": "dd9e8953bde4c50230ddf89bf48c7cdb6af8dbba", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808583, "uuid": "cf265190-33d0-4983-a5be-b010c2ec44ce", "comment": "Malware payload (AveMariaRAT)", "value": "24c58c7581a57cc8290d87349637813f1965ebeaed2da1d1ea69ea57325e601e68ce7b2f7e01f3703e6c948dc4453364", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808583, "uuid": "e099fa0c-774b-4154-bff2-b070e78dee3c", "value": "T1D7347DDB68D88032F0F31CBB8DCA70A449277C19091C4CA97ED6BA4F793A542546DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808583, "uuid": "ff510dbb-f8e6-4dc3-bbdc-187c5c4c76e7", "value": "09876ad8ac5cf1f5f38f35bc6647489a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808583, "uuid": "e6e3ca37-071d-4c40-9263-189eb930c1cb", "value": "3072:emyPROh4GyW5ANmk+A8jtrBaKZijSLmsgarIY/kuz01S5PowHooWYKj1iIHn2yTH:emysSxNmsmijSq8Iij0MKrpiIH2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808583, "uuid": "4414bea3-fd61-47cf-ac8a-9eddf776b4d5", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808583, "uuid": "ae7018c2-cc8e-42cc-a67f-3e7a397aa666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808583, "uuid": "bc2c315c-9e1c-4db4-9a45-2059f21d1be2", "value": "SecuriteInfo.com.PWSX-genTrj.14391.30426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788f2338-f104-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655776204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776204, "uuid": "a8072ab5-b963-45cb-b25a-12c21023aad8", "comment": "Malware payload (Mirai)", "value": "01ce04662e3ada3940fb4b3f840f45cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776204, "uuid": "a8daafa1-8f41-4da7-93dc-b2c0dd7330d7", "comment": "Malware payload (Mirai)", "value": "e153d44ca9aaabb34337d1bd19ad635536efd7e3ad4898215b64c8e9a303cddb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776204, "uuid": "97214d15-fd55-4aa6-a937-2ebeb7fcb96c", "comment": "Malware payload (Mirai)", "value": "d00223e4bd48b3cdd07091899594af5789d66c9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776204, "uuid": "384e1233-cbb8-45fb-911d-7131174fcf59", "comment": "Malware payload (Mirai)", "value": "4d896e20f901bdf03d47536510f3384e529cd4dbc25c4e00b4325cab3759e3eb25ac2871ff165807888e076cdfea8405", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776204, "uuid": "4fed8dfc-dd6a-4a84-bc69-41dbd7ddf468", "value": "T16A23F1254B65A572E632D8F2680606033F4F5F3AC2FD346BD0A546D9BA14E0354FA3AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776204, "uuid": "38507fd8-3609-4958-b65e-6244080f94e4", "value": "768:PHq8Y45S0GcObDSaq77NKv1FxH9q3UEL7yBZUXBxSf+7:PHq8hS0lObDLI7NMrxWL7zxM+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776204, "uuid": "7cbf5f1f-878d-4b26-9ff5-c03f2309eed3", "value": 46848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776204, "uuid": "c7b42055-ab45-47b6-82cb-e23b56d0d004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776204, "uuid": "360da146-f079-47f9-b15c-9c0cfaade57a", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2062857-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1655803842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803842, "uuid": "48a01317-5ef9-47e2-9626-fa0c4c54a9b6", "comment": "Malware payload (STRRAT)", "value": "42bf25bde680f2a7d1b44be0d28e7373", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803842, "uuid": "874d409e-21e1-4116-b2b3-12e8a8e38da3", "comment": "Malware payload (STRRAT)", "value": "e2031c646b3637c9f97b0742b58cb7f6973be937e310e6e28792f4c614113532", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803842, "uuid": "09cf498f-64c4-43d5-a551-ba72db3fc4f1", "comment": "Malware payload (STRRAT)", "value": "2c3655f55b85599b193d3cb9d50f25fca15a7094", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803842, "uuid": "022e56d5-f7f0-4dd6-8ee8-e754ffd3cc05", "comment": "Malware payload (STRRAT)", "value": "d772c030ad70f94e1abdbc3a441be5e58547f9424150c26ba836a8077029a75f853e9901aee7c7d80bbda95b7d0d97d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803842, "uuid": "08170723-c237-47fd-a6ab-905aa6f35aa7", "value": "T1E5F4E7C529683A0693B3FD34D321E533BC34E923299B16D67D807F95BE76C405EADA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803842, "uuid": "2b1dc62f-aa49-49cc-beca-c94388a45696", "value": "6144:RUAtLDNZV05YHcd/OqqarcAjOzZKdZT9qFQdd1m3kIXRGo83sBmKwMIvBKps63dl:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803842, "uuid": "f3d40da2-4227-4102-a6ba-94453fbc1c6b", "value": 768278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803842, "uuid": "6c2bd204-77da-44c7-a0f9-93ce717b3b58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803842, "uuid": "66f57077-da0b-4b64-9e1b-4c7da12c24d4", "value": "AWB#98764PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89ea199-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655808578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808578, "uuid": "b8a94be5-8c04-47e0-a9d5-9e6bc3f5709b", "comment": "Malware payload", "value": "d0317747af0387db64f1d3d984bddd98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808578, "uuid": "f7588e1f-cb0a-4410-b197-601ed8098429", "comment": "Malware payload", "value": "e26a254ffd5d43e666f1c966e99d99fd5c65cd531184d7304797e051661d3553", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808578, "uuid": "b0d29872-76b0-41cd-9359-7332affd2bda", "comment": "Malware payload", "value": "977f0275b0dea53ca7f361868f966bd704f841fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808578, "uuid": "e3f11b8f-e8d3-43c6-80a5-251fe6232ba9", "comment": "Malware payload", "value": "6b47e1e21dd7c40daebacd43fa6957756f6f98b5bd9350ee5e75bfada3848b6e56daf2cdde3af9c0870a27a46d90d398", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808578, "uuid": "83128d4c-8237-4a4c-9a8e-ec7d3eca41ea", "value": "T1D5352310EEC81FBFD3085B7AA05BEA5D1540BEFCAB21A03723E8745A65341B5D4878BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808578, "uuid": "2d6746f6-eab6-41d4-ac5d-35364f765f56", "value": "24576:YW1OcvkCmdHn1F551gP23Rg+bb/qaVfYEiOiAX2dlTEWVgOG0TYt:x1tIH4R+XCTEMAMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808578, "uuid": "46551226-2033-45ac-9e47-d50b482d2c47", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808578, "uuid": "c418b4e9-de90-44fc-8b82-c0f935feea28", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808578, "uuid": "0def67d4-b3e8-4ecb-95b6-9d2250c1f9b3", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.9098.17271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679ca7a1-f18a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655833728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833728, "uuid": "88577452-b0af-412f-83c9-889c992ef9bc", "comment": "Malware payload (AgentTesla)", "value": "fa77d79b60fdd61575be4d378077709b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833728, "uuid": "1c1ccebd-81a7-462a-8868-075ac8109925", "comment": "Malware payload (AgentTesla)", "value": "e2ea826b61a7ac96a22368ae6cd3164c159681479ad506401998c478e18844e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833728, "uuid": "f59aa839-d8d8-48ed-acc5-6a9b24cc91c2", "comment": "Malware payload (AgentTesla)", "value": "417481db4c34a1956caa6e8b2398e04a42e9283f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833728, "uuid": "420bead7-d69c-4978-962f-910908f02723", "comment": "Malware payload (AgentTesla)", "value": "a2ad45a512f9fd638683aec03b78542647a9a30c4310186c60cfe0f3d5253d0bc5ae108db022b4cca0861fc6da1f533a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833728, "uuid": "06324b7a-932f-49e5-bd2b-5b1bbfb86212", "value": "T13604035FED04AC8CCA750AFB6B75D3006D647E12AE1F46DD238CF68B4232645622C6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833728, "uuid": "268060d9-805f-40de-ae97-8a4cb554fbdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833728, "uuid": "a7c3e792-58c5-4791-a66f-720728875240", "value": "768:M3aAPp/iSf2Rht0A8a0AgMWkeXNoq/oor64o8Zi:moztGakMWkeXNoq/oou4o8Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833728, "uuid": "3f6571e1-d316-4560-b39d-5cde69259af0", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833728, "uuid": "18391264-07eb-4a98-b7f5-9426e6cd44fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833728, "uuid": "3e48af57-22ea-4df7-ad2e-70f1bdf74632", "value": "SecuriteInfo.com.W32.AIDetectNet.01.14273.31797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1852ec-f13a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655799514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799514, "uuid": "ec81c1d3-f61d-4ce3-b7e7-7ee8ad04e5b6", "comment": "Malware payload (AgentTesla)", "value": "28c69f2f73da45f09d3c9a3659238262", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799514, "uuid": "0cdfcd48-84a9-4182-872b-99bd449b193b", "comment": "Malware payload (AgentTesla)", "value": "e32e69cd0729d5e2440890de63139809d9b83d4a204e0240d2825edae04a2054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799514, "uuid": "fcf70232-9349-4670-9116-5a58bf637360", "comment": "Malware payload (AgentTesla)", "value": "35df95638a3c97734041a11494483e65b12794b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655799514, "uuid": "3290f650-170e-496d-ad74-81595586b18d", "comment": "Malware payload (AgentTesla)", "value": "561deaf2cea6a299e81c4319f0fab95b13cccf914943468d2edb87320d8fbc28cad182aeab84e6740125873339ceee3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799514, "uuid": "9087711d-28bd-4330-a879-89a80e9f844c", "value": "T14654CF67B2CC9F01D9A86571C5DF593117E1AEC72B32E3993F08B69C0E123A39E41789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799514, "uuid": "92937034-ebe1-4262-a6a2-d5a1ef7a9d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799514, "uuid": "c4192fdf-e4ca-41c7-88f7-35df53858d78", "value": "6144:tCluiJHBthMGn1Wg2wA4s0hWU1qX9u/F40:tCdJh91Wg2cs0hpmud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655799514, "uuid": "f3e80f50-63a3-4fe6-82c0-376c5400d697", "value": 288792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655799514, "uuid": "efec3548-d2d0-4635-8a59-f11bb3b1ffb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655799514, "uuid": "e900014d-b6d2-4d98-a669-d11aa47e7cb2", "value": "Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468509bb-f1a6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655845699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845699, "uuid": "2e058860-60c5-4491-9967-b52990062905", "comment": "Malware payload", "value": "5565bca70f59060a08e73c5a4d44504b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845699, "uuid": "d6e07f1b-2756-4111-a243-5333984a34a1", "comment": "Malware payload", "value": "e3d69799bd80404bfa4f52077c3d3999d1ba634ed59a2376fb2801aa64935d55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845699, "uuid": "a921ca7f-e303-4924-b16d-5721ebd76cc2", "comment": "Malware payload", "value": "39ecb6f5d0aba6a158e4b1053bd29eb223253836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655845699, "uuid": "17134684-52ec-4d52-b148-332835eb20aa", "comment": "Malware payload", "value": "7f7137ce403c6015dcaba6e6db65b909478989b0447177437fe8ce2a77cf3b16fc2b3b6c67f869b8ebd2d1d53db83d51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845699, "uuid": "33fd5157-e5bb-40b6-a5a2-98a74deb2c93", "value": "T1CF84CE00BA90C439F5F711F449BA9268B63E7DA14B3460CF52E56AEE5638AE4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845699, "uuid": "d8e320d0-59e6-4ec7-acb8-972321211baf", "value": "dbe7c866442b2c90ddc4d147097c4eb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845699, "uuid": "dbad065b-18df-4568-8543-bbcaa8cca556", "value": "6144:mXnreduD0H/2bq//ndSi8Kr3OArCBT1yMwmH80v6Jlj4O27iU/yAs:mXnqdDf2bqXdSi3ZYT1vJxvYl7279Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655845699, "uuid": "97719d6e-d551-4524-83c3-8b60a0419c60", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655845699, "uuid": "a7f81a75-9303-4134-af20-de560f49d74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655845699, "uuid": "4ae6b4f7-252b-4a47-8018-0c998e84f28f", "value": "5565bca70f59060a08e73c5a4d44504b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06afc3de-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655793193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793193, "uuid": "3418633c-77be-4f38-a157-ddc3e6291170", "comment": "Malware payload (Loki)", "value": "0060880ad115fcbf95f66303433a8128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793193, "uuid": "98935b81-1e78-4837-a2d3-72cbb2f38124", "comment": "Malware payload (Loki)", "value": "e4643c9b82dec00cac52320294c6f728fdf91008205eff49283621139bf92c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793193, "uuid": "b0d353ce-df9c-41f3-bb21-98ae3084bcd6", "comment": "Malware payload (Loki)", "value": "d2224e58dadebdd6b22abbe494f9eef90475b634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793193, "uuid": "77f4db93-6b5b-4dc6-9e76-f5e9c2469ee0", "comment": "Malware payload (Loki)", "value": "c370efb03c95ea3657b12c57287391ee311759270464ce7b2dddeccc48bfe44ad3c35cd7191940b364e1bc61adb31e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793193, "uuid": "aa1088e2-84a9-4d31-a5d8-166ee5a60051", "value": "T1FCD4F0F19FF4B961E46422B374A4613C37D21D0EE841E83ADADBF44D34A2AC265E5E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793193, "uuid": "5ca13f1c-4b1c-497f-9652-73b2134bdea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793193, "uuid": "74ee799d-a8d7-4046-9199-d00f6b1ea3ef", "value": "12288:Imv5c5a2M+tyFP1NB3W0DnujVIhi4WeGEp6937sD:zv6LE+56NWeP6B7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793193, "uuid": "87c199e9-22a7-4656-9cb7-e5ed81e5f74a", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793193, "uuid": "5f07ddae-68f0-4732-a5c6-d87120ee017e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793193, "uuid": "50a47edb-8adc-48a9-8fb4-3422f0897f92", "value": "New Quotes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2927f62-f0fa-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655772033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655772033, "uuid": "5584b84b-e15b-4344-ab8f-007c0ff9e03a", "comment": "Malware payload (RemcosRAT)", "value": "b04bae2b8c0331ed20feb993c3d0cf5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655772033, "uuid": "466374e8-a921-4948-ae96-3bc4571d7ce1", "comment": "Malware payload (RemcosRAT)", "value": "e4b575e9479a4b6b741875953aff2558ce0739b61c74728fd6daf34c3890b1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655772033, "uuid": "595a38e8-918b-46e4-ac3a-8d7fc70769d6", "comment": "Malware payload (RemcosRAT)", "value": "d55a55bd711e28ef866b11ef78c563543785fb2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655772033, "uuid": "1452ee9e-6bfd-43df-af3f-b9cbd407f17a", "comment": "Malware payload (RemcosRAT)", "value": "1663e5c4456e31a8b292b636d805d2f46d32c656673573f15e7bbf5972e408679f0d3f081d8682a51b0ba955f1e7da2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655772033, "uuid": "00026658-7309-481b-81ed-5ddc2b1da58c", "value": "T1635438102B2ECF9AD1DC1374DF61A203AAFA9F0527036777546CBF56386AAC123C59E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655772033, "uuid": "7fb07756-f051-48f2-835e-8e44d16ad0e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655772033, "uuid": "eec45985-a537-4be8-a5c0-061aa2071f13", "value": "6144:u0OOxA6X/TTzPnS9H5EoTzBXaDabwvDNlS:OOxAQbT7SPz1aD6YJlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655772033, "uuid": "604ca3fd-7aaa-415f-89e1-0313fd0a2049", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655772033, "uuid": "a0d7ee72-a8f2-4412-8b74-9cc6f54f63a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655772033, "uuid": "a86537c4-a195-49e0-8f9c-1b52307d70ea", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f341ea3-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809260, "uuid": "14dd5e04-1f40-4ac4-8039-b539641f1a2a", "comment": "Malware payload (AgentTesla)", "value": "d5b88f5b666833eecb7e135ff71080c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809260, "uuid": "d5664036-133e-485d-8a8a-61ca7a6fce20", "comment": "Malware payload (AgentTesla)", "value": "e4e22d62518e2f689a2bfb27fa22e9ab8e417c0e58deac85fba9be131fd8e327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809260, "uuid": "5cc628cf-4c2c-499e-a069-c71bd937944a", "comment": "Malware payload (AgentTesla)", "value": "baad2d4d4d8aa9259d80c667d5bedd2392ffda59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809260, "uuid": "5efc1c47-24cf-46fb-99a3-bb4a4bc7e841", "comment": "Malware payload (AgentTesla)", "value": "e76976bd0bd9cce91aee1e1bf8209663bac0257885656d2fd2a3f4eba8ad43ae2d784c269af4447fdd1be0787ec98b9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809260, "uuid": "b7e2cdb6-8e00-4a60-85f8-3f76743c9336", "value": "T11C02AE568480E32BEA72C334F2BF0137AF63A1F92402CA462570F7588297D9356C61B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809260, "uuid": "d7f9a6fb-bbd8-48fd-894d-d9ecca687364", "value": "192:xrXP/7QYaqvNrRyNr+2UI4vi7kPKqpCCO/gt+TkgjAbh:dXPvaqvNcrFl4a7/qpMM+TZjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809260, "uuid": "5b305182-1066-4503-88dc-a19273d952c0", "value": 8786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809260, "uuid": "3804fc1d-2803-4eab-ba46-b939ab32fb1d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809260, "uuid": "dfb8a81e-6603-4325-9537-bdfc01a1ec9f", "value": "New Order.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d251e7-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655801402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801402, "uuid": "aeb16f71-2b7e-41bd-bdc8-6ecc4c4d8bc7", "comment": "Malware payload (AveMariaRAT)", "value": "0959b923af273b3b045615fe9d397620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801402, "uuid": "3686270d-8caa-4423-a86a-6dae2ba79070", "comment": "Malware payload (AveMariaRAT)", "value": "e532450390f44c981a6f7491224a908a03f2ee6f683e890e969930f3fe368e1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801402, "uuid": "cb231fa6-d224-4d11-b5dc-11a0c9b334f8", "comment": "Malware payload (AveMariaRAT)", "value": "5c38a38687758821f26d7445fca61522be239362", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801402, "uuid": "912e1738-348f-444a-85db-a9899d5177fb", "comment": "Malware payload (AveMariaRAT)", "value": "54d2873144f4a95c5d6bb21bb8216191628e41ca0cb17ee1bd2e0b19d3e1071cc7b2f53fd688cd0a7f2e155120c41aad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801402, "uuid": "1775bf86-38c1-407f-a17e-41ff471b323c", "value": "T1D9259D89270C0E9AECD4077AC6F31F9181659A70392E8B477640AD3A73275E7BF8198D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801402, "uuid": "9899f31d-bbb7-48f3-91d4-2ff2d34ee8f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801402, "uuid": "fae9e525-b50f-4700-83bb-802c0a82243d", "value": "12288:m8eQ2WU4Qxr2lixtBH22qla5w/yXbxYvPkWtsFSIA7CyWolEQWJukVo:m8Y4c/tBH0MW/IbxYWFSpboQWJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801402, "uuid": "ccad2a87-7954-49a2-9efe-8bad840937c4", "value": 1033896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801402, "uuid": "f4354b51-d9a1-4ba9-8b09-27fc0c4e2b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801402, "uuid": "56e50450-d547-4230-b4dc-2316d1dcdd6d", "value": "donexx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9b615f-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808556, "uuid": "0b5cef6d-de67-48a3-9837-f16d06a66846", "comment": "Malware payload (BlackCat)", "value": "8bf2f18a0c8167724cd22bd5afe9d4f5", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808556, "uuid": "4af78f94-c3d0-4825-a176-effa1b052468", "comment": "Malware payload (BlackCat)", "value": "e55cc3426298f9f848849304d10b9222925eb19caebaebaa44dfb85ad2346062", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808556, "uuid": "91f5b2bf-f648-43f8-921e-e05adac94a81", "comment": "Malware payload (BlackCat)", "value": "dae8d9ca517d169a0290047b56e76fa2fdf3ceb2", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808556, "uuid": "83894749-b4b8-4fa5-aca7-4a0a3c662810", "comment": "Malware payload (BlackCat)", "value": "e1097d694556a6eb7bd937efe83edfce90bb893d87d1a262fb255afc5eca1fda352831cecfdf5b7a678bcf3619e2f919", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808556, "uuid": "22f4af14-3024-4d56-820c-79f7af9c8619", "value": "T1D4E5AF95FB83E2ADEDAB1470305EB33ADE344C1801199FA3DBE45D71B92EB111E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808556, "uuid": "a04e941a-2cf9-44ec-8521-0f32cde02e0b", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808556, "uuid": "7fd8d34c-d95a-466b-8119-87dc2b60f7da", "value": "49152:fQMejJ/oFaOKIV+Wv40nM338KVKKPgTxDeL+k2GNjqPwnyeuJ0+ckk+S7:Al/VOKIVvLM33tQKPgw9jqYnyec0+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808556, "uuid": "88ec1fb4-e6b8-492d-8627-9a0ea7483a97", "value": 3077120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808556, "uuid": "8b148dfa-0bf9-48cd-81f9-d4ae3b824db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808556, "uuid": "1230fdad-8a6c-4537-badf-eb68ee187fdc", "value": "e55cc3426298f9f848849304d10b9222925eb19caebaebaa44dfb85ad2346062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188eecb8-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801813, "uuid": "ff4ac939-dc27-410a-8656-84d75387f826", "comment": "Malware payload (SnakeKeylogger)", "value": "405eec49b3587f9694165e7df8b8b185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801813, "uuid": "9e365acf-92af-4564-a330-c494fa1dbc9a", "comment": "Malware payload (SnakeKeylogger)", "value": "e55da75005428c82f82b71f96f6c98c6e98941183a4e2918c03b2fd1f79c9d79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801813, "uuid": "99892db4-4156-4812-9570-3b23b93569a4", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ebc915ae21507e9008c08c3de6049b5ed1f796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801813, "uuid": "bb962afd-25ae-4afa-a17e-478c9a6a902c", "comment": "Malware payload (SnakeKeylogger)", "value": "5a27c3850e72cc4422926437869c352f26143fd90c2488ad296fe863fbb16f7b2b25d10fdafabb4e5e0040ae05c81b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801813, "uuid": "6b505ee0-a7b3-43a9-885b-cbad950c6b88", "value": "T1E69412077B34E7A1D4B763F882EB049187B1AA364D16F34C9EC070EB5466F184A927A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801813, "uuid": "c5a7813c-6c84-4f38-8253-57a5991eaf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801813, "uuid": "2adf5380-7678-4639-924c-31e5ed07c035", "value": "12288:nvvOWW7EdC4WBKP1NuOsH9KUGxwK8lrF:n+BwXWKhsHQ78lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801813, "uuid": "e4580ed2-ce0f-45b1-8870-b6239f5ddcea", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801813, "uuid": "5e5d57b3-7fc2-4b51-a9a0-8d9aa4423aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801813, "uuid": "1e0b6688-c4b8-4977-a5c5-e9854afb41b0", "value": "Scan_7463552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ff3285-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655801646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801646, "uuid": "c7d31f58-8b30-44ff-9894-fb696c65ee98", "comment": "Malware payload (Formbook)", "value": "0236dcc27cfb3d09325c976002567985", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801646, "uuid": "a43505ef-8a96-44f1-912e-0bd31c497044", "comment": "Malware payload (Formbook)", "value": "e640ade723ba4aa48f63db4293d15b61c07c05bfdd93a3a0f83f4a177306b87d", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801646, "uuid": "2abb9f3a-63d8-42f8-a486-f9e50785e8ea", "comment": "Malware payload (Formbook)", "value": "e1605510f182a0c6f8d3297355d9ceb00489df7c", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801646, "uuid": "75f3612b-5d81-4b2b-8e97-7051b3ba9e68", "comment": "Malware payload (Formbook)", "value": "53b83f3c719b63ef579943644de45d27aff77c112a218be2501850ecc21ffc02d89c04c44af306c14b647a0c68e0027b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801646, "uuid": "774abcfa-3d91-45fb-8ec5-deb9858812f7", "value": "T14A64CE5773C98B42DA9854F1C5EB493113E9AFC72A32E2863F48679D1E02363DE8274D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801646, "uuid": "9f5ab3b5-d353-476a-9155-df2fb1fb742e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801646, "uuid": "3d1b18b9-003a-4e6a-8945-0e975c562f74", "value": "6144:ZDQswbK08ixKqJIz/7xg650sgf8elALSALNBf7:qFl8Rt3xg65XwdaLHLNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801646, "uuid": "95c810f6-427a-4685-96c7-28c5d9c9b860", "value": 309784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801646, "uuid": "c694a77a-939d-4feb-9f6f-8814f6ab37f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801646, "uuid": "81520f02-7259-4bbb-ab5a-ac68f87e1ffe", "value": "vbc.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65758e7f-f1bc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655855199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855199, "uuid": "b076d139-a444-4422-a011-01e7fdd24aa8", "comment": "Malware payload (Mirai)", "value": "6448f1b36e4baf36b088f9bb46113533", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855199, "uuid": "6b898066-d995-4839-b7c0-02479dccea3a", "comment": "Malware payload (Mirai)", "value": "e6544af35752c89eba23637df011739da744476d08b8ce4f5279f019a7a6b7a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855199, "uuid": "76488710-e0cb-4eb6-b99f-b0c6f8aa5f13", "comment": "Malware payload (Mirai)", "value": "7d713ee01be078ffd6d2cd83724f54e2f1a16e83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655855199, "uuid": "9f1e6893-70ac-4ca8-b595-15879f9c6613", "comment": "Malware payload (Mirai)", "value": "562b56cfe9c90d5772a1f0ca0d1a4fa522db00038f8faec3662376b8ae2bb03e5c9029440d56f9757367c6af5995172a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855199, "uuid": "8af76858-ca24-491c-b298-eb77f146f2bf", "value": "T1A0733C24B9753E13C4D0607A21F74721BAE5329E36B4C20E7CB11F9EFF60640A946AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855199, "uuid": "f96d59b5-0ba3-4c92-8fa3-07a62a9c0ed9", "value": "1536:lYDqS5vRVCa2wGfatNIscYo5cusge1OgcovcX1lAXyabKSm:8d9Y4o5cVzvclaXy4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655855199, "uuid": "46b479b4-4cde-441b-a8f7-2f2620f8f196", "value": 75664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655855199, "uuid": "7cd77e0a-0d3d-46a9-a54e-6d8db4ae808a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655855199, "uuid": "1a52dd8d-b429-42d9-a2e4-31717b46db1d", "value": "6448f1b36e4baf36b088f9bb46113533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5a9d38-f173-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1655823754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823754, "uuid": "3117f7cb-fc86-422a-ad30-845822cb6098", "comment": "Malware payload (AsyncRAT)", "value": "c61d308dbf1b51fb131768916ee1a0e5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823754, "uuid": "b8871e68-ce42-45c7-9b84-39920ffedf90", "comment": "Malware payload (AsyncRAT)", "value": "e670d4673f40ae9a0ea8b6214fae3ac9361a476bb3a9f672d42251cdac807a0e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823754, "uuid": "611b89e7-fac5-4872-92ee-7c4d1b5825fb", "comment": "Malware payload (AsyncRAT)", "value": "f80bc78290901cf3d8e76a7bf93c8c858b0a9f67", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823754, "uuid": "33a8e63f-be77-4193-83c9-22604747c91d", "comment": "Malware payload (AsyncRAT)", "value": "1d042d4c297adebe7421ce9ebf329d2ff8bfac0649e44887c237cf16bb8d7e6314438fbc56f77436cf2683a701c53e2c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823754, "uuid": "bd07f587-8f9c-41e1-831e-8799c1e8e42e", "value": "T123635B003799C926E5AD8AB4BCB2554106B4D53B2103EA5FBCC410DB9B9FBC64A437FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823754, "uuid": "ffb99329-3f18-44dd-881b-be8c6fb2cd55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823754, "uuid": "37fac3d1-2148-464c-aca5-8fe1a5f9d6fd", "value": "1536:9n6Ror8rYZJJJfxQ7CqmB9x1bbsTxRKievw5D+as7pqKmY7:9nzDrx/q8n1bbsTsyDKoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823754, "uuid": "4ede9862-f927-47c4-b3a1-8c70ed161012", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823754, "uuid": "f3847a4c-5bc4-42a3-8538-117410eea5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823754, "uuid": "8e4e8cdc-9570-40ae-8ea2-6f6a68c9f053", "value": "c61d308dbf1b51fb131768916ee1a0e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d586a87-f19c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655841442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841442, "uuid": "eaec9f31-93af-4ff6-9598-36de04370e5a", "comment": "Malware payload", "value": "664b10216862c3174beae3b81a4b9219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841442, "uuid": "da2d7277-a3d4-43ec-b608-bce5d3ae7674", "comment": "Malware payload", "value": "e77d6fa009a46550ea4d1ca661044fd2a991124105e9efe125e4099d6758f78d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841442, "uuid": "73a6af5c-b938-401c-bef8-d159615e058a", "comment": "Malware payload", "value": "46e6a9b852d39e8efa708106929c27997338a0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655841442, "uuid": "f1b6d619-a8cc-492f-a5ff-14abacce8ec7", "comment": "Malware payload", "value": "29e122d35da3c738ab7fa62435385063b07bb88895bcaf4fc731d1baf79104eae99a5d9f9f99775ccef7a5d9af339612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841442, "uuid": "8d74d76d-7e39-480d-8ceb-e02ed8a368ef", "value": "T1D2052370E344BC27F95207B568962F68C7B6CFA1A5353AD313443484A9B76B38F273A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841442, "uuid": "fb9ea2f2-8e87-43f9-8763-482e63b42a6e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841442, "uuid": "b9bd5635-bf8f-49b5-9078-cc4db06987bb", "value": "24576:bbt0QN4mmhdnBLFrhCoe8bhCY4JFX4yBilgkS:f94mmdrDpdCY6B4yBilK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655841442, "uuid": "30857442-c7cc-48a5-962e-2e37234de3b9", "value": 866856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655841442, "uuid": "60bb8f7a-4d02-4e97-b36d-1786b4b5fdb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655841442, "uuid": "5dbacb80-ee2c-4901-a71b-40281ae34dd3", "value": "Shipping Docs 6645289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5df485-f122-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1655788936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655788936, "uuid": "e7156418-5551-4432-b217-fd0d4206c70e", "comment": "Malware payload (NanoCore)", "value": "9626c4a4f73c39bfe52b5ec617374394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655788936, "uuid": "34c3d0ce-a4fb-4150-a17f-4c67a10fb980", "comment": "Malware payload (NanoCore)", "value": "e82898928332a88843ae54b586c119aa2aa2f81ed38ca475c4b78c90dba6eea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655788936, "uuid": "52e3381c-da1f-48c8-bc6f-8ea3559d8984", "comment": "Malware payload (NanoCore)", "value": "52bbabe84ffe71086b6453b697bc8e526ccd5054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655788936, "uuid": "820373b2-7d2d-4f97-b4e0-b0a1f17acab6", "comment": "Malware payload (NanoCore)", "value": "59fc2d7fd2b43c15101b72843454421bf945a2f173e6571deafac58d86648aee04ae219a6dadfd52e68240b70dbe9a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655788936, "uuid": "9908d57f-5a86-4de4-9170-d3944ac78f15", "value": "T11DB4816EBB019A72FC0DD1308D850B4ABB660F036283B99257DF17CB878F556AD45CC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655788936, "uuid": "a6fb7039-8c93-4e84-b3a9-e543d61db9e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655788936, "uuid": "2496929f-e7af-41f7-af0e-3e5fcce53897", "value": "6144:ZZuDNApd/giDEzKhUHEqCz13l+bBI5VN4XCeSYqvNGy5gD:ZZuDhiDAwUHEN1V+a5VN4XCeSRvd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655788936, "uuid": "7e380fb7-d9b8-411c-b821-527432e265a2", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655788936, "uuid": "b4f98415-8650-40e8-b3d0-7e81d31e2ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655788936, "uuid": "741b0367-c676-4b14-a64a-fa40cfc0f230", "value": "PO101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3204d607-f150-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808728, "uuid": "b0a312f8-0e64-46e5-a871-93c5e89e9793", "comment": "Malware payload (BlackCat)", "value": "9b4286a3888680d958ba3a9d964ef04c", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808728, "uuid": "dc963aaf-23ad-48cd-b032-3a043c284af3", "comment": "Malware payload (BlackCat)", "value": "e88795f5be1970400521e0041c4603c62ff681f24ac75f926d524d092eecb6ee", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808728, "uuid": "0b565842-de46-4e3d-8e18-d2fb5f40a3e9", "comment": "Malware payload (BlackCat)", "value": "e4a2aaba0259d7feebc6b426b1df8cc43fe35b3a", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808728, "uuid": "7a11e4a6-0539-4a32-9d66-529ebd885bf6", "comment": "Malware payload (BlackCat)", "value": "e6e1aa3c02c2d1e31fa33d319c15dbdb1675886a5a76e90499bd331577e12644229a276fb4a4bf090b90dc8c38e0609b", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808728, "uuid": "f0aaf1fc-4620-44b4-a869-6b5c0168ddda", "value": "T18FE5AF95FB43E2ADED6B14B0305EB33AEE34481C01199FA3DBE45D71B92EB105E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808728, "uuid": "dedde5d9-503d-48ce-b4ae-1ceca9d3457f", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808728, "uuid": "323a2770-14c9-462a-b1d5-5563c4841f9e", "value": "49152:nQMStZChL9rV/HFHVnR3/sTUfCgUdbdNdIdTgtX6e/7SM:oghLfH1xR3/Zq9TtX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808728, "uuid": "b03c0bd4-e8b0-4595-b005-5019eff31abd", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808728, "uuid": "2c0579b8-c3a8-4bfd-bc8e-927d7644d45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808728, "uuid": "e61d4b37-9f71-473a-bbc7-723254a1e296", "value": "e88795f5be1970400521e0041c4603c62ff681f24ac75f926d524d092eecb6ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69007ee-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655802507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802507, "uuid": "609b47ed-2539-40b9-bee8-a306c0f825aa", "comment": "Malware payload (Formbook)", "value": "f028af359cc6d711d1882ea4b08b059c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802507, "uuid": "8409e21e-e52e-42c7-be5d-fe71a7c43178", "comment": "Malware payload (Formbook)", "value": "e8a557e098a05e5519447d0ad0735d7473203ba25fc83bfb67c3d03b66d7a9a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802507, "uuid": "50e6276f-d43c-4566-aacc-0f1cb3f4dae5", "comment": "Malware payload (Formbook)", "value": "cc60b2e035fd3effde81c1b2f0fc1623204a7132", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802507, "uuid": "ed429437-ad08-41a9-b01b-0579ea76a4dd", "comment": "Malware payload (Formbook)", "value": "950f51891ca0461ae541d95db74d01c024c5b4f7f6ed1cc794d381d6703a94f7696ffd8b646bab34ea8b75a2e99e148b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802507, "uuid": "07ee3084-20fc-4cd3-b0d0-470527e26431", "value": "T1B473D053A57C8081D15212FE7811427FAD978CC7FA02582DE67EBA248DBE8F21C256F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802507, "uuid": "2a6b68b5-3fc4-4fa8-8942-bdda7577e300", "value": "1536:l7Z270mftn0Aa1WFR+Sa5G8xtpjMn7lUNuW45b/cZupkcVuE3:l7Z0CoX+Z51x7jM7lUU+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802507, "uuid": "71544261-1c9b-4b3b-aba0-0c3bf6f8753c", "value": 73400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802507, "uuid": "7ab88ee2-2442-45c2-997c-b0d478bcdcae", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802507, "uuid": "cb38bd99-a605-4b2b-9f98-4754050b2784", "value": "FDA HCM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33245c28-f182-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655830204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "d3f3e98a-0ce3-435c-9fef-e7c999c617fa", "comment": "Malware payload (Mirai)", "value": "6e84fc3c5279d72216f54950d3e7599c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "b6095357-0b1c-41bd-bb90-e7e1f55b1a15", "comment": "Malware payload (Mirai)", "value": "e8b5dcd6353e54867d5fd634b852f2151ce530b1cb53ada274ee796c16d92586", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "8dd9c869-31c2-44d8-bbb5-632965c02c9c", "comment": "Malware payload (Mirai)", "value": "39d626b7f5532cdf2f0e5a74d5b07cf7bae8b33d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830204, "uuid": "bd00cc23-7ed5-4288-9ca7-dfbd10b52df5", "comment": "Malware payload (Mirai)", "value": "d8de063e30ad4ed1eebfd92732225680d31621720fc42e3ca6a9adb2ad4f2c0ee5ecc0c8c8b9a333e706b1ebb9d229b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "2f285023-9897-48ec-9fea-cfea39422d65", "value": "T138A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "e81d67d3-3a37-467c-8cf6-649e11600d36", "value": "3072:VSx+i6mqaObhNInPNKV+qKmZuqQ4DPwXXtse:y6mRObnInP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830204, "uuid": "e5f548a1-1e67-4b80-9262-d6831ad47a87", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830204, "uuid": "fe8f61c6-60ef-44d4-b690-1b09169b3763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830204, "uuid": "f5db4fc7-fb95-470e-966d-7006ed715318", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02ace0f-f13c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655800457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "3a2f3a39-41aa-4888-8e3b-98f1876441fa", "comment": "Malware payload (AgentTesla)", "value": "08710406a30d7bf919fc27fe6ea76cc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "ad8be21a-7cdd-4237-be06-33109d210a43", "comment": "Malware payload (AgentTesla)", "value": "e8b6a356aa754a7f29dbd35dd8a76699a8aa7fef6ba2c4252c17f4f0fefecaa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "2246019f-d433-41e3-a819-279d121f1c72", "comment": "Malware payload (AgentTesla)", "value": "b41ff16d17ee0f64fb76e247f4ddbdfc0648d169", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655800457, "uuid": "08d8f218-6d80-4b91-935b-784b2e225aeb", "comment": "Malware payload (AgentTesla)", "value": "90d4ab5495b0f6d9f98ada708e37019bfb5228e5e5b260c2e37d17fdeddc9759977db94cac890450f6ca2e0ddfef279e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "0fc6b12f-bea1-4b22-971a-5a7345c5e87e", "value": "T193F4E0E1BFF8B861E0E56176BC40AC7C77D23DDDDA50A426CA8BF04A34A5AC125E0D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "b1f5012e-a688-40fa-bc0c-638e42ccf922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "d1dba2a2-2fc3-4569-a09a-d8c3e95016b0", "value": "12288:/G5vSptVsitkyyz4wtGjXgQxZG74yN3tr8yqLgdkP+r/rztxSA:e5vuz5k1PIgyE74imU/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655800457, "uuid": "ddddf7b9-e30b-4bb2-baa3-b059e38dbdc2", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655800457, "uuid": "8bb74c75-8aed-4fdc-9a25-1a0e2298c4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655800457, "uuid": "9ebc97dd-04c0-406f-bdc1-e75bc96f39d1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.20950.253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e921f27f-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655793573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793573, "uuid": "c3c9645c-e1b9-4d84-9732-2ea066237b17", "comment": "Malware payload", "value": "8c1c22586f9fb8b9c810553852d89b02", "object_relation": "md5", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793573, "uuid": "0be61cdb-2fae-4cf0-852d-8d26b5144d16", "comment": "Malware payload", "value": "e8b7f42d544fe8b954c4021315cff2fdd44d67d11704009cdf3037d34e0c0a93", "object_relation": "sha256", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793573, "uuid": "b5d5d54a-7783-40dd-86e9-e5688d23f352", "comment": "Malware payload", "value": "f39d7b39c399625f35f80071dae8556362e3470a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793573, "uuid": "1257931d-8040-480a-a8cd-a0abce70cbe3", "comment": "Malware payload", "value": "fdf34182458d02ba59846d982467910c6345014d6532ae153a36e1dc942d9bc8c0a60419c894ee803ceb582c10404ec2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2015-2291", "colour": "#66D4A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793573, "uuid": "7ed4dd15-85d9-4e7f-83a3-55966c204c12", "value": "T164745CBDA5DB658BFE214C309FF4BA54CB776C69CE6AC6F109E950302D201A2CC16927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793573, "uuid": "08653141-609e-4137-99ce-ee1b2d9fecac", "value": "b65793dad44f385e9af496f0f3c49eb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793573, "uuid": "ea18f3e7-a619-4abd-a94a-6489742d9b1e", "value": "6144:43OdjlVMSBGaU6UdMFQvTJXSQTOHBz5g+QO9qEt:2ORFoTMQC5geZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793573, "uuid": "222782b0-1e5c-4bfd-b455-c3f3ba67276f", "value": 360776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793573, "uuid": "de4121dc-c264-4de5-9407-e63177c0cbd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793573, "uuid": "269487ad-775d-45b2-b9a6-9fdea55ed012", "value": "e8b7f42d544fe8b954c4021315cff2fdd44d67d11704009cdf3037d34e0c0a93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfb81ca-f149-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655806035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806035, "uuid": "91b6de03-b6ac-4504-ad61-e84f2f8f6ac8", "comment": "Malware payload (Loki)", "value": "88d0cd3674b84625495924190b903ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806035, "uuid": "f8abf344-3a7b-449c-bbd8-415158f73941", "comment": "Malware payload (Loki)", "value": "e8dfd21543fc0b232fbcc711442dd969dbd3e90ff4cde8b0a45cfff3455fc3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806035, "uuid": "7f99e8f0-5729-4dfd-9cde-4a3f311a4445", "comment": "Malware payload (Loki)", "value": "f4a1eac5d6369469a55aa304c1971553ed3712c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806035, "uuid": "6887f248-ed94-4e8d-81db-f52f0e0e5b29", "comment": "Malware payload (Loki)", "value": "d8e8270b769d2418089c947fa4d1e759e11b44745d5810febbebf4dff9b086527e9d1178d8457919929d2b00d5130648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806035, "uuid": "2fc386ed-2b54-4556-bca3-aadf43d42f99", "value": "T17C84E0137AB81B16DABBA7F517A7104517B1357FA2A2F1084CCB60DE2876F048DA4F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806035, "uuid": "ae31e7fc-199b-4e41-bab3-b6a667a4d343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806035, "uuid": "c79d7efd-90a5-43c9-9def-df34856bb5d9", "value": "6144:LoCt0jUxwJuprmPWHWNTmD5Qp02R5DlG/3bp3xfnFPnfjPF5VKQddE32ojwrzRRJ:UCt0jDgmOHQ6Dapl5D8/LNzDPF5AsE32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806035, "uuid": "2dd6e80a-e755-4d9b-b9e0-d5c1a75958d5", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806035, "uuid": "80db09c0-daa5-4a29-8556-0fd9a68d9129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806035, "uuid": "0ad7b1a8-5b98-4848-8201-aa0602fa5958", "value": "csrss.exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a935bcf-f163-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655816875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816875, "uuid": "a5f7db43-6be1-4db2-a061-c927e4832796", "comment": "Malware payload (Heodo)", "value": "30de97fd46cc083a78e472344ed863b3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816875, "uuid": "da0cdfea-5b91-40a0-b0c7-3f5e46af1159", "comment": "Malware payload (Heodo)", "value": "e8fd61a16b6662fb96a04e0ffc4714438f723f8d16143c71230707d3270546a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816875, "uuid": "0b2d3c93-1bd1-4e6f-8c05-24a15de0a349", "comment": "Malware payload (Heodo)", "value": "f8c166223b9f72c75e86186bcaed91a01cd4c55a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655816875, "uuid": "3c058c59-8002-4b33-9c43-1621fd67d516", "comment": "Malware payload (Heodo)", "value": "082391abd79fed38f528857e9b91e3a48487605caf8bb34f5b9e7af1e2aee96abf2852570c87726c349970349c26bdc6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816875, "uuid": "9f05690c-b20f-4b28-90f7-f1f0659161f1", "value": "T114648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816875, "uuid": "267e12fe-1339-4b1a-b497-919c83f401ca", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816875, "uuid": "2ecb7a3e-b8cc-4739-abaf-75ce983dffbb", "value": "6144:JqdSTDcHe3kjHfNsQnwXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3wIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655816875, "uuid": "42237716-1472-446f-ac26-01d3fdf6bb81", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655816875, "uuid": "e43a2d7b-f314-408e-8291-9558abcee4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655816875, "uuid": "777d342e-01c6-4ef8-b169-342a91b072d1", "value": "1tJ2T94xHv8j.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64bd09a-f192-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655837404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837404, "uuid": "00d785ae-7bf4-4e93-9e9b-29584d65deaf", "comment": "Malware payload (Mirai)", "value": "5dd30349c0070f45a75ef2f72f467127", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837404, "uuid": "959ab73a-a5b5-45c3-a3aa-e2d5705b580d", "comment": "Malware payload (Mirai)", "value": "e9488cc0195b744b1e9609b767b7ff8bdec75ae8587e7e7ae3b28a3a88f5ae4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837404, "uuid": "cd400790-49c2-4a0d-a834-dbda8440a834", "comment": "Malware payload (Mirai)", "value": "d9a54ad7ea938f69f5946f2b1072e1838016df1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837404, "uuid": "61439136-2812-48ac-ba34-4f821ef6ae4f", "comment": "Malware payload (Mirai)", "value": "c35fa26893ab8327156d3863983f9e539250d3057cceac8a06b349a0e471c766a6af0cd73c97cb76aea96051cca4c0c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837404, "uuid": "3d910db8-d4a1-4d44-9ef9-8dbe5e23475b", "value": "T1644302EB61B5981CD8722A71D93F7E8FB25C9FB9F549B5A353905008DE858013BBC283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837404, "uuid": "3a66639c-2b2b-44cf-8d4c-0d60f7d3c4ab", "value": "1536:btK/NbKbetc5mF1NXF85nDJkCLLuBWjLm/5n5JGF7:E/Nb9ttXF8oOLuUG55JE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655837404, "uuid": "9bff71c3-fa8d-45ee-b42d-bcfd7ca016d8", "value": 58424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655837404, "uuid": "df3030fe-9aff-453b-83e2-a8c8d43efeba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837404, "uuid": "25e72ec9-530c-40ca-ba8c-a8508a47de21", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db9051b-f1b5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852234, "uuid": "b38b24e2-5e64-417b-acf9-aba0ab8cd326", "comment": "Malware payload", "value": "b7d5725c83f0f109d79b2eb92d4fe77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852234, "uuid": "2ff1208e-6d89-484e-a46d-ce54ca96035c", "comment": "Malware payload", "value": "e94f9d735c382342ff7a90452c09c6742949b9987c74075ae64b465803c7a712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852234, "uuid": "e346088c-3ba0-49c1-a5b0-6b1f26d9220b", "comment": "Malware payload", "value": "9dd57803d311a3a4bb9afb6ea40e5f071f333708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852234, "uuid": "2614f454-b776-45f2-aa02-dd2fe281220b", "comment": "Malware payload", "value": "35665b5948a2ed728778ce9d992e6a6c1d801f2daf236398562ddb8a26f891f05a670cc4329288bf651d813b4cbc4368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852234, "uuid": "45dc91c0-ac73-47a7-9043-8e5044762b74", "value": "T1FD64D01B73E510BBE4B78634C9634A05E776B85107318B5F06A4433A1F677E0AE2AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852234, "uuid": "7451a5a1-1c02-42f5-b83b-8a2372077f80", "value": "506e25f0f4dce61af0aefa3b213c46cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852234, "uuid": "20bef3ec-ae99-4f27-aca3-f3ef8875d83b", "value": "6144:2eRwQHNIhXY0M4jEpI3WO/e59KRe0wWcmdowhx:2eRwQHUXZjEYWH59Ko0jzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852234, "uuid": "08b1b10f-25c3-4f41-b69b-20807cafdf21", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852234, "uuid": "a7eddf6f-713c-4ed1-bdc0-09a7cf1f33b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852234, "uuid": "842d328e-d747-40a6-9bc1-cba7945e26ea", "value": "b7d5725c83f0f109d79b2eb92d4fe77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912af01f-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655803733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803733, "uuid": "00a1404a-9fec-46c4-b246-df3459f41c82", "comment": "Malware payload (Formbook)", "value": "e8ba0382721cd0b5e3f9b8674f1b80a4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803733, "uuid": "f267a1fa-ea12-4b61-89f8-a3019e20e0bd", "comment": "Malware payload (Formbook)", "value": "e98f622a7d9eed1611ec02e09445aff30113b5b3d3c702d90354efd60cc6fcd4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803733, "uuid": "1a6fca3a-63e5-4648-b2ef-d7c2c21e280e", "comment": "Malware payload (Formbook)", "value": "e5466836650b44250ca3097d67cb9269b34034f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803733, "uuid": "e3e3448b-ec79-433e-a6db-6dc15f98d8ba", "comment": "Malware payload (Formbook)", "value": "8bfaeea4ee885ff2a0c0eb1036a141f597f4253ef151ad123bf16c1dfcd99269f7dc33bdad22e7963fc75031341b52a7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803733, "uuid": "bf39172a-282f-4a7f-8e72-8ce424ec9dac", "value": "T18163DF123DF20399F1F80135B2AB85367ABCED0E1C46458926983EE95E70B5C4C6FB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803733, "uuid": "cd2a54ad-3b82-451f-93b5-2bcf1c298d3d", "value": "1536:ptOZ5BEI9y/l7wSPhA000ZwX9yh+sie8gVh/XRGF38zh:pUEDdwSPhZ0Mwty4eR/u3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803733, "uuid": "7a883bb4-a2bd-47e3-9de9-80e68b04aa30", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803733, "uuid": "f21ce443-f577-4cdf-a08d-4e76ab9196bc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803733, "uuid": "1c26279a-c676-4062-a541-a8f1715f160c", "value": "TST - Statement of Accounts(S).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fb5ef0-f125-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655790219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790219, "uuid": "2ecafb45-39e7-4c77-9a32-bdafe77cfc24", "comment": "Malware payload (AgentTesla)", "value": "e15027543d60ef55c6672e17e0bbd1c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790219, "uuid": "5c241a17-2bec-4f2f-b31f-acda9ee42df1", "comment": "Malware payload (AgentTesla)", "value": "e9d2ce38375e40302cc2641eef349a9d2752a805ac88a99a540e625b97e64f87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790219, "uuid": "5293f8ee-b647-45f9-8600-d8e0646340b2", "comment": "Malware payload (AgentTesla)", "value": "8a05e8836c41d5015fe9eefa710700b6e1372e8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655790219, "uuid": "ab6a58da-4344-490e-a91f-ca57ec52431b", "comment": "Malware payload (AgentTesla)", "value": "59ed8538c41a606dd8ee29be37e543d5fd8defb1c1ca37f999f9dcf1a2a3976c23c05c487035bea8cef21a8cf48d869c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790219, "uuid": "231c5030-d333-4be2-9f81-728787a0c05a", "value": "T18EE4A83C2F7A67A1B145AC0CBD9ACDA81562572070942C71CD71E392CDF1DEAE92E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790219, "uuid": "30b0c31a-f0c4-4ee9-ab26-8f86fcf4a7b5", "value": "6144:y/g8pfJzfHMAeibET1eH1t5kyTCxQ9KH+9ZISZ9OSk/RJFervTSDI3buE6Yy/nbz:y/gezwT100eiDwfe/ow9GhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655790219, "uuid": "3f0f1fc3-7c87-4d96-b2b0-f4d82abc518d", "value": 713276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655790219, "uuid": "d429f02e-2e63-447a-a9c6-cfc6c72b5c3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655790219, "uuid": "3b1d1fcf-20b9-4c76-9afb-542be5504010", "value": "agg2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec0b1d5-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655793368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793368, "uuid": "23778348-45ca-402e-8833-08f4f2ba4d3c", "comment": "Malware payload (Stop)", "value": "bca60e1d8121184b5e2f91506a421cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793368, "uuid": "739d8d81-b552-47f3-8939-9bbbb807044b", "comment": "Malware payload (Stop)", "value": "e9d93617d6b226dd7f01845fbfa95c37325df760f8ec756e6e7ac3cf670f88d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793368, "uuid": "6ba39e2f-850a-48f0-a15c-3c3bf8d0e0f8", "comment": "Malware payload (Stop)", "value": "7f3fd9b29c102c3cbb7ac2bb1b42eea893b94de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793368, "uuid": "2a008395-1112-464c-addb-da1d66bbcb19", "comment": "Malware payload (Stop)", "value": "bfdb040470eeec5ee33ef2979c2bb7d4bde4495711c3b29034fd5e86f814e0a444ad878539130370945d2dfff5ce797b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793368, "uuid": "3343069f-2831-4eec-836b-867494b8f882", "value": "T18A05232A7390C4B2C616077059B65AF18EBE3A314178B48B77B41B7D2F703A15BB4F89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793368, "uuid": "df65a460-bc68-407d-a68b-89390d999951", "value": "32138f5b4c47f39b193f3de45cb1e6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793368, "uuid": "d8de92c6-6d87-4f8b-896a-33caeea45b19", "value": "12288:WgaapLkjjmLxy+hLUu6KDCadgTEjrKMGrYz19qFV9AoFIOUXTCLas0sKF:WgbLQ+qdwrqzMGKqXyoMXuLCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793368, "uuid": "07f2fbe9-e9c4-42d7-b8f2-629e8b76851d", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793368, "uuid": "fe46b631-cd0d-4c0f-afee-543fdc1117ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793368, "uuid": "698514ca-45db-48a9-81d3-0330ee89cf18", "value": "e9d93617d6b226dd7f01845fbfa95c37325df760f8ec756e6e7ac3cf670f88d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd038b39-f13f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801767, "uuid": "5cd4b797-d935-4a4a-95e6-8c553f42bf41", "comment": "Malware payload (SnakeKeylogger)", "value": "697a5df5e58b0d7dd5e7e70a74357add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801767, "uuid": "46e38c0b-b028-4460-a3cc-c394277385f1", "comment": "Malware payload (SnakeKeylogger)", "value": "ea054df6bc14abd11ec156155e89ee0baa92b34feddf44b35affd8b08d6ff975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801767, "uuid": "d9ea145f-def3-414e-8b84-8b18a2115e37", "comment": "Malware payload (SnakeKeylogger)", "value": "8e4809a4865c116bb2685dce05888fc91f9e80e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801767, "uuid": "a6fdcd58-4d78-46e2-a6a8-ec2421df3005", "comment": "Malware payload (SnakeKeylogger)", "value": "7ee94d986112270bca29e664d468ecfad088b5aedd1b0cb1a23cbb5daf199065b57c2eb250df7b6c741e020f9e207d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801767, "uuid": "f4b5b2a3-5d7e-497f-96db-53a42e078e73", "value": "T141D401F18EF8B865E56431B77095A07C37E35D0DEC91A43AC6CBF14938A2AC164E1E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801767, "uuid": "a1241bc3-0010-4359-95ee-cf326d4d6b44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801767, "uuid": "ba422b03-e1ab-413a-9f07-365fee3e3c86", "value": "12288:rGv6V9Q0lyvSPEdiw5Jo8B1Yl2YDiVCM+sOjYaqFbSh7BpZPgELRZ:Sv6k0lyadwN1YlTYKxBpFpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801767, "uuid": "29c0b9fc-3ebb-459b-a1fe-533381957483", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801767, "uuid": "add25bb3-6c50-4d56-9749-b8cabfbe106c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801767, "uuid": "4d632b8f-a990-4af5-b137-b1bd25f3d2ad", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f15dba-f104-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655776203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776203, "uuid": "08dc6d96-83b3-4ae2-b014-9bd23ab6dbe7", "comment": "Malware payload (Mirai)", "value": "4790bd4135af22eae8a3389bb788b7d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776203, "uuid": "363f7b7e-7ef4-419d-a789-ac6bc692b5b4", "comment": "Malware payload (Mirai)", "value": "eb1b420e73e2223c9a83e595ced38e72dca88ea7a71b87984f2c32f1e0007e7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776203, "uuid": "9398504e-bd00-4d71-a9c7-e6b1c28c9781", "comment": "Malware payload (Mirai)", "value": "9a335adbc4508abce7df0a65246ffee2dc9f6128", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655776203, "uuid": "e0000f32-0f03-4f66-875b-81e5efba5530", "comment": "Malware payload (Mirai)", "value": "99d49277c0a88a5ad06862e00e185c871bfda25791780128d179ed588a245e001bc73d2b8c7623f16e1b9796b5b8e5f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776203, "uuid": "0995891d-5940-4df8-9c5f-eb82eb0e31c4", "value": "T18AA2D188FE509D8EFA69F1365278ED1EAA50D992350D835AD325613322FF113F201CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776203, "uuid": "278b185e-b28c-4b2e-a8e0-5a633f96615a", "value": "384:MJX206yHsN1KGeJKQNhhbbVfNQPdQzr448k1OMH/SzFCNyrA53:U2/nmKMbRl4QXUCqrrG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655776203, "uuid": "64d11e4e-ef76-4310-89de-eb6f81082322", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655776203, "uuid": "6b29159e-5239-4dd6-a9d3-0a38d6fb90eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655776203, "uuid": "ef7304cc-6c95-4916-9a70-3fd51e8676ef", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdf4c90-f1ac-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655848206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848206, "uuid": "4b69d3ba-123f-40d8-b910-1ca1bab635e1", "comment": "Malware payload (Mirai)", "value": "d6b3d3a0a64097d7077fc41878909ce4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848206, "uuid": "39f7b443-8a57-4b27-8d34-bae0e7cf51c5", "comment": "Malware payload (Mirai)", "value": "ec6e7ffff56282087f36688dce353ca4157b22b4a1ecb28f503c3a8a2ab1d3b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848206, "uuid": "bc80aeaf-cbc7-42e7-ac2c-b9855538fee5", "comment": "Malware payload (Mirai)", "value": "14e83a9363bb60158e164691136168d5c515e136", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655848206, "uuid": "b59b71d3-6614-4a6b-b7ae-f6eada520a44", "comment": "Malware payload (Mirai)", "value": "b870e91b1c0c594a8fa1325df92bbf14961cd89b65d3174bd72ea6e8ad4f7a3da17bf0fc141b754941f658d4f153042b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848206, "uuid": "1a50e7d1-4444-4dba-987f-ccd2693d1180", "value": "T189C2F10051272871E630993AEE3D1F0A33476FE051EEB1F22595577EAD89BAF3678702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848206, "uuid": "0f380d9a-041e-4994-a7fe-3f236fc6c37d", "value": "768:CgvZFfdEZMHhqOidieBOXQAySL3nImy95ws3UozUU:fDEZMYOidPQZyonIbzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655848206, "uuid": "db169594-4f80-4424-bfc2-9a1b530bedde", "value": 27472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655848206, "uuid": "ae35f0a9-8524-4ada-9979-2445ffee242b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655848206, "uuid": "7491f609-b10e-46c0-ad26-432447057dd8", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78efbd81-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655803693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803693, "uuid": "044bfa5d-8194-4467-b655-6a5671edcec2", "comment": "Malware payload (Loki)", "value": "bbe0b187428bcd510d26dba08814aa3a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803693, "uuid": "ce868980-e032-4887-9054-7fae3efa1fae", "comment": "Malware payload (Loki)", "value": "ed4193ee096d17cccb97a27c3e99d11b95aefdc94255804c046be95f2673a6be", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803693, "uuid": "66f57bf1-dd58-4568-8715-d66fc0041a29", "comment": "Malware payload (Loki)", "value": "027d6a4fa1b4d7773a330e4c825b94a7e4435276", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803693, "uuid": "1719b366-36fc-4111-99ea-bd4fdc41ee9c", "comment": "Malware payload (Loki)", "value": "3ccb7e0c6a7a9a4c1f283dc60e19aae56aabf26c3aa86fcd5c3e7ee35b74db379343ea61d4949bc2832ed13d243ea2ca", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803693, "uuid": "6f765c73-f0ab-47ae-b45c-aea46c2c99bb", "value": "T1A773DF1FD269EF49FCA6097959ADF3F8093EAD34B546074214903A7DD830A83B7C91CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803693, "uuid": "d133906b-21a0-4278-8cb2-253525fca3fb", "value": "1536:DI7HQDnOW/MystwG9RQxSq0AyGPVal37UiEH2nO/y:DoI1M3QSxl37UilMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803693, "uuid": "635dfc77-6edb-4aa4-889d-2302f55cdba5", "value": 73416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803693, "uuid": "0d4c7e3a-c16e-4b91-af35-b3d3e4177351", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803693, "uuid": "3ee6f9b0-7954-43b4-9b07-602236b16884", "value": "Draft Of Shipping Docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922e0c9-f192-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1655837220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837220, "uuid": "ce80ad0c-bd40-4ec1-a5a6-5a49bc037f87", "comment": "Malware payload (DCRat)", "value": "728069dd74987f62c9a0c1ce448081cb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837220, "uuid": "45f14cba-e513-46f6-8898-04302234e891", "comment": "Malware payload (DCRat)", "value": "ef113f7b1d1ea18be64340c7b246f47c894139bad140fe08d947e8fcb1e88577", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837220, "uuid": "530eb569-6631-416b-b1ca-1addb8fc04a1", "comment": "Malware payload (DCRat)", "value": "4a0d61b1b7b361be8775a5540f902298ff7e38f7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837220, "uuid": "9bad80fd-ce2b-40ba-bfdb-b85c01469401", "comment": "Malware payload (DCRat)", "value": "6b5f4a2ee6c8b430389752cf8dbbf548797f73dbe1d5c10f525d62f1c7d60615de2c4959156240bf9b8ef79d68b40f59", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837220, "uuid": "a7439725-68f1-4b64-a1cb-f2cad07f020a", "value": "T16C65129C326131DFC45BD1728FA91CA8EA95767B871F0613A42B129EDE4C287DF084F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837220, "uuid": "f5ae3beb-9dba-4937-a5bc-0c95dac0bfff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837220, "uuid": "dd6bc9a2-0f94-4672-8e35-fb137d5558e6", "value": "24576:dpO3DaolqFNZx7PXjCwjHjwtIsi2H2ZOMIwUBwSdCBaVpJVF8Cua:dpuqFNZx7PDem2HJD9WSdL3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655837220, "uuid": "3a1c45fd-996a-40d2-bb8a-dad8b69832c3", "value": 1465344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655837220, "uuid": "c0228c6f-6b3a-4d09-b242-27f34bd32930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837220, "uuid": "c9b6168a-0ca3-4196-aef3-4c0d79114970", "value": "EF113F7B1D1EA18BE64340C7B246F47C894139BAD140F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d41324d-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655802036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802036, "uuid": "50925603-ff01-4356-b23f-3a61f7d8ad2c", "comment": "Malware payload (AgentTesla)", "value": "365b5e8dc280f55842209d121f8c6266", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802036, "uuid": "11918efa-415e-4c44-8956-95fb503eef8a", "comment": "Malware payload (AgentTesla)", "value": "efeaddcf237dfbe27e0bea158fcdfb05a56fe0fe78381d2f8e0501a45fdc1689", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802036, "uuid": "7086ebf7-f4e3-4a8e-8cc5-1345d1dacfd7", "comment": "Malware payload (AgentTesla)", "value": "0a2564cbb59240a7d8c035e2e7d3ac3a38e1a172", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802036, "uuid": "10aa418b-969c-4d19-8a48-175817bfde2e", "comment": "Malware payload (AgentTesla)", "value": "1d4d1aab35be916947f7f1bd297ae1281037cfc1daf8c340d90e2650a672b692461413cd8787c17b0f4851fa62f6701a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802036, "uuid": "ad86cbd4-a10f-49bc-b6a1-cf03eb24b1c2", "value": "T1B1914C35E29CEC81C7828BD56E48B4E8D16A30BB44D7380A70CC97D9075267B6FA6C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802036, "uuid": "491e399c-def1-4508-ab71-490832ea513e", "value": "96:EB8bl74KOJqTerjGsOMEPGAkOBs1LS7OwfqpBRas4:EykceX0PNkbQqpBRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802036, "uuid": "64cc146c-33f8-4f31-93d8-93a0cbd69f40", "value": 4210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802036, "uuid": "633365a3-eb4b-4fa4-a025-937e09f3b668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802036, "uuid": "c899011f-bd64-4577-b981-cbb02f6f89a9", "value": "Payment Confirmation MT103 swift copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fcc7a5-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655802285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802285, "uuid": "05342b11-3d81-4c72-8b05-1377cad4bdec", "comment": "Malware payload (Formbook)", "value": "02c755a3861024c1e79118b9159c9054", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802285, "uuid": "121b43dc-6f74-45e6-b192-ae12f42b28d4", "comment": "Malware payload (Formbook)", "value": "effb514af6cb0ff5315d92b990dc6e4727a2798349020a5c88b040b2f84bb849", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802285, "uuid": "ebf909a4-166f-45ba-bae5-7f947c0c8135", "comment": "Malware payload (Formbook)", "value": "a3b7119231700859502b6254b9a12cfe75daf99f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802285, "uuid": "b6376726-5e5d-4b50-9600-be32f9cd0e5e", "comment": "Malware payload (Formbook)", "value": "8a56a4c0aaa36e19fecf30818377f6d72e956b7d58defd8dfc6fe6aa66bc580acf0d0ebbf550a141016da32a2c60227a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802285, "uuid": "91372fc7-5e44-4ddf-8270-e0dc255dd087", "value": "T1C663D0827D9980BCF4D20E318A276C866575CEC56E07C86B9117BAEF3233E3E950D5D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802285, "uuid": "371de6c5-4ac0-4627-b85e-baa5ea4a77d7", "value": "1536:Mkz4rO0xAFVoXsSS/i2SXQvPCP/SlTvsAwYxci9u:MkcquSDSJSu9rYxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802285, "uuid": "ae0cdd79-c478-41d6-be6b-af0a7c31648e", "value": 73320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802285, "uuid": "63154835-ba07-4a26-9eea-911d11c38552", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802285, "uuid": "09973b81-74d5-43db-80a3-8b6047e9a6b6", "value": "Inv202206201625.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4dfac1-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840531, "uuid": "1900dc0c-c645-4382-9806-07b3700254f5", "comment": "Malware payload (Mirai)", "value": "d631da4b98ab26d97809916919bb2ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840531, "uuid": "9b0714c3-af03-420f-a4f4-1835742eae71", "comment": "Malware payload (Mirai)", "value": "effb9064c86fde17093c98994405a071df623a5995f6d19b5ed3a0275a2a5cb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840531, "uuid": "06bf434d-adb0-4383-8d2e-16d17cd5ac98", "comment": "Malware payload (Mirai)", "value": "46dd781840fc7c24d0801c133edc1717598c7cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840531, "uuid": "d3033d72-cf9a-44e4-8405-23a69eab3899", "comment": "Malware payload (Mirai)", "value": "f27f4865db402e9d83e3417e2118b9b1905a43139bc53f77b9669a2c9266bd23e301645f0932b3a512ddb84c6d1b1467", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840531, "uuid": "0b01e870-b070-4479-b997-1aeda026b285", "value": "T14D833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840531, "uuid": "e1b37da6-1072-40df-be79-375c3e96c540", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCCdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JxBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840531, "uuid": "1ccc1f19-3096-42db-8a9c-f25f2f5432f9", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840531, "uuid": "93525d53-fd88-4d55-a288-2b095ad51917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840531, "uuid": "76b242ba-4b3c-474d-a8bd-5d4811bd6c4d", "value": "d631da4b98ab26d97809916919bb2ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f787f030-f192-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655837406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837406, "uuid": "75db75d5-a906-4a18-8737-2f747f75e25e", "comment": "Malware payload (Mirai)", "value": "fc7af92d4ad4f6a8806e2b62c84e1154", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837406, "uuid": "4859a62e-2cc5-4c33-9ac3-64ebecb6260f", "comment": "Malware payload (Mirai)", "value": "f0f5d6fb5b138f6974e753f4592f0bfa4c2c6c62e2b03f9f5ef472b9c9ab13fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837406, "uuid": "d49a9969-4d12-4b15-af0c-4b33c8c33a79", "comment": "Malware payload (Mirai)", "value": "44537fef1a0874c561508072532f73ec1eb41727", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655837406, "uuid": "e423b9c6-f8d2-4ffb-b17e-25e5faa5171a", "comment": "Malware payload (Mirai)", "value": "ff7e57df4e63b06f69c2b4c8971b7801281b2b5fca3b47b6e40a0ab46597e7f36d6bcd956bd758f3036801cc5bc443f5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837406, "uuid": "a14ec909-c5b2-4b3e-ba5d-60fde244b042", "value": "T17AE2F1F4BBC5A73087380DB920F4C2C73A5647A4D0FD75129A548AD53AC052AAFF02DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837406, "uuid": "a5046384-55c0-4336-a054-491517c88351", "value": "768:EGKyTPomrMuOh0vYwvsi2SjyPq8PDhs3Uoza:xdw8MOvbNsq8oza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655837406, "uuid": "c4e2af65-872d-43a7-97dd-8785c27ec878", "value": 31192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655837406, "uuid": "51af2b2f-b1c1-47d0-bbdc-514fd0ac0ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655837406, "uuid": "b021c483-c33c-472c-8293-39d95953720d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6790795-f14b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655806829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806829, "uuid": "6fa75c43-31a7-4d98-bd4c-0dbbe1f451c2", "comment": "Malware payload (Formbook)", "value": "2e52c38d8778410158ee262129a6af34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806829, "uuid": "921662e8-5432-4779-9f15-a62c1d2e6344", "comment": "Malware payload (Formbook)", "value": "f10c54328db9ebcbcad355e53fd2cdd6befa60a298981e94f2cb4c69317b6d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806829, "uuid": "fa48bc73-6b01-472d-8e88-499420f320ac", "comment": "Malware payload (Formbook)", "value": "690a3f66815b0d053780694c8657891a7841b8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655806829, "uuid": "04f6f0c7-43d7-4529-ac96-e8933e9d53ca", "comment": "Malware payload (Formbook)", "value": "d3fb5d8b22973c6d863356b6763fcf256221a1dda44a58c97ad91cf35d14ecedf11c4d520ee2c97ae4fe4bea03e87c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806829, "uuid": "556c8da3-f44d-4363-b05d-365fc4613c66", "value": "T1F2B401007A784716D97CCBFD48A2A24453F874269267F3998FCA60DF4DB7B068750A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806829, "uuid": "47c649df-172f-405c-bfdf-6f081a143ce3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806829, "uuid": "5a9e60e4-5c93-4424-9972-8811660facc5", "value": "12288:L2iN2H1wj9i8BaWM65OEWcrfauUc83G81cW5:L1Eci675OE77gW875", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655806829, "uuid": "fa3c2bf8-47bd-4af7-9c15-9d26abdb1dec", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655806829, "uuid": "0817a9e7-bd8b-489e-8ee5-0180e9906ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655806829, "uuid": "2af0ffc4-496b-407f-8c3e-6511b0a08a77", "value": "vbc (8).exe.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e32baa3-f111-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655781770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781770, "uuid": "d09e42ba-4785-4d8d-a7d0-c0a2675db492", "comment": "Malware payload (AveMariaRAT)", "value": "8b5822b182c46f18a859bb80bf392089", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781770, "uuid": "dd4699c7-ac92-4566-a741-685fb62042dc", "comment": "Malware payload (AveMariaRAT)", "value": "f2dd00932b9f5d109eb2c69bc510cf3738d33044505bb4b8c0923472cb3c251b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781770, "uuid": "5129e478-f2c7-4101-a8e1-0d95203e285e", "comment": "Malware payload (AveMariaRAT)", "value": "d91b37a0d5026a86ceaf2a3c3720ffb8cf483ae9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655781770, "uuid": "8f577759-40cd-431d-bc9e-f15130a297f2", "comment": "Malware payload (AveMariaRAT)", "value": "66a57486198beec5b27b47dd8c3fa0968e54bddb6907600be2572d8ff5ddb4c1e612a9cf5acbc9d1557086043b3a7e02", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781770, "uuid": "a4433f63-c80e-410b-bb16-844e416d5db9", "value": "T195B4703DFB4196B2ED1DC43088A50F0ABB661F132286B98657CF23CA974F256AD15CCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781770, "uuid": "e953b6a7-e084-4a1a-a390-7903db07191d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781770, "uuid": "0fb30fc7-88f8-47eb-9cd6-33e82de08181", "value": "6144:1eFTmTFfMbYW2we0BwijDtFkcZvVK7fyIybytyEyGycVxKkC8FBPNDD0jGEEHcPH:1AmT1MVe0Bv9KbnUGzB1Kkb1DD0jFKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655781770, "uuid": "94f858b0-ec92-4c14-ac18-c18a6a00925a", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655781770, "uuid": "c2688238-4fb0-407a-8e2b-46d421859b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655781770, "uuid": "921836de-8680-40aa-b25b-536a2bf1de0e", "value": "013&492 INV - DEPOSIT TRD INC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e27637-f19a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655840577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840577, "uuid": "ef292c2b-5fb0-4aec-9d3c-fcc52c4e72bf", "comment": "Malware payload (Mirai)", "value": "c79d9f1d76ee4055b07cac11f3e40760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840577, "uuid": "7cc44c37-7fe0-4130-89bb-763219a80d4a", "comment": "Malware payload (Mirai)", "value": "f32dea5beb12bd7a4fb1e43cf4908a0b70d03d825ef48e8fb9cd19c6d38cdf8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840577, "uuid": "4e106419-6fe0-4601-82ac-55e777506c4c", "comment": "Malware payload (Mirai)", "value": "41d5f9e5cb01b0f0b22a5d83cad1ed492749c44a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655840577, "uuid": "8350b1e7-1d34-43cf-9dda-26333cf51160", "comment": "Malware payload (Mirai)", "value": "fd0b291fbc55e513c0082efc15a4a7b08a659e49464e35aa10e8943bbde62db17236b1b0fa9f7e245991b029ef45757d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840577, "uuid": "2c492ff8-8b91-4a83-a3bd-1569445e8660", "value": "T17AF30982271D3E67D1D7FEF02AF7E7F143EBE90117925140B19EEE845236AB06509B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840577, "uuid": "69085fb0-a678-4ddb-babe-8bd56457f1f7", "value": "3072:JKXxkrGvpAXDE7oBvUeIpSK6vRyvFP/nAEQKNy2Wgt:JKXxkrGv+TEmcebK6vRyvFP/nAEQKNyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655840577, "uuid": "1e982eb2-9cdb-4343-b1e8-39f365a8e849", "value": 167951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655840577, "uuid": "abd9ed95-1138-41a0-b331-e35eca3cba8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655840577, "uuid": "7f2c1b75-5355-46e5-87d0-da1debe79714", "value": "c79d9f1d76ee4055b07cac11f3e40760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d797659d-f1ba-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655854532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854532, "uuid": "6058ecf2-ba55-45d2-a9ab-45ab4a90cba1", "comment": "Malware payload (Mirai)", "value": "29e0e88ef412cc54d98b0a2cae219757", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854532, "uuid": "9e22dcd1-32cd-4b7a-aeec-0deb46ed16ef", "comment": "Malware payload (Mirai)", "value": "f34502ddd1654546c6ab8eba082391e523329a620e14788df83bdd7785b6fb21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854532, "uuid": "9e2ae13f-d28c-4b2d-9c97-5c4f6c53b976", "comment": "Malware payload (Mirai)", "value": "b53c0379a4aa5bb569637701ecea089eafa0f5fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655854532, "uuid": "02bad889-4d30-497b-b767-febe3585d9d4", "comment": "Malware payload (Mirai)", "value": "97230d88207242e7b01a03cc3a46a177dc9c8f5ccbae28beaeed7e4b14662d799dcc554e2f131d5a56331d38c76f0469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854532, "uuid": "20930954-74f8-4258-9676-f1acad3b5a16", "value": "T13B33F163DAA7587BCFB14834DB308D89BE57C0FCE0FA623718144A602D902A771AD1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854532, "uuid": "4ab9eb40-976e-4ba3-9868-f569f68d6521", "value": "768:ZiQVWfGCWLs/lYaqqrI1pvbI4kXelEYKgO17T3ipZ52ML9q3UEL4S7GS+6Ct9LBk:Zlf7cYooTItXcfKgQ7LI5eL43S+Rt70V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655854532, "uuid": "c95079aa-af63-4dfc-a212-1150c781d560", "value": 52888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655854532, "uuid": "fb22b5b8-e76f-41c1-8c88-669200ee1f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655854532, "uuid": "92c8b321-6932-45f3-8fdf-30fa564f2058", "value": "29e0e88ef412cc54d98b0a2cae219757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb2a988-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1655801845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801845, "uuid": "24b37f61-6a9c-488e-9a4a-553b820c7762", "comment": "Malware payload (Vjw0rm)", "value": "ce75410067a95c5ceccf08f7487cf247", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801845, "uuid": "a467ea22-31a1-49a6-93d4-ac9381fb8c03", "comment": "Malware payload (Vjw0rm)", "value": "f356566e43a72607bcb73734f5c3dd4b03117f42a03e0534b327e2fb4b3d7132", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801845, "uuid": "0ffc0398-d6f4-43a6-bc17-f75e8f6d1520", "comment": "Malware payload (Vjw0rm)", "value": "e38edaf16c0b2e994fc65e5228912428c6fdffa3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801845, "uuid": "e466c2b1-669c-4eea-9357-8da008072e81", "comment": "Malware payload (Vjw0rm)", "value": "02b3286a9e80c6280f4ae96fdc5b9937de59f9e2d4c42266971aaa9a729b0f9e8df5da00b1eab53a871264c9228f1507", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801845, "uuid": "8eadfa3f-8933-405a-8bc0-d853d029ffa9", "value": "T175F37DDCA814F0DDD921E2B97A7A3DC9A7E4221BD04553CD781DB2010B76780D7EEAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801845, "uuid": "ce11fb16-b771-4248-9d41-22678ba6f326", "value": "1536:YHK3I3XLTGeW+9vOrgYSmcSrsbmXPNOwbHGtQj3qkbfCKs:YH2eWHLDPNO7E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801845, "uuid": "b406faa8-ad17-4dd3-8cc7-c5fd68d929db", "value": 171373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801845, "uuid": "8b24ddec-1247-4dca-a219-1ceaeb2358ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801845, "uuid": "07e57bf3-a28d-483e-a668-76e4e37f155c", "value": "PO docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8ba1fa-f14f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Grandoreiro)", "timestamp": 1655808589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808589, "uuid": "2f2cce3e-7c89-4bd9-9a61-4e059fb7ec32", "comment": "Malware payload (Grandoreiro)", "value": "00af2cda7fe5bca57d883435209a9cc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808589, "uuid": "d7a1f983-ffff-4924-9b08-04592751a438", "comment": "Malware payload (Grandoreiro)", "value": "f35acda1eed9266b9ad277b7bde8c270558678bce100255e786a0b2937826021", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808589, "uuid": "177a1263-4f37-4834-8e0e-31f05bf041b6", "comment": "Malware payload (Grandoreiro)", "value": "5a19ce01d7b883c74011c90ef724eac620e99871", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808589, "uuid": "d6a5275d-ba92-44f0-b76f-6812eb32d208", "comment": "Malware payload (Grandoreiro)", "value": "69ce0645fa377de68ee1d1c173a5d0b6071f2754a8f138c001cc5a8750946e75c1ec2f8a81c73ba60628f1314afa8853", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808589, "uuid": "b6c0b1bd-cabf-4755-94fc-6d7c83a065db", "value": "T1D2367D32B284613ED1AB1B3A8937E659993F77712922CC4B1BF4498C4F359803B3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808589, "uuid": "b590d952-99fb-4131-b5cb-fd3f85ecdeb8", "value": "a24f921fae7bee45d4a02b4d00ef6356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808589, "uuid": "6abc8c72-2b6c-43a9-a3fd-0690a1b4e9ad", "value": "49152:pbDw9G/gpyOG0x/TpySS7hFTXUNutkFNeiBthe2uY0b21tVpJSrNGsdZTjVkdx6o:lDwA/+uXjOFVhQY0bYtVp8rNGs9kdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808589, "uuid": "62013018-3090-43b0-aec2-b7b2aefd84de", "value": 4877312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808589, "uuid": "ebfcb33e-cd0f-4785-9ad2-4ae6733bfc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808589, "uuid": "d4f04885-816f-4c7e-a320-10cdae540378", "value": "SecuriteInfo.com.Variant.Tedy.107534.25952.26576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1392643a-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655809106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809106, "uuid": "25337119-d953-490c-9fe0-9586fdc97539", "comment": "Malware payload (Formbook)", "value": "d165ec46cd17db4d3c3c08b141d8a3c0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809106, "uuid": "af93edac-027e-410c-a9eb-665851c3f183", "comment": "Malware payload (Formbook)", "value": "f386d0a92d33acedfd4ab31747a07377e67da31ff843f4598f16c6de567bfd6d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809106, "uuid": "16f74a47-d2ce-416d-808c-16f747281712", "comment": "Malware payload (Formbook)", "value": "87ba3ad1807763cb2e188d0cd92a63cf81206861", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809106, "uuid": "3ab90318-9ec8-4528-b274-8c3f25c176bb", "comment": "Malware payload (Formbook)", "value": "09ce2159ba8c3bf2d8dd4b527916fc1ed7e89d7a1550bf2b697ecf69fb8688a473588b3d746114fa4c4a4c77f0c0cc42", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809106, "uuid": "804a73d7-fc0c-40d6-bdc7-f73642506a10", "value": "T17152C0D79DCB00CECE5F4AB74D81537C27E4B6C80D249FA03102557838A3AC96B3A5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809106, "uuid": "ab0c21f7-d40a-4c0f-9f16-fbab8c85d0f8", "value": "384:yUSbHvzngoOEAK82FqeTDB0/Q4sHfRVM34:yZbPTWcvqCHfRg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809106, "uuid": "57b9ec91-8f10-4002-a390-7fe73c64d204", "value": 14348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809106, "uuid": "e0a3a33d-4330-4243-8120-c683f34fd9e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809106, "uuid": "779b75c3-8635-4f8b-81a5-4aeebcb6f12e", "value": "DHL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348b2cff-f151-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655809161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809161, "uuid": "40058dde-a986-4985-9b78-3476f740de1d", "comment": "Malware payload (AgentTesla)", "value": "226b28068e1646781b24c98d8cc63627", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809161, "uuid": "87c46d93-b9c8-406d-9c72-85142a4c97a5", "comment": "Malware payload (AgentTesla)", "value": "f3c96b41da47d483e00b459a74d5bad02a33c0d46420849dec4c6ea3c99a1604", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809161, "uuid": "f31dd9d6-5c75-4f5f-97c0-39d98b6c9a4a", "comment": "Malware payload (AgentTesla)", "value": "f4954356a6bc1ba1f20a7461856cdddaf76277ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655809161, "uuid": "e3fa1e2e-1f5e-43bf-b79b-9ac55c63ee6d", "comment": "Malware payload (AgentTesla)", "value": "be99b6b1ec2c2a53858201cc3bc2963e9a9972324624c854b17d7d53489a71f729d6cde2c40bfae038db5810d7702601", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809161, "uuid": "46a71efc-4bfb-4c7d-bdd4-b46cdb65623a", "value": "T19E029E51C4484657D7422F75ABED1D77AEB761A87E48899F2035F338108278723CE2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809161, "uuid": "b0170e78-2d40-4496-b241-16f3e6392b9d", "value": "192:xrXP/MbSh/1inRid1I74UcMvM3CCtfHecKK3XAaqD:dXPSShQQ+CLdtfFKQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655809161, "uuid": "bd95fdb0-9811-4c8c-ac9d-f6c8e110730e", "value": 8792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655809161, "uuid": "6b77229b-bb75-44cc-9638-29e2835e4ec2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655809161, "uuid": "1976c8f4-4b26-4fa3-ac03-2fb755deffbf", "value": "Purchase Inquiry_pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119a3036-f189-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655833154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833154, "uuid": "d5a64fd2-2c42-4cac-a86e-4812ed360aae", "comment": "Malware payload", "value": "71892b4a7bfafcb6c10f4fa9115a7687", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833154, "uuid": "4547d0d2-e8a2-4c45-b6e3-ed1411fd84b6", "comment": "Malware payload", "value": "f3ed47b5a9149d40f988865547c725b54c809c03641645088a5a9fba813a79d8", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833154, "uuid": "c7dfd34a-8510-4564-8bcf-c8bfd4e0e0f7", "comment": "Malware payload", "value": "e92bea8a8a0ee34090490b4cbc6228aaf4446186", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833154, "uuid": "1865eba8-5285-419d-a13a-dab8b75b6ab7", "comment": "Malware payload", "value": "5a9cc0d9e2ced89615f1676f5da2051df7749675134ca64e22a9d4c98294a445b2bf92e1a4bac437d36280b1e6bd25ec", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833154, "uuid": "6d13726e-b635-4b64-a9b7-bd359dbe60f6", "value": "T19F665B52B2C9743AC06B1E36492B9758993FBE602A12CC9717F43ECD8F35D803D26A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833154, "uuid": "015f4875-3fc6-463b-ab80-f49cd9adba67", "value": "98304:dI/3SdCDy57EpCviIq0g19IndE/RJCGY2A:d1Wi7tviICwdEzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833154, "uuid": "1d833f1d-b1e7-4e55-bfc4-b0a7782e9821", "value": 6640640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833154, "uuid": "72b16209-4458-4a8a-9aad-c2788ef204d6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833154, "uuid": "3a2ce6ff-93cf-4b18-88c2-26786a564299", "value": "__[~68ja.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02b18c9-f12b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655793128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793128, "uuid": "f356309d-7c2e-48dd-868b-f8f27d09ae9f", "comment": "Malware payload (Formbook)", "value": "c828050ae845dc34d983d64430d3b0b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793128, "uuid": "1d3564ea-5dbd-4278-9cec-1331f403ec00", "comment": "Malware payload (Formbook)", "value": "f4f4bbd2bebb1d39de060934968ddddd6cc8d68353864e971aba35d6807e14b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793128, "uuid": "092743f5-8ba8-4365-aa0e-caa41c9f62c8", "comment": "Malware payload (Formbook)", "value": "9fbda901e87fdfc21a980dde36b4e8c915a6efcb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793128, "uuid": "e2f2bac6-14c3-440b-abaa-492be7fdeca1", "comment": "Malware payload (Formbook)", "value": "527e808dc1ed5e02ce9468051bf9288dffea8a7b19ec1bdad74b6955d8faf2be4a91e18c447c51035e08534361c79ee9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793128, "uuid": "3efd6fce-36da-4f74-becb-f70e3aae85e5", "value": "T12706A431B17979D3D22654215A5FBE460309BE83B3C65F9C401DFBF92DE68EB630290A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793128, "uuid": "b6cbf490-f8b8-4e1b-a7a1-bb59e5e54d78", "value": "24576:JBmnvAgk/vtU4ivmZYir0HSrW7xVhGUZYK+Qh5UXrXeU6CJi:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793128, "uuid": "511bf03b-611a-41f5-8dd2-a4d2ae0d98f9", "value": 3946950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793128, "uuid": "8becb946-e52c-48ce-8a89-95424f5a1c0b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793128, "uuid": "078e23c2-97a3-4db6-b22f-babc6d047e25", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.16335.32112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f23c0e3-f1b4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1655851807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851807, "uuid": "7209699f-ca50-4c75-b201-96d0cc9eff90", "comment": "Malware payload (Mirai)", "value": "f7eed43eeb4dc560f5fd430f5cc279d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851807, "uuid": "af0a4ccd-3a1b-43a5-b751-ae1ab962a517", "comment": "Malware payload (Mirai)", "value": "f512ca713eb17d1e05c5b1815ff7dc3362ceb1ee737e3b4dcb06ede1fce155e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851807, "uuid": "f652b1a1-4c5d-49ac-8ddb-d09561bbab68", "comment": "Malware payload (Mirai)", "value": "0ae7c01024393defba6e6348f6d75d6865618d28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851807, "uuid": "976809f8-5998-4fc4-adf6-6faa355f576c", "comment": "Malware payload (Mirai)", "value": "efef0feeafc31797ebb24c13d4e26b1a40631f9be47d784bdee6d3183a75d84838dd0d4ab3d427f28689353f729b8c2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851807, "uuid": "0d0c0d3a-bc49-409b-9695-2e31c12f91bd", "value": "T1DA7319827C81AA26C7D017BBFA6F108E33156BA8D1DA73438C155F5577CA80F0DA7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851807, "uuid": "8a5cab20-d522-4a8c-8c5b-237cb293e7ac", "value": "1536:ufzomOUDUrqVC+Oe97OBo/qMH/HMBLpJeZWaeJ7M:ufzomOUUBLTwnsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851807, "uuid": "e2e5cb66-70cd-403b-b903-dd601bed1517", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851807, "uuid": "3e430a14-d8ad-4096-bb8f-4c6325e0c04c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851807, "uuid": "13880e46-d169-499d-bd35-ac06e68802a4", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39dd64f-f188-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655833024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833024, "uuid": "0784fb76-3198-433c-871d-f54690352fbe", "comment": "Malware payload (Heodo)", "value": "bcbb2eaf9c1aacf046e68e0184931b1f", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833024, "uuid": "ebd1ad94-6be0-4ecb-98fa-d91e010e3f92", "comment": "Malware payload (Heodo)", "value": "f5475dbfbad3b709918ab2af83cf7a3bc3d352f25e8b27843586ef454d222816", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833024, "uuid": "d58f0d90-11ad-4067-9b58-14b0dcfe04d1", "comment": "Malware payload (Heodo)", "value": "2e2b0befd09a87a9f7f1bf50082553085fac3def", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655833024, "uuid": "0ef334da-875d-4ffc-abde-7d2da45e973a", "comment": "Malware payload (Heodo)", "value": "dd08926a719c3e402d1e677a35a4fff195ebb017c9c4c102413ce23702889a420c19bda563ee49ab2fffd1a5ebe201d2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833024, "uuid": "a6b80bf6-593b-4fac-9c46-b282435e24e6", "value": "T1C1648C0636A04866F3194B348903F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833024, "uuid": "28fdda4f-bfa2-4a4c-8bc7-4d81256275d8", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833024, "uuid": "f2418cbd-dced-4c6f-aa44-529399d4b270", "value": "6144:JqdSTDcHe3kjHfNsQnSXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3SIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655833024, "uuid": "2e5d826b-3122-4abf-83da-31381cd518c6", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655833024, "uuid": "501d3843-daf6-4abf-849b-244214647058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655833024, "uuid": "f87b6bb9-7b82-4284-8f24-5f20908134a6", "value": "sBYnRG4PnM4MZYX5XAASWphom7G2.dll.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f536ace-f15f-11ec-93bb-42010a9c0043", "comment": "Malware payload (premium)", "timestamp": 1655815219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815219, "uuid": "7c6903b0-e4fa-4106-b700-798b1751a876", "comment": "Malware payload (premium)", "value": "55bd116231202bc83059688a7a7132d9", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qfq", "colour": "#86C8F4", "exportable": true, "hide_tag": false }, { "name": "qfq32", "colour": "#630BF5", "exportable": true, "hide_tag": false }, { "name": "unbootable", "colour": "#BC18D7", "exportable": true, "hide_tag": false }, { "name": "v3inv", "colour": "#1BE7B5", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815219, "uuid": "ecaa9395-9957-4fb5-bb10-a97887020a63", "comment": "Malware payload (premium)", "value": "f624ac67ace602bd64c79d820506ddac165a59af2ae46448b2c18ac43aa67a27", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qfq", "colour": "#86C8F4", "exportable": true, "hide_tag": false }, { "name": "qfq32", "colour": "#630BF5", "exportable": true, "hide_tag": false }, { "name": "unbootable", "colour": "#BC18D7", "exportable": true, "hide_tag": false }, { "name": "v3inv", "colour": "#1BE7B5", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815219, "uuid": "8cd8eec1-53b3-4582-9ceb-0ea7e0a09dd6", "comment": "Malware payload (premium)", "value": "35cf4f8eb780a45ac4fa250d96c32b52ed01747a", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qfq", "colour": "#86C8F4", "exportable": true, "hide_tag": false }, { "name": "qfq32", "colour": "#630BF5", "exportable": true, "hide_tag": false }, { "name": "unbootable", "colour": "#BC18D7", "exportable": true, "hide_tag": false }, { "name": "v3inv", "colour": "#1BE7B5", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655815219, "uuid": "bccd6e23-9524-4f34-a6b5-7594145d5cbd", "comment": "Malware payload (premium)", "value": "57def37f8e22dccbde02e3bb8acfe3a60e658d4b8566ab9336881c1a1d118d377956671f39aa51e48c5592aa9ee736fc", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "dangerous", "colour": "#3AC0D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qfq", "colour": "#86C8F4", "exportable": true, "hide_tag": false }, { "name": "qfq32", "colour": "#630BF5", "exportable": true, "hide_tag": false }, { "name": "unbootable", "colour": "#BC18D7", "exportable": true, "hide_tag": false }, { "name": "v3inv", "colour": "#1BE7B5", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815219, "uuid": "1a334fea-c154-48ea-9b19-2c8c6349f4fa", "value": "T17EB40150A2CD12B2E9E189350476E03A9235AE18A710D9DBF3CC3E937973AC55D3B3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815219, "uuid": "50c8f83b-0ff9-4834-bd65-ded5eae415dd", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815219, "uuid": "06497cb1-6f25-411c-ac6c-266bebd63822", "value": "6144:1ldk1cWQRNTBS9nsGP1CkdJwVKXglJKwkeP4CwHoILYP9uoqNk0vZhr7aSKrmK7H:1cv0NTY1/JfgWwkhLYB302vmK7uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655815219, "uuid": "17d90dd7-3b0d-43b9-b822-4b489e731ce6", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655815219, "uuid": "0f577d79-5c94-4422-9052-ed0a893e4c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655815219, "uuid": "b6050085-23a5-4466-9339-ca04b32556b0", "value": "qFq32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fed5ada-f141-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1655802228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802228, "uuid": "710260a2-4a33-4003-ac54-6937f87aa501", "comment": "Malware payload (RemcosRAT)", "value": "e0d714cf6c8d72451b7cd523d9800771", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802228, "uuid": "c31b9dcd-ce3a-4651-8643-51eb4b2ea35b", "comment": "Malware payload (RemcosRAT)", "value": "f774d98f3f3a0218005523ed8221de531bb9e3afc651aaa9e8bb2ae1ff8a99f0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802228, "uuid": "63939c4e-d449-412e-b56c-b002ca3aa13b", "comment": "Malware payload (RemcosRAT)", "value": "e811d386b4ddc4152d8e91176f0aec0c021a2f65", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655802228, "uuid": "f9741207-9206-45e3-978c-8f0f8bb01764", "comment": "Malware payload (RemcosRAT)", "value": "cea0c637e5914f5fb83294e645f23019f01df8b59ae9b1695de468e2ad2f9ff0db9df4ad4ba89905a787d894a3e04f02", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802228, "uuid": "8a869dd3-2bba-425f-af0f-6c33fe199270", "value": "T19E83D011F240D2C7EDA36F30F18A6E827AAD6CE69D0691633C51339699FCE82149257F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802228, "uuid": "67b3aaf5-bafa-412f-852c-8b95f1059d2e", "value": "1536:9JWRH2J0/YQL9qI07pICKoxeBluQzapLXNfv5Ey5m0wZJIk+Wg:9YRCdI63KoxeRzaFXNnl+JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655802228, "uuid": "4958e15a-b509-4a4a-89b5-8028fc722adc", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655802228, "uuid": "11d86ea2-a85a-4e58-be1e-2bc8aaa25c9e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655802228, "uuid": "7b97626d-7e2e-4b4d-99cf-3b6fbd918088", "value": "PO IONE-GS-ME-0079 Signed.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710b132c-f12c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1655793371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793371, "uuid": "c996cc65-a6db-4627-ad08-6ac606af65b6", "comment": "Malware payload (Stop)", "value": "98a56385dc442cddd3f643d599b56dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793371, "uuid": "a47a7474-a051-4a1a-b575-19ba44ca49f4", "comment": "Malware payload (Stop)", "value": "f7f51a595e7f7079410e05bfb48069ea37a2b12013d99e075dbed9b2ab870d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793371, "uuid": "d69aef27-c71f-44f5-bdd8-e81d4bf64216", "comment": "Malware payload (Stop)", "value": "1c4b855035a4776a35d9af0a7fa331b21e9e6986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793371, "uuid": "370db4b9-2f2f-441f-aaf0-4557fea5bb30", "comment": "Malware payload (Stop)", "value": "f66c34aebed2726630e58ceff4f30effe95d3c8dcf786cd55c7a32610f0efbfc521ad846b4a2a16f209b70761e46e42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793371, "uuid": "7b6ec1ee-2438-4ea0-a7b4-6aa76383ad2a", "value": "T15905F110AB90D434F4B702F44A77926CBA3E7AE0972495CB52E91AEE5734AE0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793371, "uuid": "7abc85c2-3dc2-417a-80e3-76dc46b59e04", "value": "ee3080f6667a990e42e6516a4d659799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793371, "uuid": "b9dd0078-e66a-4c6f-810b-39494d6cdb34", "value": "12288:w0UAqAfpmf5qzJ7Gi4ptha6BS/2ek4c0NIErjp0CkWq7ytcrDJk+/GE:EAFA58Cw2elc0Njj+Cyytcy+/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793371, "uuid": "d0e30b81-4b75-40f4-aab2-04b68e7153b3", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793371, "uuid": "6d0e2808-aeab-454c-a6ee-92c77b0692c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793371, "uuid": "20250430-1bce-45b8-941a-7167cf609ba2", "value": "f7f51a595e7f7079410e05bfb48069ea37a2b12013d99e075dbed9b2ab870d4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e063d6c6-f14e-11ec-93bb-42010a9c0043", "comment": "Malware payload (BlackCat)", "timestamp": 1655808161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808161, "uuid": "e2a0874d-84e8-43e1-9ade-f196953e6979", "comment": "Malware payload (BlackCat)", "value": "817f4bf0b4d0fc327fdfc21efacddaee", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808161, "uuid": "16d297d5-14e5-4b63-9f99-fc726eb2c06e", "comment": "Malware payload (BlackCat)", "value": "f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808161, "uuid": "a79db16a-c70a-4f99-921b-e3e0e69f9c03", "comment": "Malware payload (BlackCat)", "value": "8917af3878fa49fe4ec930230b881ff0ae8d19c9", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655808161, "uuid": "ad09fe4b-0b74-4ba7-aad4-6da78b69d2f3", "comment": "Malware payload (BlackCat)", "value": "4ad4c830fd974fa9d49cfaa4955c4e20d0ac09bbf2bc057c1edd273207b1ca879921b8e33f99567a1e9689f40e8a152c", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "BlackCat Indicators", "colour": "#E10E26", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808161, "uuid": "5c8b9b2e-2970-47d3-b867-d14b5ac390fc", "value": "T1FDE59E46FA4356ADCB971570305EB33AE63A491C602D9FA3E7E89D30FF2E71019C8619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808161, "uuid": "289e4e17-a361-4472-8075-2cd32f687481", "value": "55c1bce75ad836c886b7fb6bca398063", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808161, "uuid": "8c8d6f51-9c0b-457c-83c2-8c9f2da7cc5e", "value": "49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NE/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFyvww1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655808161, "uuid": "105f951e-24fd-4d09-8d51-7ed0b0d28e55", "value": 3068928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655808161, "uuid": "6cd53a7d-6914-4343-991d-1e7c5003a795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655808161, "uuid": "e8bbe132-0342-46cf-b9de-8e6f962c7886", "value": "f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36ff42c-f144-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1655803791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803791, "uuid": "992d1153-7a24-4bc3-9f31-eddd1d4d340a", "comment": "Malware payload (Loki)", "value": "f26a4752e680986cf1acc1260126974b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803791, "uuid": "51960b4c-c3c8-4598-847c-cd4f033dc715", "comment": "Malware payload (Loki)", "value": "f87fe3a79b619b480bb647598f91816736888848f21f12a8c75cbeae984245ad", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803791, "uuid": "175478c9-7bc9-4a5c-b3c0-e8c3df6ece3e", "comment": "Malware payload (Loki)", "value": "601483538b9df5ee4219a3e83c3bc5d3214a4155", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655803791, "uuid": "548ec75d-b8d8-4f04-82e7-61d67cfb4610", "comment": "Malware payload (Loki)", "value": "e6d0c3fb5e932ebf0bbe902de45bce6f8c19e42f9a75ce77de6da995dc888bf643d581044cff9d0ca5a39d4f6a4f0546", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803791, "uuid": "90957ed5-8ea2-4471-8f9f-f3a0f4e16046", "value": "T19573E0141A547E48E8E3873924DD600F8A2D7E5C5CC3C279D1273226C9B7E1DA6F9E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803791, "uuid": "081cede6-a72e-4eb2-a4f2-522abcbd6807", "value": "1536:K/2BY7O8fytsBiniryPWtC7XpMgK1+oXWGpfPJhUzdd6WEP:K5GtsBinpPWtopMg2+oXWGpfP0zdwW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655803791, "uuid": "a7d158a8-0596-4e53-a4e6-9c1ed94e6ced", "value": 73576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655803791, "uuid": "e7d9b86b-4dff-458e-b837-83dd6d56e7c0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655803791, "uuid": "71aa33a9-e470-4224-9267-b384d4eb85bf", "value": "SWIFT Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d855589a-f1b3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655851527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851527, "uuid": "33ad27fc-906d-44ee-bedc-4fca057b4ba8", "comment": "Malware payload", "value": "e9eb1636f80fb31551de90fe83f3544e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851527, "uuid": "cd2ee2c3-186c-48d3-a48e-b41edfb092e6", "comment": "Malware payload", "value": "f9f2fda63a7ccadda9a7b251404d6fa5a43349d31686bf4c4c00ae40caa7107a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851527, "uuid": "3ceaaab9-7f17-4fe2-aac6-b1a4182695d5", "comment": "Malware payload", "value": "8cd14a74bd00c214552b7500e8fa6cbd12c1d5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655851527, "uuid": "fb203108-5cbc-4f0d-aa1e-718a0e059069", "comment": "Malware payload", "value": "96c75a9054187e5c59e0f87d7525b931f388f8626dd89255cd3ff44f625637558eb36a950cd346e6676b286c4a9970d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851527, "uuid": "cd2dbb96-eca2-4628-9465-f4696fb41cc0", "value": "T1EBA4CFF19FF6BD12D6142133B0D1A13C33E25D4EE862E737968BE1092852AC656E1F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851527, "uuid": "89938135-b7cc-481d-92f7-6f8469bd0a80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851527, "uuid": "57185548-2c7b-4584-925e-8e20a8e5993c", "value": "12288:uMJlrJ213/eS/JAykv/PzNPKCIaPdtu38Io:uMJlrI3/e4JfknPzNPKFa1cpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655851527, "uuid": "7d486868-3ce5-4396-95d5-16a4990df93d", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655851527, "uuid": "d0597a11-fc5f-4168-b895-73899352da1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655851527, "uuid": "a8210307-63db-4338-a9bf-8471fa08ba70", "value": "cotizaci\u00f3n y nuevo pedido.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c43511b-f1b5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655852178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852178, "uuid": "796d3743-7a45-4c49-a6cd-885b73ae85a3", "comment": "Malware payload", "value": "609d593af98a3c18acb98f14216d0bd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852178, "uuid": "c8404732-c83c-4dca-9b0b-a7ab8aeff3ae", "comment": "Malware payload", "value": "faba5925ee5e0f769b8b412870d7ccc4dce9288fc42141bcdfd07b2716596380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852178, "uuid": "9a83b292-8e22-4f75-b237-28ac1069f067", "comment": "Malware payload", "value": "4980634e00177a3e4d1b36d374387ac07199221c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655852178, "uuid": "94a37a73-f6a4-4c7d-b3a0-ad9309202c78", "comment": "Malware payload", "value": "929ed2065faa096413403c4017c4a794fae6ebf8715efe2c2f81625bd9587ded1dc4c9f966c27ec02e8922e4e562efd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852178, "uuid": "5a1b4884-2d02-4327-a71d-2c583e25fad5", "value": "T1EED59D0077D9FA27E6BF0776906200509BF3E4527392EB8F236066B94C873DC5D5A29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852178, "uuid": "04ddcad7-05fc-471b-80e1-db80caa2dd2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852178, "uuid": "fbe46fb7-a883-45e5-a737-c80bf84e0617", "value": "24576:CHnUHeTak1Xukw5Z+eGsPV8sZvOjq1RFoRLoWzqcEVyTfTUTT1xxxJL8v+yJwTds:In11H9OurkYeQ79kGxue5AonV/tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655852178, "uuid": "f73aedc5-b9ef-4e24-b535-0d636a7121c6", "value": 2812928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655852178, "uuid": "22d9bee8-eb6e-4217-9500-29a5913a9aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655852178, "uuid": "ce62ca68-9e0d-4a43-9001-ecd2928a1d8d", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ee30f2-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1655823577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823577, "uuid": "53d309ff-831c-4e18-9248-8fd547db8a00", "comment": "Malware payload (Formbook)", "value": "f86865bc1b7e91e8e07d2a886682a772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823577, "uuid": "22024725-8808-4735-a42a-bc9be2f09c43", "comment": "Malware payload (Formbook)", "value": "fb3720f555a4f24cbbb34901d750d439d9b56d7336e6d6a187dde5a723fc50ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823577, "uuid": "0fc60823-065f-4275-8a29-3a48d3cb0faa", "comment": "Malware payload (Formbook)", "value": "a496236c6d15ea25bca7afc6b0656fc1d1a78779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823577, "uuid": "bf6e3403-5191-4c25-a4d8-226f3ba15e30", "comment": "Malware payload (Formbook)", "value": "bdf391501b6dba9afbd5f882a7af39f105a467a62eae09ed3e1a802628aba9b4c2c84a36dd470eaab60a48c94c401ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823577, "uuid": "f3ce997b-4e70-4986-9acd-250a2f26df9e", "value": "T1325387E02EAADF6AFD694BB4853171CC13727C5634E1D30ADDC230DA1A67B4846A0B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823577, "uuid": "e779fb1a-72eb-44e6-bf73-c113314d9871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823577, "uuid": "a9c9e783-677a-4f19-a5a8-cb10c65cc3f4", "value": "1536:4Av7O3gav3EEoemaaXaaaaaaaaaaaaaaaaaae:PaJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823577, "uuid": "eae5308a-8b73-45c5-94dc-c3d4c1199d0b", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823577, "uuid": "ecd3376e-c041-4d38-9fb7-bc651e200a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823577, "uuid": "673ce4f7-c508-4263-bc34-2d096d344498", "value": "f86865bc1b7e91e8e07d2a886682a772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27eeb602-f172-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655823314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823314, "uuid": "3d29fcef-b55b-4ca6-ad09-9ecb6a711475", "comment": "Malware payload", "value": "e61589a3fed635683b85dbae92d30996", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823314, "uuid": "37e4110e-5b5e-45d1-9102-e214337f90f9", "comment": "Malware payload", "value": "fb5a7f9a4bca20afcf01e5597ca6a707b34efd33c0b283e32e6e425dd51c8557", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823314, "uuid": "d4938e90-d21b-4903-9e54-4c8c918f3620", "comment": "Malware payload", "value": "27b5400ffeb181e8a72d163970e97286caf26593", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823314, "uuid": "81fa1f0f-b0f5-4ca5-8143-87233c10448c", "comment": "Malware payload", "value": "51478973923cc22cf5ed46a36ab3d8193f45238a356a459376d6cb77b91db3b1bcea7ea6b9567c54871b40b8347a22c8", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823314, "uuid": "db882719-95d5-4de7-a4de-71717f4feeb3", "value": "T1E9027D109B90D287CF726A3DEA796ECB2A3BA0260183561378D1F5581325AC3674ECF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823314, "uuid": "f072a791-6695-4fd8-9e40-1d5e2130a80b", "value": "192:xrXP/BmtO9pniUWP37DLcy/CImd7JSyadwHSIhG9eY:dXPs47iDP3/LcyKFSrTICz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823314, "uuid": "35dad516-8feb-4ce2-b060-3dafbd298adf", "value": 8783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823314, "uuid": "ab6abfe8-d3d1-4181-80da-2ea439e08c5b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823314, "uuid": "8e1b9591-8754-44b8-aa8d-b3cc7066367d", "value": "Custom Declaration.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45494c5b-f12d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1655793727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793727, "uuid": "21308b4e-7b47-4334-8b2f-e9979767ddaa", "comment": "Malware payload (AveMariaRAT)", "value": "be6479b11543d7467a60cec57759109c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793727, "uuid": "c2f037a7-7158-4ae1-af97-93b8210feaa2", "comment": "Malware payload (AveMariaRAT)", "value": "fb9afe69ff07ae97955d794ea7a2dc0e6f69da712ae0d23b8b9906bb83c0daf0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793727, "uuid": "65e2f61a-c488-4ab5-86c1-00d0fa650420", "comment": "Malware payload (AveMariaRAT)", "value": "12336e66a1f2c3584e5b0056aa18a57ace53d231", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655793727, "uuid": "116be0ce-96d8-41fd-8c94-16b364171a5f", "comment": "Malware payload (AveMariaRAT)", "value": "e9830af20b3dbb785052b764dca68a2a9249d095ba79d858d73c45f27dcb4b1b61a2318b4ee0c484b012af83e63c354e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793727, "uuid": "f72b3fec-aab0-421d-bb69-7452ceccfc1d", "value": "T15D83E00451ED2129FA79063356BE5BAA22FAFF17B96743092043B1CA6872CF0516F71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793727, "uuid": "b3096662-c665-4236-b343-d6fa3fd04e9f", "value": "1536:+4KcbnUonuDLUry3Bc1P5L7pIuJa+fCevrghFyL9mqk7cqY:+4trpuPUrm3maE6FGmqwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655793727, "uuid": "643f31cd-89e1-4607-a3a4-e80cf94021e0", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655793727, "uuid": "478ba7e8-6387-45b9-aab7-97eeac87aff9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655793727, "uuid": "28c110bd-d620-4e2a-85ac-fdc42f534fc0", "value": "New order Contract.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6823983c-f198-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655839742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839742, "uuid": "ef651c7d-eb31-4705-b999-be74aebd9164", "comment": "Malware payload", "value": "7bad648c2774078d3090cd88ee36ca06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839742, "uuid": "0162e57a-5878-4664-8099-13e6d5cfa3f8", "comment": "Malware payload", "value": "fc03d6fa6787c0e6fee51af9c567bc1febf642bdfd6fd91ee99348b0a2cdf947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839742, "uuid": "7637f50f-5bc6-4c89-8a90-96e48222047b", "comment": "Malware payload", "value": "0b14841ef89165a6ee5bb2743575251c005d5821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655839742, "uuid": "eeca18c8-958f-413b-bda9-70c7f1fbd0d2", "comment": "Malware payload", "value": "de1ffdbc84e96d1017750546d5c1ffe2844eb987a2577d416150c367b9739829967d27be743381580b32eb886815bb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839742, "uuid": "3ca3e6d3-6871-4765-bb74-7367a0f2b5f3", "value": "T1A31633C4BA909E8EC893C8B8F5907C7C9459A19F57F39B4BE11317B8CD69067CE81872", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839742, "uuid": "a384f1cf-5b1e-42e7-b7a0-b0a69cc83ca3", "value": "98304:hz40W+qaA/N1R/hiP/SrRB4s3kDBEfTg5Aaj6O2q:SR+qNL7A/0B4sKEgX32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655839742, "uuid": "be49b2e2-e84c-4006-b4a9-1e0fac0d70bd", "value": 4407296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655839742, "uuid": "222ce273-bbd1-466c-84b1-0b1dcc3baa78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655839742, "uuid": "8dc0435a-29e5-4209-a3db-6feb556e04b1", "value": "CCleaner Professional.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587299c6-f136-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1655797625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797625, "uuid": "56eb91e9-a346-4d62-a957-73225324c77e", "comment": "Malware payload (AgentTesla)", "value": "ec51b0dc62594816c038e57a8918a996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797625, "uuid": "99c48290-2514-421b-a735-81ff8174562a", "comment": "Malware payload (AgentTesla)", "value": "fc28b0d1e8c3733802f549b051fc6f650dac5f21b520fd56edd24b6b228361e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797625, "uuid": "5b964923-faf7-443d-ae64-4964f57991bb", "comment": "Malware payload (AgentTesla)", "value": "c17b050f0b96cf023e341778ab0e153f19dbb254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655797625, "uuid": "2ea8806e-5434-4b7c-bb73-be185d4cf42b", "comment": "Malware payload (AgentTesla)", "value": "d2118b2a7c881778388076561f799d3a70b91c7eecd4eea078566c48659c1be09b6a19b8f7d55f9c637209384c722fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797625, "uuid": "dc96def2-595f-4048-af11-13288fdf6f33", "value": "T11805D0E87AB075AEC416E873B9642C3C77D16C2BCB0BD113D047A19CA51D9D78FA09A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797625, "uuid": "e1d46881-a39f-4437-b9d9-0b2c418274cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797625, "uuid": "3ae60671-e005-4ef3-8e8a-d9521abcdcf2", "value": "12288:0XBv8W9R+tCb9LfTW9037E/bppYVO9pguXN6YIvnAInFpYGl+lOa7ZQfxKY:mBvP9s8RJ34Tpp399fIfRwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655797625, "uuid": "52be056a-abac-4ad5-a060-70a0e01783c5", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655797625, "uuid": "c84d91fc-de9a-409d-9fd8-1bd944610d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655797625, "uuid": "e352d0d2-ad6e-4d2b-81ac-c351f7b155c3", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9864.11647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b8114a-f183-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655830796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830796, "uuid": "6f83ca50-127b-422b-8e7b-28f4abd9134d", "comment": "Malware payload", "value": "ecdc419893f5d1086855bea77a2042c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830796, "uuid": "d81c9515-b997-4b4f-a6d6-796f93e8f539", "comment": "Malware payload", "value": "fd0e07ec492cb76abaca206083a13f5cad0a3ed563495c852f13b4876e63974c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830796, "uuid": "0e11decf-8c24-4de1-92d4-46df68504292", "comment": "Malware payload", "value": "d23d64429f7b5cb7cac9f946a3145ccfbb730744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655830796, "uuid": "b5caedd7-daac-47f0-b5a8-00d0e19ee3fb", "comment": "Malware payload", "value": "7da10d21c98538182797467ff8a31fbdd2a9761d6643bfa3654a1a3e25bd526ec5c83b4a6bb25faf0cdb6ae089682c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830796, "uuid": "5e51fca0-cf3f-4f8d-8255-66ef8da13079", "value": "T19015B0B876047DD6667F477BCA96ACEC13B626239ACBA4CD8064B7C30563375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830796, "uuid": "b970f87f-7756-49db-8109-8c40fc1ee05c", "value": "24576:QKIwWVONhcM7Z8WUQ6nOqbxfY7uhHmJP+Xcdy0/F+l:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655830796, "uuid": "4496d464-aadf-4866-ab23-4a56bd5cd188", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655830796, "uuid": "f720becc-08e8-4484-b9e8-0f492ea229be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655830796, "uuid": "109f36e2-65c2-4353-b301-8891f85d3771", "value": "mar7nal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a75dec8-f140-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1655801870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801870, "uuid": "d1673aad-6c85-4f3a-a28e-f5d000ebeef1", "comment": "Malware payload (SnakeKeylogger)", "value": "41f9a905799319743ca5380eb8d752ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801870, "uuid": "0061ff5c-67b3-411e-9bec-e801c45a3931", "comment": "Malware payload (SnakeKeylogger)", "value": "fd1d6feb2e3be798f22d91244cfb52e52303220a7c822227122901fe0cf1236a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801870, "uuid": "e4b38e55-5bee-4d50-a42a-409fb4b761bf", "comment": "Malware payload (SnakeKeylogger)", "value": "b14e9fdd789cae9d0db001f9297cc17986e614c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655801870, "uuid": "71c6aa6a-d9dc-4bac-b4ce-b00c3860fcb1", "comment": "Malware payload (SnakeKeylogger)", "value": "ba93b9337c50c4050931cc80ee82581111b7a7b118791d7b935c2e398fe949cff52ba7434dd0f7ca5b6380f7d0329618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801870, "uuid": "ecd2f692-6983-4c24-bb44-d811df947ae0", "value": "T159945C9CB22C74DEC89BC27699A84C64EA60746FA71F500791530D9E9D1CB83DF268F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801870, "uuid": "a8b3eaea-13bb-4aec-af18-afcdbc3c5344", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801870, "uuid": "71f568a9-f2f5-4ef6-aa2b-df74f8e7f476", "value": "12288:ekXTpvAmkxjBkOk32pAcf9rIH9Z6SVqmapu:XAPxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655801870, "uuid": "5b874c01-4f39-476e-b4cb-fe7bd5258aff", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655801870, "uuid": "5d66327b-053c-4b59-bffc-bfa5e08d6215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655801870, "uuid": "5ab3c5dd-d47c-459f-8b78-9414408c3ef2", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9dc370-f17e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1655828636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828636, "uuid": "a1670ca6-dee0-4a56-bdc2-a96a839018c8", "comment": "Malware payload", "value": "a378416b2f91601399628debc93e6b05", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828636, "uuid": "7f93226f-0a35-46ad-ac96-6d718a4714b3", "comment": "Malware payload", "value": "fd87ea2eef08df5e98ed65b49b02f7dfa62dc784eb1ee3767996ed0801b5144a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828636, "uuid": "9e42354a-e2c0-4835-8144-c3ebf6369fdf", "comment": "Malware payload", "value": "4258ae9ed15e34e63f001d3349fd3d60c55f2875", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655828636, "uuid": "328e8db2-4c1f-4273-b3d2-52c27d0eec55", "comment": "Malware payload", "value": "b789a7332fc7838018aaa5c5d73868bcf1e987dadf253f5156c2d3b2fda200e9cd07377b09ae344332e0532ae56d1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828636, "uuid": "b6c8bde9-55d2-4f64-923e-c9d35ed975d3", "value": "T14D94485303891BBDF69D0EC9C95B205B20F2D4677D251289EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828636, "uuid": "66e0d9f1-5366-48e6-97e1-f9e3bae927a0", "value": "1536:C9XR1YBrhe2dXKheI73K/z5lKHzNx1qGoetQJZTsW3t47RdrbTD+4xb21iNarfo/:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655828636, "uuid": "0ac01b34-bdc9-4ecb-912c-3bf2e9d8f2af", "value": 435531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655828636, "uuid": "9ab5ebad-ac77-4734-9cfa-d05709fc43bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655828636, "uuid": "7e10ea8e-f1bd-4010-8dbb-e6f2fdf3b25e", "value": "1b5622_befba69d472e44e491e6f6d035d590cc.txt.(ps1).vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb8c93a-f171-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1655823243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823243, "uuid": "7bb81ece-f110-427a-81f8-e73c705cffa1", "comment": "Malware payload (RedLineStealer)", "value": "f9ded2924f84f211c731ac003a31c024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823243, "uuid": "698a4c7d-90bb-4f6f-a90e-e02197b3453f", "comment": "Malware payload (RedLineStealer)", "value": "fe6827e60825601a241e49bb9d001cfcb1bc86987619468f2aceeb4871ec606c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823243, "uuid": "9ed7441c-38d9-4fbb-9cd5-ae4d8762eba6", "comment": "Malware payload (RedLineStealer)", "value": "35522a2c49589d051910be9f9e65d0da222dd320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655823243, "uuid": "141d9e19-fb2e-475a-94a5-3fe64f585bf1", "comment": "Malware payload (RedLineStealer)", "value": "f94e963cdc5d72372d32dfc9159d43e78f1a4531288fb985829c3e980a90ec5f6708d852ce87f9e6650d343a5ed91640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823243, "uuid": "a9915a9d-05f0-4d6d-a251-c7d991a7f237", "value": "T1DA05E57CBB015B72FC5E817059010B66BB620F436280B9B257DB3ACB974F1A69DF5C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823243, "uuid": "7ae8d07f-301e-41fc-af1b-543024954abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823243, "uuid": "d3faddd4-9c5e-4349-9b7f-d8875baadab1", "value": "24576:IvNXEUb03UjrgVJ/zoKuMjrcAQ8awpeJxwpe:IvNXBbiUjrgVJLol8xpe4pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655823243, "uuid": "8b91c9c9-02e8-4999-9ca3-9fb2a7b4e589", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655823243, "uuid": "649cf2a3-4c37-4485-a8fb-c243dfcb272b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655823243, "uuid": "cb198c84-f593-4742-9d69-45cadc05cc75", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676fc2eb-f16c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1655820843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820843, "uuid": "752931a1-60ac-42ff-928b-f79b82c8f69b", "comment": "Malware payload (Heodo)", "value": "df1709fc7cab4da62c1d19ecb098df0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820843, "uuid": "6bfc44ec-4070-4b6a-9021-671223944f85", "comment": "Malware payload (Heodo)", "value": "feca36fa47382c8ce959ae572f627b56ee60c59b3138ba0d5ff77de1f2348e8a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820843, "uuid": "825481c6-27c2-4bca-be29-af239cf2a0a3", "comment": "Malware payload (Heodo)", "value": "f33e8cfee1a63803d8a85d19406d2825cc0c66a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1655820843, "uuid": "3f5c58b3-f89e-4b95-b622-d016b88e9d9b", "comment": "Malware payload (Heodo)", "value": "6516adc669113cf61a3663878c4afc3986f514f371620c2dfc0f033496fb9a660644bedc5e734228fdfec49a9af56870", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820843, "uuid": "dc925db2-a561-416c-a7f7-00a962a5bc62", "value": "T114648C0236A04866F3194B348907F6DA8765AD7D15E0E60EE2787C761E332C36D7B62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820843, "uuid": "a0ff5d7f-8b92-4901-bd9f-a8f73185c70b", "value": "fbb4d9f7f00c9636121e47653fd6dd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820843, "uuid": "8581f562-69dd-47d0-b264-05812790ba9a", "value": "6144:JqdSTDcHe3kjHfNsQnYXYyDzVbh2RVFKSwmA6I+108ios+4XPOl5uG9+:uAcFHf3YIyT2dkv8iI6w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1655820843, "uuid": "91319a6d-ec57-4b2a-a328-2d2a7932bc39", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1655820843, "uuid": "2a06dac6-ca21-4f62-8516-791571d165ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1655820843, "uuid": "652680ad-0d47-4e62-a27a-3ec3f6b7c388", "value": "FOXrRSL50BlRP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }