{ "Event": { "published": true, "date": "2023-03-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-08", "timestamp": 1678320181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a496978b-4c3d-44d1-b9f5-a0dffb1b759b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aed9dc-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248305, "uuid": "167e3160-b3bf-4e54-b1bf-56863ad23fc3", "comment": "Malware payload (Mirai)", "value": "110a1ad0229e54bce02947fbbc5c6f3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248305, "uuid": "604e70d3-1dc3-4f88-8b28-3521a4247db9", "comment": "Malware payload (Mirai)", "value": "0059586ce6c950f3ae7090b84c589ddf8535d1f4adbe12e35a75e4e7ea684db2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248305, "uuid": "fe5fba64-2e7c-4b50-b0cd-a4c8a723f5ab", "comment": "Malware payload (Mirai)", "value": "dcfc2de4ebd9469e2a9f0bd7504e609a49be562b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248305, "uuid": "54a250d2-0892-4225-a6e2-8c237560d623", "comment": "Malware payload (Mirai)", "value": "cf05a8f49f8705884c91cbfca46de8fdf6ebf9d23be4895e9de90a435ce01c009792a491ef8f5fd6d7a117c39607a9aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248305, "uuid": "c29afb8b-0283-4cfa-8d96-f5c789be6913", "value": "T153E32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248305, "uuid": "cd4037d0-ecb0-4403-9505-2a8c5fdd7334", "value": "3072:iJLce3pCgn7naqHbz4Nt7kJ0BIJ1FHiXkkTM/9fCMY:iJLcO7naqHbz4NJkJtHHiXkYM/96MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248305, "uuid": "2c53b16d-8d0e-4135-8e10-f05b56db6628", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248305, "uuid": "ea1ca203-9975-414d-a126-01562a4c1293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248305, "uuid": "10ef8a35-793d-4d4e-93db-f9384b3115df", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fee2b1-bd4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678236144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236144, "uuid": "21679f01-7107-417c-93e1-f483873bd219", "comment": "Malware payload", "value": "e0a8b2eaf4ed3afd3c866fde84097b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236144, "uuid": "d5676217-6cc3-4dbf-a3ab-b573cc8e31d0", "comment": "Malware payload", "value": "00ba598e474e88b24038d277d41298f0539d5172875f1ac9305e4feb5691e537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236144, "uuid": "223ca52a-163a-4dcc-8f51-56f3e2c1bdbb", "comment": "Malware payload", "value": "782497caa92aa84ee6dd657fef9d50494b4832a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236144, "uuid": "bd178622-8b51-4c63-b731-67d61f95c13f", "comment": "Malware payload", "value": "ba507dc94604855d2013dd7c76bc27f99f795be2b843dc88d1831c5ed0bdfcbb13a9f66601df9b96799e45b9f6556eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236144, "uuid": "35955e6d-30ca-43e7-9fa8-66c89cd45cf8", "value": "T1DC64C500B1CA823AE5D3D3FF97BB8B2AD91996F0278112C7C3A457AE9F551E53C32425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236144, "uuid": "9fabc208-2de1-4a23-bc24-0998a7693b19", "value": "3072:C5nMR/mhihc4SAQuMSoe7px2YDp0m8Hj7ZErilJH:s+lSNnSoivjN8HjFrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236144, "uuid": "2b392761-1aa6-4240-8d8f-7dc68f31f972", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236144, "uuid": "8393a97f-4669-4a12-99ca-775caec02e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236144, "uuid": "4d0ba18e-faff-4285-815f-6a952328ad26", "value": "SecuriteInfo.com.Variant.Zusy.429385.2989.20262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd8d01d-bdc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678290911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290911, "uuid": "975cfe21-7dce-4253-9f36-b8de74e6dd2e", "comment": "Malware payload (RedLineStealer)", "value": "14f5e165626c6af52bffbc89d21329cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290911, "uuid": "81932802-ce4b-4d9d-90cf-91cb2c59bcc6", "comment": "Malware payload (RedLineStealer)", "value": "012246d33d0db647d7d358792ca9610d561f0cfdbb7b173966842d93ad4af725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290911, "uuid": "b29ea693-a38f-4edc-a339-0d8d9dd77356", "comment": "Malware payload (RedLineStealer)", "value": "984311acb1194d14570e18fb067d0d77e18e09f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290911, "uuid": "901f6a5c-885a-47c2-a8e4-3a2a0e492955", "comment": "Malware payload (RedLineStealer)", "value": "26d9c8626f4a4e55b0d1ab5ca07dab46285faa247bc813f93c23049af1ebed20f5d16b91085ca3528032ca6abd6ad6f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290911, "uuid": "670cc479-8f87-40ff-83d8-ff9b58a000d0", "value": "T1D2E4121252ED6874F2632A309EBDC3B0A92EFD639E746A6B32146B1F1D712D1C572313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290911, "uuid": "7521ed64-043d-46bd-902a-4d321163a423", "value": "2115960edb01d3d9bd07271fe70d5d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290911, "uuid": "0e31bc64-494c-42b0-baaa-a08e47f334b0", "value": "12288:zVWaqBVJ9djGK+NILVhWtA2upeUQFEoo+eN1d2xH8+llKGkAOH:zVWlhd+NIph4APeUQFEoo+eN1OH8+llu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290911, "uuid": "b196959e-75b0-47ee-ac6c-9a666ad758e1", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290911, "uuid": "598c21ab-e5be-4252-8df7-5c96407b7429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290911, "uuid": "6dd54b2b-349c-409c-9808-16b014211714", "value": "14f5e165626c6af52bffbc89d21329cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b17a9d-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266829, "uuid": "fe1aabe9-b7b9-411a-a99e-3f9d54637777", "comment": "Malware payload (Mirai)", "value": "7940b47f142572132e726897adac0432", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266829, "uuid": "46a6a5d7-47d7-487f-b72d-1194e731a02b", "comment": "Malware payload (Mirai)", "value": "0172b45249c955ea8c1b201b44f84249944729240d8b7682e5d8e98246ea27fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266829, "uuid": "1b120b8c-9161-4555-9c7c-df01169fc088", "comment": "Malware payload (Mirai)", "value": "af48cd3ee154f36c6a88dccd2680e268e7534418", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266829, "uuid": "cc59bdde-2b00-4331-a63f-7d0397180ab4", "comment": "Malware payload (Mirai)", "value": "a341bcd23d93f0267f246c936c97b19d2badbe8303df98f2ce6211737ca1d7848814417b5a39c2ed490510c9d5331cf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266829, "uuid": "0af2e295-cd70-4230-b838-7e2d82c205e1", "value": "T140F32B46FA418B13C4C62776B69F4249332397A493DB73069928AFB43F8679F0E23945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266829, "uuid": "3533d670-b5a2-43e9-8237-87208ef32c5d", "value": "3072:2GMavKqPtHGHAGhYaIrIomY90AoTthWZLptbAu2LUM/93okPZf7:2GMSKqPXEYaMIomY90BTtsfbAu2wM/9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266829, "uuid": "999fb7ed-47b2-4487-9135-64997e83b92b", "value": 162129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266829, "uuid": "86c95470-874c-4a65-a837-45f8d4946505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266829, "uuid": "f77003e6-7be3-4bd1-b462-c942264f4370", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecbbb35-bdbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678286380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286380, "uuid": "07a4ac8c-fd48-43cf-9351-bcf41c53221b", "comment": "Malware payload (NanoCore)", "value": "9c8242440c47a4f1ce2e47df3c3ddd28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286380, "uuid": "d146a83a-763e-4a60-8031-dec9112ff066", "comment": "Malware payload (NanoCore)", "value": "01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286380, "uuid": "e83623fa-64d0-4810-b735-fc14a6235288", "comment": "Malware payload (NanoCore)", "value": "874f3caf663265f7dd18fb565d91b7d915031251", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286380, "uuid": "498d6c9c-5cca-432f-816d-088c9932d96d", "comment": "Malware payload (NanoCore)", "value": "a9b9993935da4f81da652c08d13476b1a9b1baf3bedb362f5ac175fc33b5fc213b0b5decb98df5aca700b0c7e41e316e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286380, "uuid": "5dbba755-2ac8-4e82-afb8-f0f6feb8e994", "value": "T134A3490766CD6EAEDABD4638733307C6C328CE425953D6DE28D420659A3A7D33A033D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286380, "uuid": "ef8b833f-073d-4ded-bb5c-ac35475f1cb8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286380, "uuid": "ac3cbbb7-9158-4e40-947a-a66199dfa72c", "value": "3072:2m7DYfm4SRR+NaVEs+k6kiS+94ERR6gR0bRbD:2IoIRRGaVExfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286380, "uuid": "602d8906-8c10-4c1e-8e95-0f9d9558becd", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286380, "uuid": "d0cd5c44-1412-4654-9df3-c35cbc85b15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286380, "uuid": "fe76b564-6158-49fb-bc70-4d85be6ced28", "value": "01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67adcd58-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261189, "uuid": "8f9b90f0-f243-4374-9bb3-06ce3e626f36", "comment": "Malware payload (Gozi)", "value": "a69361ef6e25ae8829e5e5ec00fcf461", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261189, "uuid": "c848b7ca-f42e-4c64-9573-0fc493285166", "comment": "Malware payload (Gozi)", "value": "0284ebc8b81dd2894fbdb7ca298d1c2c85c41630b9b9ab99aed51aec86073aae", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261189, "uuid": "7e1c921a-4ba5-4acc-b14f-b87f6311e874", "comment": "Malware payload (Gozi)", "value": "57c704fa05da4d9ba66cd01abb87768506283a7f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261189, "uuid": "9419cb73-898a-4f1d-9d41-a6cd340c31a3", "comment": "Malware payload (Gozi)", "value": "3632d347884746043852c22c711a70d999771cbc9bc87bd5a1a8084bd02bfbcded3602428580fbbe1a42b5ce5b797f11", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261189, "uuid": "208e035e-cbbb-4796-a8f8-f0bdae7a2e6a", "value": "T1BBF05CC00D1A4724C016D0BCECA282B19AB0754F007718BE325D5CBBDC656DA075F28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261189, "uuid": "81d08513-0847-43e6-9324-b2738c8dcb25", "value": "12:5jpZrCarN8+OW3xqaFbBzb/1gMxfT8ryuFrN8+Zp4TtFpP:9nryZW3oaFb1BgKTEyIyDj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261189, "uuid": "7863be8e-680d-4154-94f7-aa6b6adcf3ea", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261189, "uuid": "7753bd04-5114-4888-a853-4e72f3ea52a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261189, "uuid": "4deb9ddb-69b4-4e63-aa46-59c7a410f52b", "value": "AgenziaEntrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97022eaf-bdb3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678281454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281454, "uuid": "38ca6254-0d96-4dce-9032-bce79b79ae44", "comment": "Malware payload", "value": "9e31dba41c7524bb1e06c08d4620a4a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281454, "uuid": "4eab4f02-9869-4833-b754-c5dd2ef6d012", "comment": "Malware payload", "value": "033827e8c7f02407bcffd0da28fca479d25dd2ce8b4750899f0d576ce1f1311f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281454, "uuid": "9d79d88a-39b2-45d6-8d06-fdd1ade51442", "comment": "Malware payload", "value": "66aedb856ae810476895bb17911ac2bea7934688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281454, "uuid": "34ed2e65-c43c-421d-872a-50b930f76a9b", "comment": "Malware payload", "value": "5d34a00714b7b9d4cc5a5b4a6b413488b721982afaae680fcd9f82182cc643365de18ad7f85fd03f44df586b573402dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281454, "uuid": "695fb373-bb56-48fd-962d-4d12bce51ec9", "value": "T1C0057C50C5C7A13BE4523637EE9A87613263B6C25221A4FBD569C2E8D6BF6C1F0B1063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281454, "uuid": "fa29abbb-6787-481a-93fe-73af09cb872f", "value": "12288:JQFSU+usmGr+6jL7pN6gAUgtbXSzrJG5PVoLugpLSmC2Ba4lOfGl0G:JQi3jLz6FUgtbXSzVyyLuyLxa4OuCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281454, "uuid": "ef30e18e-d621-4422-8736-b37e56b67e51", "value": 850548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281454, "uuid": "e509b494-591d-4c23-9142-f91353fd18e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281454, "uuid": "4161b38a-574e-4127-a440-ab237c5de03b", "value": "ar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff44c5-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678279540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279540, "uuid": "421a8964-3b6f-40d3-b50d-4b163d833177", "comment": "Malware payload (Rhadamanthys)", "value": "4adf9b20011bc571b61884f1b630a84a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279540, "uuid": "c500c284-4f94-494c-a072-f11d5fe5f4ad", "comment": "Malware payload (Rhadamanthys)", "value": "044e62e14faf9e06d2759ac0d62b4c6cb3a103fe287e235c48ab1c64604cfe3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279540, "uuid": "48f2073c-aa21-418e-8c44-71fa13644fd4", "comment": "Malware payload (Rhadamanthys)", "value": "fa9b755b0c0a86183ce059ec5c03a57ebd292de9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279540, "uuid": "77de4de7-3fb3-4ecc-a75c-e27a57e8134a", "comment": "Malware payload (Rhadamanthys)", "value": "66f71fa6adc4c7f54932fd457d04c3e5c7952baf750fdd92f4597d30b552762ad0b00efb1ea055e925fceb6b0b7e3085", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279540, "uuid": "04979073-d1b1-4431-9986-f767b3e44b22", "value": "T1FD75DF623ADB147BF03A41F175A48CF8BDBE2F9BB401072E1165D6FC45AE161C6207EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279540, "uuid": "4ab14442-d155-4511-be97-7f2a06e9e063", "value": "caf9bf1d191236de3d7b150ac6f71de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279540, "uuid": "c464a928-9fb7-4721-8b17-3c39b9c8490e", "value": "24576:gncYAIIhJ6Z1NM97KM/th4FosodIWp26ICk95akZPa/S6Dh/aI5:2GJ6q7DQi3dTp2/9gpRaI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279540, "uuid": "11caed18-6615-4f08-8b4b-f94eef1e69f5", "value": 1660312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279540, "uuid": "c358a3cf-b219-472e-8677-dec78084c369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279540, "uuid": "b20db3e4-e685-4028-a84e-c248805f8f02", "value": "4adf9b20011bc571b61884f1b630a84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fceac4e-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678261175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261175, "uuid": "293671cb-53a3-49d3-8a36-35ad87b554fb", "comment": "Malware payload (AgentTesla)", "value": "84ba8850090f854400da9ca28f4416ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261175, "uuid": "3e65381c-675b-4b76-b501-19a4fbb77ae4", "comment": "Malware payload (AgentTesla)", "value": "048b57705057d98f9cfe2f95f1bc390de79ba3e4abb0c6f0dc131c4adf4bb373", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261175, "uuid": "4464da07-327f-41b7-ae84-b407c43d9473", "comment": "Malware payload (AgentTesla)", "value": "1a352249bb1008db203ceff327e2ccafc07c4300", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261175, "uuid": "ab844ae2-df34-4539-8135-10c2611c1b93", "comment": "Malware payload (AgentTesla)", "value": "77ef5dc640de0229bf8938e3dbd34ee1fe09e970e66c0609a67023c7f529ab33d164c38414d14a471aaec44e37bfadd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261175, "uuid": "a320f42e-c3ac-45b3-83a8-e2b1fd5d1fbd", "value": "T12E15CF99B3754433EC8F41B90927C2CF2D40F98B7611E237677B7A42E6591BF7688222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261175, "uuid": "28a37536-424a-4fb0-8e62-2199195c3eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261175, "uuid": "00d7f855-6f84-40fa-a7ab-bf07e5423048", "value": "12288:wJEP78/2iNv73NMigtKKoJbOjdAY8GmevqFoVxCk9Xi6qOeVkPVFQRnnoG:cEP78/1JpMiVNQEiSFckmtqnVkPVF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261175, "uuid": "85f85270-0906-4392-8f51-eb691961aa09", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261175, "uuid": "8a797ad3-b246-4ee8-9f88-10c584d8ab1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261175, "uuid": "796566f4-231a-461b-889d-bb251f745390", "value": "prodotto agricolo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1735d67-bda9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678277231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277231, "uuid": "5b1c7ab5-5dc5-475f-90be-2c1d1dc1ebca", "comment": "Malware payload (GuLoader)", "value": "437cf3e5277a57cb6223bfa1b8366330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277231, "uuid": "9f95bd29-9fdd-43ed-9fda-7ba1ac7028b0", "comment": "Malware payload (GuLoader)", "value": "04e37487ffb37eae4b2c7afc8d932dd002549c4d6e276a51327de2606dbad9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277231, "uuid": "346e87e8-7109-4775-bb12-70bccb5c7c4f", "comment": "Malware payload (GuLoader)", "value": "dd20b1225c45b6917e9d321eeb8c58def5c6476a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277231, "uuid": "4314e329-ec53-40e6-baab-a9f6985ef23b", "comment": "Malware payload (GuLoader)", "value": "724a5984bc80c766364058bf6e7c6119b443b33a104554496144f0f165db03b406727952e3f9e9a48a7828657a177ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277231, "uuid": "0e5b1475-8aba-4eb2-8875-5089f0c57485", "value": "T10DE4229139E1C56FE687D17C0CF58A91F7FC9E600A224503BB2437DDFA3CA4289AD652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277231, "uuid": "37529d99-31be-4d10-8128-433e010353c9", "value": "7c2c71dfce9a27650634dc8b1ca03bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277231, "uuid": "a50e8133-5167-4dcf-b118-8162f6fed1c1", "value": "12288:UFfNPXhuc7Lgc8jR4W7qL4ILCStrKa5neId1EDxc+YO:WfkyGDiXLTrbneqS6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277231, "uuid": "255eae64-7e1a-419d-b641-f25047db0d0d", "value": 700032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277231, "uuid": "ca01060b-b66f-48e8-99aa-ca7596074e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277231, "uuid": "72ae865a-487b-4916-b4ed-5b1d81dd064f", "value": "04e37487ffb37eae4b2c7afc8d932dd002549c4d6e276a51327de2606dbad9f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce7f4ba-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678267801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267801, "uuid": "7f71c126-a0c3-4c5c-b44e-5dfa00c2fa10", "comment": "Malware payload (AgentTesla)", "value": "f2ba6f43d0094d7d4fe1e98659b89776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267801, "uuid": "c257b26f-8d23-4572-8674-f410496e9403", "comment": "Malware payload (AgentTesla)", "value": "054a594169239afd3bfa42b370444dc98b0bf06cf25b26ed506f7b2f747e4f6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267801, "uuid": "4c8a4c6f-9172-4119-83c8-db2a1b8e93db", "comment": "Malware payload (AgentTesla)", "value": "cf384622b2fd52a701573c9d3b4614667f77b083", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267801, "uuid": "d13ce11f-abd5-4129-8661-eec53cfa850b", "comment": "Malware payload (AgentTesla)", "value": "0a6a00b37a05c6bff8206ab6af58de5b71ecac33c23b7d58d54093bf4f09932b2256246be7a299aa33c19f0738f9eab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267801, "uuid": "c11f212d-9fe5-4921-b9a4-51c78ab16ad6", "value": "T15444238B5C032DED269F54754EFB392F71A3282D10D6EBE1214CEF6A881E927C326435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267801, "uuid": "db56c0c0-479d-4f5f-b547-bdf4cbae7048", "value": "6144:FSt4Hst7lG5ILO585VA0Xwc2T/s657NiwTgQRBIT:gt4HsFlGiMiq0AZT/su7A+gQQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267801, "uuid": "d2d4294d-776e-4a1f-a5ea-27434ec058ff", "value": 259216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267801, "uuid": "95bc2fcf-140c-4262-b2d1-8f7452ab3ed1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267801, "uuid": "25bc8c20-de17-42a3-8e96-79704e999da1", "value": "RFQ.IMG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad78d450-bdc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1678290511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290511, "uuid": "ffdc7373-3e4c-456e-b5f0-0f67f5b9c5ea", "comment": "Malware payload (VectorStealer)", "value": "08d33215e41bf247a8f0d9ac6a24ad07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290511, "uuid": "2cac8834-47f5-44eb-9df9-e9958d46f49e", "comment": "Malware payload (VectorStealer)", "value": "0605dae3b82bab080aceb4e8a0ed850098aa93dba439b20b871c4c53a7d50c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290511, "uuid": "361fe224-6b92-4c05-8910-c945179137a0", "comment": "Malware payload (VectorStealer)", "value": "5a51811205a37d4fbb9e5d452c35f48cc886dda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290511, "uuid": "ed987d62-bb51-46c6-891b-0e465a0b809f", "comment": "Malware payload (VectorStealer)", "value": "2eb9cc5ff29a8938610785599f37ed40b3b82cf5ae83f15ed542d244a32a78b2f4307eee7f9abebbed014fdb4ae6703b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290511, "uuid": "fd2e46aa-c439-46e4-b346-9bf3c7adefb7", "value": "T17505F15C22946E6ECD7ED138FC692D58EB78B4774A43E327658260FA2F45782CE042D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290511, "uuid": "2978b1a4-9895-4d6e-898a-535856274def", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290511, "uuid": "37326455-d0c8-4af0-a3b1-d4a323d42e10", "value": "12288:E2mfruorRzLsTzOuN6F7ZY6S7g/m7PHZ/nZEPMV5E9/a4LcG5N5p:XT+Rz6OuN6nLSgg/9ZE1HLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290511, "uuid": "4a5e8519-1bb5-4a73-b28a-19f7a88d9f5b", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290511, "uuid": "3ace27e6-b459-4a99-9ce2-73d4f83db7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290511, "uuid": "a75a6a1e-6ef6-4b1e-8160-cf3f6c09b1e7", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee42870-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289977, "uuid": "dd747a58-d8f9-4faf-8c53-3a83b64f455e", "comment": "Malware payload (GandCrab)", "value": "3ebbc8bc763bce9c935d41fdd0193731", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289977, "uuid": "eb68cae0-ad31-42de-b8b7-b74b8b4191d8", "comment": "Malware payload (GandCrab)", "value": "0607034a90e6e2e2d718f5c1494c2740346d0fff288f15da99ee544f9b6c9c17", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289977, "uuid": "1fe306f6-b9fc-48fb-86b1-aeaed0e39e36", "comment": "Malware payload (GandCrab)", "value": "221d69986a6f03b96fe704605cce73b3861d092e", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289977, "uuid": "d0d533c0-e4fd-4e57-bb54-1ea930b7a155", "comment": "Malware payload (GandCrab)", "value": "75f595fa592d191a67d4b182bf3a08a3829f8f6ecbdcc927bc79c8e37baedf63cd43ba14822f38748b7e3c111187f698", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289977, "uuid": "24e049d9-0704-4c87-8f48-7e1506e48a64", "value": "T195636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289977, "uuid": "91f0c057-b840-4345-8f26-ea6ceb8cc023", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289977, "uuid": "dcf72f1e-3165-43c9-ab15-c5d2e150da30", "value": "1536:jZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Sd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289977, "uuid": "bf3ce6e1-cb69-4264-b12e-a577665e1c44", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289977, "uuid": "b138fd90-39bc-4b9a-ace5-ba9c85cb5e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289977, "uuid": "2139dd71-138a-4490-b538-0f0fd22a2f47", "value": "2023-03-07_3ebbc8bc763bce9c935d41fdd0193731_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e41cb03-bd99-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678270219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270219, "uuid": "6065a082-bb7a-4f0a-8a97-5587cc241517", "comment": "Malware payload (RedLineStealer)", "value": "925ec082e66fc7effcd2801c02fc45be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270219, "uuid": "2e33cca3-352c-47d5-b9fd-7180b133ed2c", "comment": "Malware payload (RedLineStealer)", "value": "073cfa9c393ec523939794ed92996a25d4693a936db98eefa17744a44946eb70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270219, "uuid": "25d4c874-1ea3-452b-97f1-5bbd558af82e", "comment": "Malware payload (RedLineStealer)", "value": "a571c246189b66ba1c73cffe86abdba6a9a1931b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270219, "uuid": "ea508c25-5a4e-4468-a35e-688bdc0345e8", "comment": "Malware payload (RedLineStealer)", "value": "51bf7f65528addd57d0ef7dbfaffe82eb9f9ddedb14dc473933d90f786c6fa3d61cc6ede997b9c7b642399badf3afd48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270219, "uuid": "fc163661-6fae-45c5-91c2-a648318f61f6", "value": "T100E4020253ED7865E1B256712B3CC6F52A1EB9639E3917AF331A2B2F19B0291C533713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270219, "uuid": "be1049d2-b587-4121-8934-1c8a9cb3751c", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270219, "uuid": "17301165-52ba-4365-8ff9-f23a904d7551", "value": "12288:75j3JR3BozEWIinsj8bTpSR3ok6CeYM500olt4iztJ5H:75jDB4minsj2U6kQYMEkiD5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270219, "uuid": "1330f565-caf6-4915-b26a-1a5521300bb3", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270219, "uuid": "49b35a78-655a-4979-bd4d-3a24468a3dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270219, "uuid": "b3292918-c13f-4b92-9aa8-bb8a2c989099", "value": "925ec082e66fc7effcd2801c02fc45be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213d659a-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678309604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309604, "uuid": "38060ed4-97ad-49a9-b3d8-001b087cf670", "comment": "Malware payload (SnakeKeylogger)", "value": "6d72973d1389e540061b30e0f8985f5f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309604, "uuid": "7184de02-e120-4957-b082-3a7a29d3d8dd", "comment": "Malware payload (SnakeKeylogger)", "value": "081c74eaa0425a920ffc337c6113b4106c8dbd527730adc49e8b819de6579988", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309604, "uuid": "738cea7d-16e6-4df6-bfac-d6faa797d71e", "comment": "Malware payload (SnakeKeylogger)", "value": "dc5dcf873897e08bf348f29c29746fefd4a62357", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309604, "uuid": "9b049d50-7c21-4dd9-9fca-a0122fbeb7af", "comment": "Malware payload (SnakeKeylogger)", "value": "495609f7e434de53d89e34e63e89786368825cd164c2cb04850d1bdc24a92cc11f164c2c31252bea8fe62887b816abc0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309604, "uuid": "23ba611a-ba77-4315-ba0d-67c9c0dc7ab8", "value": "T160341204ABE0D1ABD53307B10B3E07BA4FF9A52508B4928F2B215B9DBE77542D50E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309604, "uuid": "ece8e685-7a89-4752-8490-b14b6a752b9c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309604, "uuid": "d7a907f2-c1f4-466a-a941-63232db82bc0", "value": "6144:/Ya6WAtZw7nf5uvY/1CDT0qGRL33HcvV6XwdRc7lMwDE:/Y4AwoteLcWMRco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309604, "uuid": "6fe9275c-174f-4906-a71b-eaee957ce5c4", "value": 235779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309604, "uuid": "942748ac-a9e3-4029-9ced-b2eb4c37ace9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309604, "uuid": "5c3d4e03-4b7e-4b32-a4a0-9e24b54fd89f", "value": "DHL AWB DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8d4844-bd7e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678258672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678258672, "uuid": "831fb891-bd93-44fe-8d6e-ad0aeea67c82", "comment": "Malware payload", "value": "d7fcaadf19e6ba27903d00f17050a4ca", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678258672, "uuid": "3514b64c-41c7-4841-accb-7bab4f36ddcb", "comment": "Malware payload", "value": "084603632959a499a04ccc27fcee4e933c13ac387022ea71708c8176eab54cdc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678258672, "uuid": "354553b8-4e89-4dec-b2c5-8e40426f0e87", "comment": "Malware payload", "value": "ee634466b74d8b5c871e4e078fc3b464db99b38b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678258672, "uuid": "843ae0d2-a952-4950-9027-b8855cc757f1", "comment": "Malware payload", "value": "b055e6423fcdb6ea82cc9681fa5c21403076a676154ac39dbc660ee204a2af8e38a5f12a8366df8e84f23a05c2d8bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678258672, "uuid": "32fd5511-5704-4090-83b9-6f3131366d8e", "value": "T11715E043C634AE5BE012C3BDFA2F3555510FBD3662C2A88A764DB31B4B33BA558BE114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678258672, "uuid": "ace57599-baa3-4334-a8d0-e88c5967be6b", "value": "24576:7LK6Bi1tHlxOWQmmav30xK68SpnacU1GNCma7opT:7LK6gH7DQmmQ30E6BpacU1In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678258672, "uuid": "cd11a11e-d153-42ba-8d70-855011157957", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678258672, "uuid": "e12f2136-04f6-4b45-9d44-aaf8a4f7671a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678258672, "uuid": "8e473e7f-0296-4c47-8e98-9a09654fa966", "value": "Swift Takip_92be67ab-e027-4955-b6fc-64bd720b2ba9.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc44605-bdef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678307155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307155, "uuid": "441b951a-97bb-42d9-b231-9f26da95b657", "comment": "Malware payload (Smoke Loader)", "value": "1688f7ee4f6050cca41219d332c6840b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307155, "uuid": "b74f8443-f5fd-40f7-83fe-dd9a367704a0", "comment": "Malware payload (Smoke Loader)", "value": "087969b4fec1bfae1b33eb26787984ce0f41b74f683dc85e2448122c9e6e741f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307155, "uuid": "e647cbd1-aa56-4aa1-b916-82b94ac0f605", "comment": "Malware payload (Smoke Loader)", "value": "0922adeab045816701173bf75dc9e7fb3c5ee45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307155, "uuid": "940b54d6-ba6b-4086-91ac-cedd36d80a03", "comment": "Malware payload (Smoke Loader)", "value": "5b9cca0fab64bafa005633e256356cc0e76b6fcf819091b2780df482c199163342d380d51fa5bc76e01a09a29f36d7fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307155, "uuid": "eedb3405-f593-4596-afaa-b8f01fdf497c", "value": "T11A148E1293E16C21E66746715E3DF2F83A2EF4616E7BEFDA22245A1F09B01E1C563313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307155, "uuid": "b681486b-9f99-4d88-b306-94e7c262a365", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307155, "uuid": "98676681-6b89-4647-9936-86439ea89e8f", "value": "3072:albbrBoASRlqHfqfiXWdBYyBS0n66nw2bpcGJF:woVRlQzXW/YyBSs66w2C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307155, "uuid": "dd780b9c-9184-4b2c-94c8-4f9bc7d99a9a", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307155, "uuid": "f1ee5d79-b5f5-4081-ab36-79f055837210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307155, "uuid": "04b5ab50-a231-4c9a-b0a1-343eee3a2ed6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5662ff33-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284782, "uuid": "0944e0e9-ed1f-4405-8799-a52ce5bba853", "comment": "Malware payload (Heodo)", "value": "f34cbef2485c4fccea1b92122bddbe55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284782, "uuid": "04cc7869-6d97-46c1-80d0-b583d0481b6b", "comment": "Malware payload (Heodo)", "value": "08ba8a4d132552fec06e45bd1ac9a70f92e5561860b611e5ac99b709d7c40214", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284782, "uuid": "a02d8ee7-4703-4897-a055-6aa4d855304d", "comment": "Malware payload (Heodo)", "value": "2713d5e1af8217356b23726b042a83e5e23c9378", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284782, "uuid": "053b6aac-79a6-4161-b485-cdfef6c138c9", "comment": "Malware payload (Heodo)", "value": "fb63f46979cbc7ad51fd2d869ebfc0f3f4e440c9fa1fb2b434000e488352c9f0ea57309c83c024c0cd9f9e780ea60166", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284782, "uuid": "de59438b-6fa4-458e-afb8-1fe4215c6f7a", "value": "T16515233C5F67790FF5997C362AF3847AFDF90858DC96E90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284782, "uuid": "fc7a6ef6-39ec-41d4-95bc-01918a8adf84", "value": "12288:V4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s1:KevtlkdJe4m19FgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284782, "uuid": "fff4c945-e59a-4502-b8b8-6ab5bb36c6b5", "value": 885898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284782, "uuid": "5be15806-03b4-48ec-89d7-9767b1c34d5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284782, "uuid": "e1015851-9f44-4f6d-81b8-85ba10801ab0", "value": "XM1RAfuLGJskN2JRFXEM90psonhHJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeee712-bd89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678263234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263234, "uuid": "e42824de-2e83-42a1-b4b8-7d99d53619aa", "comment": "Malware payload (Heodo)", "value": "41604c65d3c3b92aec7cbba4deae8df6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263234, "uuid": "7e4733ed-f4f2-4de8-8321-1c8818470068", "comment": "Malware payload (Heodo)", "value": "09389a18b5464aa25c4029351e5fbf22e4dfff309cc08cc6f4b6d5d08a341bc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263234, "uuid": "1f504b11-e557-495b-abc2-593d33021e09", "comment": "Malware payload (Heodo)", "value": "398182536295e559181918105580bc44ec654c49", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263234, "uuid": "76574e36-a06d-41c2-80a1-9db36fe39a29", "comment": "Malware payload (Heodo)", "value": "7e90c385f1a273466f173e5779d534dab705036f5737cec4e50744c837db0290b584c3b58dcfcb7921b47406ee2198d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263234, "uuid": "35962a0e-7222-4634-90db-5afc58200ecf", "value": "T188E40211E66D3C39F0A56B708198A0F6D74856EFA01670B6D07AB003B6BBD672F1B5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263234, "uuid": "6300cd32-daf8-46fc-b145-996c13d76dda", "value": "6144:zJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqe:nbPHom8TYyCT8x5I5w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678263234, "uuid": "09e3f55f-17e0-43ee-ae40-0a19224baba8", "value": 711366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678263234, "uuid": "112d919f-6f8d-4846-b76d-ff3f1c1ec802", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263234, "uuid": "3da67595-5e87-4eaa-9c90-09cc754023d2", "value": "Rech.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bdd938-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276587, "uuid": "e73377b7-22ee-4ed3-bb31-acfeb278c053", "comment": "Malware payload (AgentTesla)", "value": "fe71c0601ee4411b33cf68f48c32fec2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276587, "uuid": "a21724a0-76a2-4f34-a94f-8d394b09bb65", "comment": "Malware payload (AgentTesla)", "value": "0951d41438e1c5b63eab321b9a13935e9d8aee810062508e9cdfff81fa51a40f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276587, "uuid": "fcd2b7dc-97ef-422e-8b7f-5cd3b516fbf4", "comment": "Malware payload (AgentTesla)", "value": "51aec8f35109e14132c71b542dd41ab2c3ced4ee", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276587, "uuid": "1352d1b1-12a5-4bac-ad22-a8e0057b57ce", "comment": "Malware payload (AgentTesla)", "value": "f2defa12ed1ce0f1c2109d7e371bc8fff32bbe70582b5dc3efd37897e342be1d62ff0f5c40075de65a72c2162596ded1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276587, "uuid": "d237cbc2-8360-4b97-98dd-5f968b1383a3", "value": "T1FDD4338D7B4047F03676D62A0458D5BEEDF62A9A46A714ECC06C810C06EA0F87E67D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276587, "uuid": "a4c77e19-0e57-40cd-a032-77692d3680cb", "value": "12288:5kU9W5dXBxDdKojYZ27KgJTfvepaTPgwTFaTJX7rAXoXyRYSl9KUcadKkj:v9W5BBxDdKojR7KgJTfveTwBa9LrAA+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276587, "uuid": "133a6ea8-24fd-420e-ac6f-17da3f13a698", "value": 624056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276587, "uuid": "eda509c6-70ff-43b4-872c-8c53994e9b39", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276587, "uuid": "98a5de8e-8e37-48a4-987c-a971098cd8ac", "value": "Fuyao Glass L460 - Overdue Statements.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0d93ca-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274779, "uuid": "7efb8069-f5da-40f2-9956-da991f51feca", "comment": "Malware payload (Heodo)", "value": "d6c16bcb67cbc6625d016aa6272542ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274779, "uuid": "8adf8009-3185-499d-aefe-e9c53155f417", "comment": "Malware payload (Heodo)", "value": "09ebc05c356dd661127c50f4ad7b538ebe3c9d97285ae29389b427e5d206507f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274779, "uuid": "b87e6d14-5060-478b-b5e8-91278cac24f3", "comment": "Malware payload (Heodo)", "value": "5bed2773f31f578740f9e43c9f24303e27c63a6b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274779, "uuid": "5d133c2b-bad6-4b37-9e46-a3fd0a0ec863", "comment": "Malware payload (Heodo)", "value": "54328df2163c7b4a48232814bbcd968fd7e858c77761e8469d2f46105e76c6185959c0bdc3211e462acd0595bcd26066", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274779, "uuid": "d9cbb870-addf-41a5-93fb-d3754cb4faa2", "value": "T11C15233C5F67790FF6997C362AF3847AFDF9085CDC96A90A17431A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274779, "uuid": "e1fcf6f2-9093-4520-a0b3-6fce2b1f76ba", "value": "12288:q4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sH:NevtlkdJe4m19FgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274779, "uuid": "4dacbc40-2d16-4386-93bc-2d463eecbd9f", "value": 876684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274779, "uuid": "c8a0f7f2-f6bf-4050-b788-e7f1be67c43f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274779, "uuid": "5a69bf89-3449-48d9-a26e-bdf85594ed62", "value": "58h5up45DSBCCH0AxDpgPlyy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6c603b-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289976, "uuid": "3315c3d9-5760-47d4-9255-ad7279a2b84f", "comment": "Malware payload (GandCrab)", "value": "b9bb0a0cff8d16143c50af7c71b22f5d", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289976, "uuid": "3b385cbf-e02a-49dd-beea-6d4e90c953e9", "comment": "Malware payload (GandCrab)", "value": "0a6c62c139aa9baf898add2a10fada3d49f78b3089507b84e613868242e169b8", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289976, "uuid": "aa1dc9af-2581-4946-aa67-74265eac37b8", "comment": "Malware payload (GandCrab)", "value": "89dc77a9ef0294b99ce849c2145f9d5139025480", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289976, "uuid": "54fdd443-0871-4131-a793-dd0ea0b307df", "comment": "Malware payload (GandCrab)", "value": "ce92c61895544cfe2e7688acf95019da96ee50ff0f14874957ec1786c36998f4eaadea9a4996b6f6eb7bf8eff0325637", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289976, "uuid": "7534fe07-8844-4621-9032-00cebf9382f7", "value": "T152636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568120F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289976, "uuid": "859bffb5-b6a3-444e-8a06-bdff81693d17", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289976, "uuid": "2d9fca7e-dbec-4892-8a7f-e22a64bbad44", "value": "1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:id5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289976, "uuid": "caa571a2-6ab2-4b2e-b850-e8873e4bf0cc", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289976, "uuid": "8505791a-424c-49a3-97ec-7e09f9abbb44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289976, "uuid": "c9cf9cc7-01ba-48ff-88a8-35c45530808b", "value": "2023-03-07_b9bb0a0cff8d16143c50af7c71b22f5d_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dae390-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274800, "uuid": "6f2fe150-088c-400b-82ac-edb61071fa6f", "comment": "Malware payload (Heodo)", "value": "4dd6a5881249d7141b2bb2dc68854188", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274800, "uuid": "51c3351b-fec3-4760-aa8f-ba3f9196725b", "comment": "Malware payload (Heodo)", "value": "0ad9026e5c997be4d9f6805c315ccaeed7497e1d9c63be0b532976be59569f9e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274800, "uuid": "941e09de-a825-4c9c-a400-6bbe82168b5b", "comment": "Malware payload (Heodo)", "value": "0283d2c5ab52d9bb87dcbe4b07d98a024b97e1bb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274800, "uuid": "cf3c1147-f85a-465a-ba93-75d5d371378e", "comment": "Malware payload (Heodo)", "value": "c4e2172ab65efa6375372f82fe1f998d0bf5ed54de14f65294b5a71993d50006c8cc39983e1eabe7a6574133131705f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274800, "uuid": "3d54825c-f65b-415b-b555-42c4caf99d80", "value": "T1E805233C5F67790FF5997C362AF3807AFCF9085CDC96A90A17532A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274800, "uuid": "18fe1478-7456-420f-afda-32abe7e11839", "value": "12288:y4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sE:FevtlkdJe4m19FgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274800, "uuid": "11462dff-5637-4e20-9271-ad90f647fdb9", "value": 873691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274800, "uuid": "9b32db52-0839-4d9c-baef-72fa67540050", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274800, "uuid": "e857dc58-3a01-4706-91aa-0702b72ab6c3", "value": "tLdF7bnk45cMk(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474207e9-bde6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678303225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303225, "uuid": "7e11fcf0-99ab-497c-a341-176980d5bf80", "comment": "Malware payload (RedLineStealer)", "value": "291de1df239a0f66bcdf79449e0c69e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303225, "uuid": "6a514571-a128-4caa-a6fa-fe02a46377fb", "comment": "Malware payload (RedLineStealer)", "value": "0afb28c467b02cc9b91cbd45a6b0eee38a4c0c93c11efe7e892e9ae8a0f250a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303225, "uuid": "b347992d-db27-48e7-aab0-345456bb58f7", "comment": "Malware payload (RedLineStealer)", "value": "b10c7730bdc4164222517fc35809d74d80e1ea8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303225, "uuid": "50b2c194-c162-4432-906f-69464b88ae31", "comment": "Malware payload (RedLineStealer)", "value": "116fef729dc76bc7c7cc865a36a7671f92afe0a3a5990ac5d72fe3948a19b6b5999fa59c6a0faa774f624bed6837c7c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303225, "uuid": "fcdae77f-b48a-4313-9e7e-be6dc50a2b53", "value": "T1EE54D00283F1AC21F27787715F3EF2E4663EF5619E7BE69A2224162F0DB01E19663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303225, "uuid": "f9c35bdc-b533-4bce-a6a1-366e7bf425e2", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303225, "uuid": "a8fc4f26-9ef5-49a1-921d-ccd4e0f61d04", "value": "6144:3ro0pUxqp3D84vrrqJD+EP4JERBzeBFj19zPhNCAOZOqWpUNx:seUYIqrqJKy4+WHzTCAIOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303225, "uuid": "3cd03244-4cd1-45bd-a364-cad9ecb51d8a", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303225, "uuid": "3bc3382a-ff81-4e95-a51b-f77abb0c5357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303225, "uuid": "2cdb362f-1c84-4948-8d0d-25c40b54e581", "value": "291de1df239a0f66bcdf79449e0c69e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2559ba7e-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678308751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308751, "uuid": "7549e436-0f07-4147-816f-0fbe85dc95ac", "comment": "Malware payload (Smoke Loader)", "value": "4789fffccdfff47f563788cd503c8e76", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308751, "uuid": "95cc0963-44ae-4bac-a545-ee379e7a3d9b", "comment": "Malware payload (Smoke Loader)", "value": "0baa53972ce2be403f9e5d9d3a7f5d7098858a3acd9e16a315f6e4f5e0b2c902", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308751, "uuid": "f802f163-75b6-424c-b39e-e4fff4226f91", "comment": "Malware payload (Smoke Loader)", "value": "b4d8e0be44a528db5f9eae26cc9c7148d19801a5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308751, "uuid": "6c7c3d58-a9bd-4a6d-90e6-1632267b717f", "comment": "Malware payload (Smoke Loader)", "value": "fec146d5b6ee88c1316fc7496d616830ffd58f658193fadc8607e64182420118ddfaef3b502de426989b74223a22a708", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308751, "uuid": "61226b79-196b-4e4b-ba61-52b1558c1d29", "value": "T177148D1393E1AC37F66287718E3EB2F5263EF8654E3BE6DA22145A1F09B11E1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308751, "uuid": "2294153b-7e5d-4c19-81e1-a4818b5b3113", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308751, "uuid": "1a49547d-e0ae-42c8-bb06-88699d392790", "value": "3072:PwB1lofAqBoAsVJO8mRm6F0W177rG4hFrHGiONKV0vIjjMfkF:OfoYqBOq88H1S4hFrmi+KV0vIjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308751, "uuid": "8ed35525-616b-444e-a203-835c9ea91e41", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308751, "uuid": "967151b5-da5b-43f3-85b6-ce4148f777f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308751, "uuid": "c9d5c55d-3698-47f4-8311-e956209103b6", "value": "4789fffccdfff47f563788cd503c8e76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f60f0eb-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289978, "uuid": "b6feb1a7-170b-4bef-ae41-9e7f8815c0fc", "comment": "Malware payload (GandCrab)", "value": "7bd74c234b2b0a783340f7bc8f273c84", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289978, "uuid": "150827a1-f15e-4283-9dea-305b85484c5b", "comment": "Malware payload (GandCrab)", "value": "0ddcce08b727ccbbae208459032f010956794a84b7f35e225b5bae927b0f6835", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289978, "uuid": "e23b23d9-1124-4caa-b53e-687b9daeac73", "comment": "Malware payload (GandCrab)", "value": "5b55082a53e2f2cf5c4badf8e93da0717bd90f67", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289978, "uuid": "901f7ea8-a946-4d4f-9591-a90db06d85bc", "comment": "Malware payload (GandCrab)", "value": "b2aa10a6cf9213dc5b6bec15240bc36bdf23615860c3309e5f5b934c6d4ae585e5c9bd29834de80b7e9c8dedb470b020", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289978, "uuid": "835f21f2-0a71-48d4-bb85-9e08ed4cfadc", "value": "T1BB636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289978, "uuid": "1b0f96c8-531c-410c-924d-00e4b85dc483", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289978, "uuid": "7aa18f60-2a34-433c-8083-48679215c720", "value": "1536:hZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Id5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289978, "uuid": "4a21947f-1109-42ee-9eaa-91b7ad2046c5", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289978, "uuid": "44fb91fa-ce73-4b32-90d3-20a7566b175d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289978, "uuid": "349c0f86-f081-4929-8503-58c119757286", "value": "2023-03-07_7bd74c234b2b0a783340f7bc8f273c84_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4211101-bd87-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678262605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262605, "uuid": "d61a0b04-31c2-4a88-8475-1c7875adfa1a", "comment": "Malware payload (SnakeKeylogger)", "value": "22f13e167e362e825080526ecb9a351a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262605, "uuid": "377e4043-bfd7-499d-9242-e47d34d27059", "comment": "Malware payload (SnakeKeylogger)", "value": "0e642ba6a80400a3687939384dbbc0a993b5ad11dbc7bccd6a0b00f091878463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262605, "uuid": "ecec8c20-4088-480d-8ff8-47e4a7a22e51", "comment": "Malware payload (SnakeKeylogger)", "value": "ea298505aa86a98def963ced3641ce3715f7075f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262605, "uuid": "1fd4c1fb-7587-4f63-9255-a11e799273bb", "comment": "Malware payload (SnakeKeylogger)", "value": "b4149a617578440da0f3a74d861a5100ed324d22b3e0ba7afa3a94229d9b5f0bc3d36e07ac984bfc244f741b139f40cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262605, "uuid": "b74082fb-0312-4bd7-93a3-7240e23e825c", "value": "T116259DA56F19A257E7C1A1B31804E7B6EBACBD4D2417C0883ED13D8FB1B9D2C1112E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262605, "uuid": "bbeb9ef2-98d3-40df-b951-cfd75922e684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262605, "uuid": "55e65acf-c093-47e4-b044-c6191cbd42c9", "value": "12288:BEX30BVmNUfqBe45ZYsFGU7Szp/HSlCVL7TD14i/lTStXZnsxm3I4YzWsRj:UyYNUfqBp5ysrSlbVL7t/lC2c3Ipl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262605, "uuid": "c0225d5a-060a-4dae-af1c-e1333e7699b0", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262605, "uuid": "1cd663aa-fe7b-48bc-8576-c073b4432dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262605, "uuid": "e774e7b2-5d3b-4e4f-aa0e-a2361c553146", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be3f4e3-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266833, "uuid": "8b38c17f-ff01-4712-85c3-27fe21de9ab7", "comment": "Malware payload (Mirai)", "value": "82f3f2eb1d7025e533b7fa48888c87cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266833, "uuid": "a6479375-0f3f-472d-a159-bd94fc04ca88", "comment": "Malware payload (Mirai)", "value": "0ec1dbd3e8adce86dd230c3f3b04253f0c8350eb9fa471b85c5927d3ebb71943", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266833, "uuid": "66aa9326-d691-47d1-ade2-eb159cd6c2d9", "comment": "Malware payload (Mirai)", "value": "dcbd3bd3f6ae39b48c6dfc1cc803c0d3dae5e432", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266833, "uuid": "36464310-dfd0-4f4c-9be2-71e2f15c6f6a", "comment": "Malware payload (Mirai)", "value": "e77382c7445fd3eda2481ec339f3f0af0492bfd37fa5d8366805f69b72f0c9412a16292f88e63ef2051853a6be2d5a1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266833, "uuid": "0adc06fc-c59d-4d3a-aa9b-17d98296d8e1", "value": "T1FC331B41BC825626C6D0237ABA6E5ACD372173E9C2DF7227DD205B2076C651F0D63E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266833, "uuid": "3e8a8a2f-7fc9-4f79-bb4d-0d504a499705", "value": "768:ZgTbrVG9Kq69xa8cG5ptzlUjiO6odOtOi/h9QSAysIR7NzoCUH9ltohd42n/NcwM:Z2VGEqGYbG5ptZUj9J2DLsc7NMlunG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266833, "uuid": "76c22fcf-8171-4bdc-8215-fd2de0ff8ce4", "value": 52032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266833, "uuid": "c5033998-8371-481a-89ac-64ac354b278f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266833, "uuid": "afdfaa7a-9eeb-4178-b535-24e44b6dccb4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d730a09-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "70afcf8e-9bac-4f84-ac38-17e5885065f8", "comment": "Malware payload (GandCrab)", "value": "6933fffefd94b7e16bcb04a498c82da6", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "ef488b0a-7574-4bc1-a81d-c2c845ff2427", "comment": "Malware payload (GandCrab)", "value": "0f5ace8adbaf1f05d0f5765166537ff4b77ea9f038cffbc08c16afd4cc869972", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "e3325985-31a4-44e6-8359-16ee4aa6f037", "comment": "Malware payload (GandCrab)", "value": "6f4f45bdba6379f7df52326f8754995c28a9b335", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "8f5f5887-291a-4176-83c5-1bf78f8ac1ea", "comment": "Malware payload (GandCrab)", "value": "feac4d89fec3b0fc84df85036eb9408c881972e8c0c1d32348e41aa33e5d359ebc8df2913e2e72ded1b5bc0edb4fa73b", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "e015eb3b-d3ad-4033-a51b-67f8114c9025", "value": "T1B0636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "910ca32f-334d-4bde-8d25-933c47cfd7f3", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "a6864e6e-dc83-4326-919a-599ea58dd565", "value": "1536:RZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:4d5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289975, "uuid": "37380f17-58cb-494a-ba52-3860c1b39f4d", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289975, "uuid": "2d1dec46-57ed-4e82-98ee-67878b608201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "e55da315-dc25-4550-85de-efd3e28b0e08", "value": "2023-03-07_6933fffefd94b7e16bcb04a498c82da6_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8295b061-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266817, "uuid": "36136f80-1fd2-4f92-a030-9424ebf1d56a", "comment": "Malware payload (Mirai)", "value": "4e1b39e6ff6238ccbb5dab6f16ad59d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266817, "uuid": "2681fb23-27fc-43bb-82af-a98b59b6e6c6", "comment": "Malware payload (Mirai)", "value": "0fb5715a29705c1802458277ed5ba2d09fae7871f0a7ac51f17cb256b3a85ed7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266817, "uuid": "f4245175-d032-458a-87b3-e3d5489ecd76", "comment": "Malware payload (Mirai)", "value": "e6d26093b9ebda9ab39c04b229d1b8acd79b08d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266817, "uuid": "f45c13bf-8218-484b-9df4-fade95df70e6", "comment": "Malware payload (Mirai)", "value": "43ecc33cf7faaf773fb5b77b40c0aac12c6ec44d1525e3a3926bc4c477aa493648a17fc0b87639545fbb250f2006bd7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266817, "uuid": "08da7282-ad37-46c6-82b1-a421bed843f1", "value": "T1BF735C07F94180FDC09AC074976FB53AD82274FD0238B2E667D4EF226C9AE611E2DD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266817, "uuid": "1e3ec6e1-4988-4e75-b299-87544e998459", "value": "1536:BRHgwQtdR3O76//wsAVtlJlDLGMAeH2k2gTa4MsFMK:PHgwGdR3qO/jst3lDL/iglMsFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266817, "uuid": "8d132424-58da-4391-a854-19c29f5eab74", "value": 73888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266817, "uuid": "cc7e8b15-8a81-4973-80ef-3ce815c50f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266817, "uuid": "5ce64959-7943-4958-ae5c-dc04483851c7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1d34cb-bd53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678240018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678240018, "uuid": "2cad8d5b-cec2-4fff-8525-a7e6e4caa601", "comment": "Malware payload", "value": "ab7e644322de183d608634fa5f6d2b6b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678240018, "uuid": "34936d79-1644-4293-8a55-e303328f3f8c", "comment": "Malware payload", "value": "0fe19523f658c7e219b24745d694853a8171ecfe9b738c968dfc0e08d6de1c23", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678240018, "uuid": "45dc2826-b9e3-4935-bab8-0808e914cb96", "comment": "Malware payload", "value": "14e81b0c7ac1c76bfe27d5c39c48d1cfa730d160", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678240018, "uuid": "88c9b97a-c126-4d4b-bbeb-6b3949c591a4", "comment": "Malware payload", "value": "99e2327ef7c3792963209e8f8f92b098b930c2acaaae474db194d1558f473adff46af5fadcf286d25c17d78f1ffc5eb6", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678240018, "uuid": "d1dad19e-3c8f-4bcb-9292-1c4ffb081aae", "value": "T10826331A2A4445ADCD424EB0D60F03A1AD656A607EE2D8963B13F1673C783B3FD59CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678240018, "uuid": "89342095-31f8-48ea-b5de-ec301bbf582d", "value": "98304:Dop8nmpc+1srg2w07AWzuSxttbSnnW/Y7oekCDtikQRX4XHfRxEfjQZg3:Dop8ncrsr7w07AUu+tgcY7uCwkQ54XHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678240018, "uuid": "87c5e84d-64b9-4d67-8664-8e873d5570a6", "value": 4505926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678240018, "uuid": "858f93da-f31e-473e-a53e-75d0ae3c00bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678240018, "uuid": "9869f85d-85c9-43f6-abaf-708693422d38", "value": "NF-e_LEKF6UA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218ea810-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267513, "uuid": "351732c4-c103-421b-8854-453e83e820dc", "comment": "Malware payload (Gafgyt)", "value": "7feabca2dc9e6be1184391a9f3a8bd98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267513, "uuid": "5c2dfd2a-7bbd-4b80-8033-f1d6a2d5d040", "comment": "Malware payload (Gafgyt)", "value": "100450f4ef5914547969e806dc14830d861216a2f4ba0c7b29216309826a39de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267513, "uuid": "32f5cbae-7cee-424c-a9cc-63563278aca0", "comment": "Malware payload (Gafgyt)", "value": "77e428088331875f98f3c926757dd2324c1d2ac4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267513, "uuid": "5e971b57-eb26-47b2-ba78-3e5f877b7674", "comment": "Malware payload (Gafgyt)", "value": "5198a7d1252eddc73b8bc8e076c78461bd2459e8a74d4b065961699545cfa05178918a9e8a848e9d90c2c14403879112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267513, "uuid": "301b7742-58fe-4568-96cb-f15fd0b9a37d", "value": "T116C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267513, "uuid": "5c73259e-1190-44af-812e-aa9eca2e9245", "value": "3072:idwracAAviNmLpMQ1xe5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxe5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267513, "uuid": "0657ad04-2371-4f41-bff8-d3a6f57ebfb0", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267513, "uuid": "5a50b0ac-60ce-4918-9ad4-a4ba8b1ed3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267513, "uuid": "323168d6-85f3-4b3c-8c4b-dd4727836154", "value": "7feabca2dc9e6be1184391a9f3a8bd98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b859270-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308359, "uuid": "10e7d67c-d141-4198-abbd-7324d1b05e27", "comment": "Malware payload (SnakeKeylogger)", "value": "b4fd1aec88192329f786b0a8a3328eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308359, "uuid": "b902e02d-5e53-462d-b42f-813f2443700c", "comment": "Malware payload (SnakeKeylogger)", "value": "105564f796b71e908a08ce7cdac01b5e441569cc03cf14293f7e482790ad51dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308359, "uuid": "ee7ca69e-5ece-462b-b60e-12cb137f35f7", "comment": "Malware payload (SnakeKeylogger)", "value": "3c3dd4337fd0574c389872f5ccbc294705838998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308359, "uuid": "f898be71-8c18-4f51-8b19-8e051c368eef", "comment": "Malware payload (SnakeKeylogger)", "value": "55d9fa10da42f8bda1418225f778fb24478defb5e2de5c0bfc51d668e28d45ea4a8576a0eda3bdeaa2ee54add9316745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308359, "uuid": "c1bca70c-94fb-4d0c-b0be-d8c266b564a4", "value": "T1C515CE99B2314533EC8F81794A27C1DF2C14FA4B7611E23B577B7B41E2591BF7A88222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308359, "uuid": "bb473f6b-e02b-4241-aa15-1a6c7f359703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308359, "uuid": "8f30bd76-0ad9-49cf-83d8-ba2cccb79de3", "value": "24576:QEP78/1bxDABeRKWBPJEu5+VqPa4lk/ewXT:oJxUEKWf5+VWi/BXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308359, "uuid": "f21d269f-b990-48df-ae1f-df9d60da1872", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308359, "uuid": "1e2ee12c-46b2-4703-a788-f8a99dc4e4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308359, "uuid": "9a7ceacc-3ea7-4669-98a7-13d87e21521b", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7443417-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678275039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275039, "uuid": "74d10252-6b67-4ff7-aac7-f86092186a65", "comment": "Malware payload (RedLineStealer)", "value": "316a585c060b41dcee1b84769bc58a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275039, "uuid": "15fcabc7-7472-43bc-a17e-52f04db9fbee", "comment": "Malware payload (RedLineStealer)", "value": "109ad4bb0da7071bb6ec2c9250bc7db458b3973ece6769f30663ef2b82d51cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275039, "uuid": "b4323a16-7aa3-4535-aaee-94df66dfd2cd", "comment": "Malware payload (RedLineStealer)", "value": "b90b5632a35f0266110e63fef4085281af12d59f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275039, "uuid": "093bfbfd-d76c-4686-847d-e47bcdefff0c", "comment": "Malware payload (RedLineStealer)", "value": "ffb8c7e0714bcded254603085ebe6888a07f2eacc09a58c58e9d427ce729c7a7b53f0f14b6a4d7472969268c2c619ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275039, "uuid": "d3d7f98b-2dff-4953-bbf9-ad234f8d910f", "value": "T19274750178718CB6F3D7693FF4E228B16223B57F83EE5789420189A71FA51C1FAD164A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275039, "uuid": "cfc88bb2-6c65-45d9-bc85-bd35e59b845e", "value": "3cd9779e209a4934b437581310f3126f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275039, "uuid": "19a55f1e-85bd-43f1-8153-1e5de9233716", "value": "6144:rf5BL0j5BNYDHxvJgzwKJ3PVXX4aXrMXvX0XWXFXwXIXYXEXzXlXQX8XCX/PRu78:r5BLRjzg//F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275039, "uuid": "86e7567b-43a4-4612-b1d9-bc6822793e04", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275039, "uuid": "520dbbe5-13fc-42d5-9114-df205c48d572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275039, "uuid": "2514c1f4-4f78-4843-a75b-83eeb02a3fc0", "value": "316a585c060b41dcee1b84769bc58a3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456d1047-bdea-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678304940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304940, "uuid": "94771ef4-da1f-49e0-9480-4ef75d97a852", "comment": "Malware payload (SnakeKeylogger)", "value": "f7f9221902eedfdb7a72c156180d3a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304940, "uuid": "e56d5d15-0d82-4f48-8518-c6255baedd5b", "comment": "Malware payload (SnakeKeylogger)", "value": "10b51c1b01c212fb397f492f3df0ca4a5847e2350d6df9f58ca50442f9e594b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304940, "uuid": "4e622077-28c4-4b23-9a7e-8bc0b98e3617", "comment": "Malware payload (SnakeKeylogger)", "value": "6a91ffe9ee6ba2b919ee80111c27a1f0251e227e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304940, "uuid": "1be673a0-92c3-4ac4-851e-75f94b716d2d", "comment": "Malware payload (SnakeKeylogger)", "value": "0ada7b20547715904f58a2448c936a0bbb026884eb9f6cbb94091306784ef96fcb79fec4d856c5e51ad641a8556a915e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304940, "uuid": "1c37af16-4093-4803-ad4d-144315426775", "value": "T10715AD57F259AC5EE8BAE730CD86BD54E830B0727202752B75DBC09847ACAF19B101E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304940, "uuid": "aba6fe7b-638a-45a7-a9c3-8bbe649686fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304940, "uuid": "3b88c4db-c416-4d97-b98d-031fb358026d", "value": "12288:Xe3yg84uZ82+O4+siqTUi7huEn2hLaZ56QYZrUDr8wq2vzD1aZrmzt+wWZgQ/:Xe3+zZ8HO40/ilN2h+ZbkUDrDVaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678304940, "uuid": "49a351c0-49e7-4a31-85c9-1e511bda3159", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678304940, "uuid": "0ab0087e-453e-4274-b9cb-1fb1a2ad6c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304940, "uuid": "300cece8-2cef-4369-b2c7-04ac0cab2e78", "value": "ARRIVAL NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92405518-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308934, "uuid": "92b99576-5654-46ae-86b8-27986787cb8e", "comment": "Malware payload", "value": "078fb584923487706390abc1a27a0459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308934, "uuid": "eb19f735-fbfa-476e-b509-6025c8a36aff", "comment": "Malware payload", "value": "10d30f99a7ff28b979466911f5ee0e451156e627682a1d639661dbb7c42c1b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308934, "uuid": "50deb082-752e-4713-8084-3b4199fa85f6", "comment": "Malware payload", "value": "6b76f46309dd288e93d765570d51136ecf7e7792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308934, "uuid": "9f3bed8c-796a-4f1f-9b77-2a5be00b7694", "comment": "Malware payload", "value": "2971cec0b76f08469a1d4023eeb937b8d2f1c35d9f795e7f484911e2f7331eca6198879cc99d8b5f7c8163bc7d81279d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308934, "uuid": "a27a572d-657f-4cca-80ed-68c176d7fcad", "value": "T14824C02172E859F9D67A4130DA235737CBB3BC541928172F12A0CB9A1F3351ABE1EB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308934, "uuid": "22a3f9a4-5ede-40f0-bb31-d0f3c5f9693a", "value": "90292de38e2bd6803e8e5e27da945a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308934, "uuid": "a7c0859c-dece-4899-b062-00264dc45f0f", "value": "3072:xVFE/ZYueQ6059PKEywh8QzEfae1NJLgf7nDVF6PUp1Yo3ICgC:MYue05FhyI8wEHN5gfzDVlVXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308934, "uuid": "6c21c36e-55a0-40ef-b58e-e699447df9bb", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308934, "uuid": "f4a67e75-4efb-4a84-abca-63434d3b5f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308934, "uuid": "d1e4987d-c9b6-4636-b999-da1b2279d79e", "value": "078fb584923487706390abc1a27a0459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b467d26c-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1678308991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308991, "uuid": "b0a0b341-9102-4f57-a2b3-562df682ac60", "comment": "Malware payload (EternityStealer)", "value": "633b0303b31c70c07ee65e0fcc895259", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308991, "uuid": "5dfeaa3f-b9af-486e-83df-ab538ed20177", "comment": "Malware payload (EternityStealer)", "value": "11536d2bcc70ddd7cb41038ab3db2b38ebbe5ce0c7eb2927f93772d63447c3ce", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308991, "uuid": "f4a7f47a-c037-49ab-b5ba-697f5a7b7dd6", "comment": "Malware payload (EternityStealer)", "value": "c00053332bc05a57604147419660908d8ac0da1d", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308991, "uuid": "df444c8f-35c1-4cf3-b69e-71a180df72e5", "comment": "Malware payload (EternityStealer)", "value": "df072c7cbf9fc523d80a8eb4a4a328bc34adb97aae7cd60bcb92bf0852b6fd80069450757fe9fc95aeaf21b396f4d6e5", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308991, "uuid": "58fed3f9-15ef-43ec-8c1d-62e156135119", "value": "T170A5DF3CF8A45ADAE176F7334667E250F7F550F3B301C91678E2888442B4A72A2DE51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308991, "uuid": "16d4c316-2d50-4aaf-9e32-9487fc9b9ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308991, "uuid": "fa8ba5b7-b97d-4616-a565-dce7663900a2", "value": "49152:ajzUCIk+1a7hKVy7fH6PlTooUy9KhJNN38gf:WUCIk+E7h/fBFGKhF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308991, "uuid": "bc246422-c7b1-48b1-9e13-8b9e2548dd36", "value": 2190336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308991, "uuid": "cf48bd12-94da-44e0-bb1a-73d273f92780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308991, "uuid": "cb6b4af8-2a37-4d78-98f6-428d45ebc691", "value": "633b0303b31c70c07ee65e0fcc895259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca78fa2-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678261331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261331, "uuid": "7a67b1a9-af0f-49c6-9d27-ada9f3e8f380", "comment": "Malware payload", "value": "9712372cb52ed98f84d926190f7c101f", "object_relation": "md5", "Tag": [ { "name": "9712372cb52ed98f84d926190f7c101f", "colour": "#B8B6D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261331, "uuid": "ee90c7ed-6d9d-4b2c-ba40-ef6de34d043e", "comment": "Malware payload", "value": "1164914316b77d7cf73b466265a4597deea3159d191d26893db31af8f0b222f2", "object_relation": "sha256", "Tag": [ { "name": "9712372cb52ed98f84d926190f7c101f", "colour": "#B8B6D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261331, "uuid": "fa25a9f9-0df7-4d69-8804-aa50cbe54f8d", "comment": "Malware payload", "value": "ad300fc8e2cf74801ba70a227b1bb9ab870420f3", "object_relation": "sha1", "Tag": [ { "name": "9712372cb52ed98f84d926190f7c101f", "colour": "#B8B6D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261331, "uuid": "9edf6ad6-a32d-464a-8091-06e2adbe168b", "comment": "Malware payload", "value": "28d106b8a2a6feef86effe1a21d29af8472b413f5b469e04c5a525cfdcbcb01fcf96d90a121287a1b1c6eca30e79e44c", "object_relation": "sha3-384", "Tag": [ { "name": "9712372cb52ed98f84d926190f7c101f", "colour": "#B8B6D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261331, "uuid": "912a9118-b9c7-4a53-aa9b-ee5701839b24", "value": "T16CA53307EBE84477FAE24B3445F147831B3BB8A65C68435B2342660B19F25C6E63276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261331, "uuid": "fbf97bde-3a1a-4ad0-b00b-be61e026fc33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261331, "uuid": "0a566d54-6720-4951-b860-4da9f262510a", "value": "49152:DyvXymSXcAy5EdiEucEf09QenQ8mxTPwVa6s/NuklpB:uXQi9RfAnAxYa8Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261331, "uuid": "04c53184-d2bc-4bbb-8ce2-b46ee42bcee0", "value": 2189824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261331, "uuid": "b40f33b4-56a5-4754-880c-c9d9a67f9697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261331, "uuid": "88d20568-df9c-4c01-9848-0ccd7380d8ab", "value": "9712372cb52ed98f84d926190f7c101f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da04d29-bda3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274352, "uuid": "43b897a6-bc78-401d-a70b-e745da909864", "comment": "Malware payload (AgentTesla)", "value": "318041f59cad16180d33cebc17063ae1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274352, "uuid": "573ad02f-d05c-4d3a-99a4-8cf317f72843", "comment": "Malware payload (AgentTesla)", "value": "118ce3f625eaad392eb35e73e16d11b2f5c35f22b34a65cc96b3112ed1c9ab72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274352, "uuid": "c97312d9-3f8d-4602-b050-6a3dfe3cca56", "comment": "Malware payload (AgentTesla)", "value": "2f710c94dc4cd431f06b69b06a490a6b93e76e40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274352, "uuid": "01af7738-4e20-4a39-80bb-f5ba1cacc13c", "comment": "Malware payload (AgentTesla)", "value": "1faeb8ee721d14f393da10341051414694c3388432c168ce00a986132384e05bf00e97ab3c275a3658b268e1ece5cbec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274352, "uuid": "2e241e55-b8a2-4e59-9620-6cb0a1e39836", "value": "T105F3186892CBBED1D32D40F4CDB1111807F2E18B9667E66D1EA168F6BE463C3731AC61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274352, "uuid": "2708c6b8-7500-4b02-9778-d77849fc293a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274352, "uuid": "bdd5f3c1-58f7-4a4a-bfcf-a65286b82808", "value": "3072:Kg6Au/sjyfPfZaEaYhgK1eMhZnL7bi1wPkTTTz961dnBCJIArR:d6AljEZaygBO7b6TTTR6fQOAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274352, "uuid": "84b659a9-6be8-4ff4-9e16-da124f528357", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274352, "uuid": "d8f70195-7cc2-4854-b30d-4983f8fd8c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274352, "uuid": "3a4937a5-84a2-4e98-a8bf-d776783c1f96", "value": "118ce3f625eaad392eb35e73e16d11b2f5c35f22b34a65cc96b3112ed1c9ab72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b168aa-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678303952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303952, "uuid": "1ca8961f-1f18-4927-b612-c14bf6b9f718", "comment": "Malware payload (RedLineStealer)", "value": "83a532cdcf0025e35be7184db230598a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303952, "uuid": "d0d54a95-88a4-4540-85f8-e6f16be2bd7a", "comment": "Malware payload (RedLineStealer)", "value": "12006b38bc7ff086eec3fb35e47bd28867615c281af33735d5a72132faf9deed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303952, "uuid": "65e6c68d-bdcb-47cf-843c-a6cbadfc8a44", "comment": "Malware payload (RedLineStealer)", "value": "56f9e9d42fd98cef33f318025c018aca2a280b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303952, "uuid": "972b3d84-e967-4649-977e-f138ad9dd9d7", "comment": "Malware payload (RedLineStealer)", "value": "6455e288d220018bebc8381cd7ffe722e6c0f5dcced4333db5745f05723f1ce515543bdb3f1f639d68170aa94915d65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303952, "uuid": "7c4e0e66-0e15-4bc7-a4cf-a177070be643", "value": "T1D2556B50B0D093FDF92D1D3284ADC550D53BA92C0B5CA9DBBBA217DEBE2128C8563F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303952, "uuid": "6769b571-1847-442a-a632-185f77c3e8ac", "value": "858cfad24fb5db04ff86c07b8d3d3c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303952, "uuid": "9a066ba3-8b67-400b-a645-165cc576a8e9", "value": "6144:ZHRCtw93p7Xdxmq8dAAOLkNxwVLVkFOMWFBZX7yfYDFczVfox6OCJItOohC2mGpc:ZHkm9ZLLtkNxw9qUMWHZFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303952, "uuid": "050a8e41-8e66-4c27-b050-f98030f7408a", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303952, "uuid": "c7f5593e-e39a-49a5-b89c-691e8f581994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303952, "uuid": "1f56f48e-091f-4a13-96c9-af18315d549e", "value": "pancakeswap-sniper-bot-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0ec703-bd98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678269757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269757, "uuid": "c46c717f-65da-401d-852b-618bfd97236c", "comment": "Malware payload (Gozi)", "value": "ebbe6434b8d6ab9439c69218f6513fbb", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269757, "uuid": "59ab5c5f-1937-4607-a5df-ba765d6064bd", "comment": "Malware payload (Gozi)", "value": "120b092e8d8212a7c0e796ac320dd10c56c8b801aa8fb234cb577d5f0dabc05c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269757, "uuid": "ecc972cc-097c-4e85-92da-641433200ee6", "comment": "Malware payload (Gozi)", "value": "4abb5e3486546ac452b99d3b04079b810f151ee0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269757, "uuid": "7c928050-09e2-4da4-a1b9-705a60b9d133", "comment": "Malware payload (Gozi)", "value": "b97c7a5513bdeef53db89f6da45b304d44e9a13728841c1e6f5fd78cbfdf3b54224c836bd8800aec280b78a6de17b139", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269757, "uuid": "61e38841-03e1-4663-8dc4-ea6189e9ab54", "value": "T18EF05CE0D50A7721C65B16B540E5C774E235A235D6D03143029DE0DF45C1BC88A5758B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269757, "uuid": "6fada86b-5f68-490a-80c1-1f5c0beb4a25", "value": "12:5joBwsu/mOr+TrLml/zqMeLJ2su/S2aHJOt:9rsu30rcPsuqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269757, "uuid": "6f4ec0a1-aa9b-4ec1-960b-b12140868808", "value": 478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269757, "uuid": "2c57cd58-b1d3-43de-92ed-c3a276825015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269757, "uuid": "337af924-218d-4dd4-8e06-02e3e90e52bb", "value": "contratto.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3b81ce-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678270590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270590, "uuid": "6a2dedfe-c960-415b-8f68-d34a530a6f64", "comment": "Malware payload (AgentTesla)", "value": "c4e6210df23d8c36b5fc72a04d91bd89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270590, "uuid": "96a49f3f-8368-42a5-854c-bc811ac8f1ba", "comment": "Malware payload (AgentTesla)", "value": "120de63b8f726ad218289a7562f96160b9a01b5cc62bf98761628b1667502bfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270590, "uuid": "30df5c28-3646-4219-9dd0-1aefdee3430a", "comment": "Malware payload (AgentTesla)", "value": "9a0e48c1fb63bc93d3c56e134f8f037c9b8292ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270590, "uuid": "ee2be8e4-1884-43c6-afc0-5f315fb99624", "comment": "Malware payload (AgentTesla)", "value": "2772859a3e2543b5c623a62d6b4e2d9088d31c4dbb8d77d5be794b68e5894bfbabd024da3751bcbf21406b65769cc384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270590, "uuid": "d68d3d90-0556-461a-8c49-8645cfa92b98", "value": "T17F25AEA56F19A257E7C2A1B31804D7B6FBAC7D4D2426C0883EE13D8FB1B9D2C1111E9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270590, "uuid": "2c682bc0-0471-4d2e-8b9e-97c253f0b4a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270590, "uuid": "f9a3a126-b879-48b7-b510-067e2bc76f00", "value": "12288:BzX3BBVmNUfqBe4EmGlDy+YSmv9GgjawQ5f26qW6ZX8FxGe+9mo6McgLg0NS:dfYNUfqBpE9BzYSZDh5fBqFyePj6Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270590, "uuid": "148e031d-8c92-4c5d-9989-fc6afc1f7988", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270590, "uuid": "f23dc7f9-c820-4b65-bc65-20d13740f882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270590, "uuid": "b98a1939-3bb3-4e02-8464-4559a2286c25", "value": "c4e6210df23d8c36b5fc72a04d91bd89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75bfd8f-bd86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262181, "uuid": "328c5f1a-8673-4149-8abe-db86cc3bc925", "comment": "Malware payload (AgentTesla)", "value": "cfa821715a9871db962010fa982fce00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262181, "uuid": "6c0cf209-bdca-4167-a1ab-e38fac3727a3", "comment": "Malware payload (AgentTesla)", "value": "12acaf892557d5897e26395962b15c7dbdd69d5e446c523e1e2a2ae6a42c1529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262181, "uuid": "d6c7d955-dce6-409a-9bb9-269ea20b15ad", "comment": "Malware payload (AgentTesla)", "value": "fd3a6c35fbd84adbc5f0c45528dca0f5a2ba3408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262181, "uuid": "5e97f495-c3ed-445d-81cf-049fbc19e3a1", "comment": "Malware payload (AgentTesla)", "value": "d2af9d3d7bdd267cbd7577dd3ef8d2621bd911124a093f8dafc62e6770d4f7b16d034100aea2f2144b335a4707cd2ce6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262181, "uuid": "33f8ac26-21f0-4f05-bdc3-67f414f2e53c", "value": "T13BC4120072A44F9BD8F787F94955A62043B26C1E5D37FA691D82A0CE18B3F40AD6BF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262181, "uuid": "b757191f-332a-4307-94b6-65554789e74d", "value": "12288:Hr8YiXalu+DJLA3jS6wqMt7WaaV919bfdhzd7Plpu++M2KtDftWnfJo2:HfSalLUybaV9bfdhzd7PMM2KtDftWnfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262181, "uuid": "c3280272-8d8d-4437-bda7-83ea9054c357", "value": 566672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262181, "uuid": "0419ea36-9f76-478c-84c6-fce1c93658e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262181, "uuid": "38c8bcbf-01f8-4486-9c8b-87616a1674f0", "value": "vGrj2wnIq0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cf2e30-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289980, "uuid": "b28e7ad2-0423-4523-8186-057c6e6eda6a", "comment": "Malware payload (GandCrab)", "value": "69d9a8ca55d981e263da1188bb7c8097", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289980, "uuid": "2cdeed02-1344-46af-9232-fd51775e0ddf", "comment": "Malware payload (GandCrab)", "value": "12b3221e4315f4316195938ce990430ba038f869c8a8f38706b85d93b0e33fb5", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289980, "uuid": "134e3a11-c262-41b1-afea-e83a0738b6ee", "comment": "Malware payload (GandCrab)", "value": "2fad40421f5c17bcf2ed60882eb0b7cdece79cef", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289980, "uuid": "0dc55b78-5c4d-4310-8578-5c5fbb3a0973", "comment": "Malware payload (GandCrab)", "value": "ba6f637ae6254013615eb8ea271f9f3d495823c5e832574829e211fcb18143967a3687994af0ee0b68c71d9561a0a5a4", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289980, "uuid": "5df614cd-93a9-41d0-b1ba-1520ad82b6fe", "value": "T18D636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289980, "uuid": "d11393c6-1151-444f-8afd-bb7e4edc7ace", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289980, "uuid": "35c46ec1-dc23-4de9-ab4d-6a1ea1754d27", "value": "1536:hZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Id5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289980, "uuid": "3571412a-dd96-4cf8-8f34-bafa24a8e742", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289980, "uuid": "34d70bf3-4935-4027-bcd8-e70c789dd921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289980, "uuid": "f4cea4da-17c5-4063-97f7-b4da1412ddec", "value": "2023-03-07_69d9a8ca55d981e263da1188bb7c8097_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226948d7-bdb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678283406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283406, "uuid": "f43d1ee8-4fbf-4233-bc07-fb97dc55eda8", "comment": "Malware payload (Mirai)", "value": "599fb6c7a46f8ebc183cd406fc70e439", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283406, "uuid": "dc4fcc69-1b2c-4c7f-9761-4423bba7fcc1", "comment": "Malware payload (Mirai)", "value": "12d6f12fc49f8e826f17474ff969264f1f01a366fc747ebf8a3b9e75b38d1538", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283406, "uuid": "81014c44-d8ba-4624-bb9e-c694f5d27506", "comment": "Malware payload (Mirai)", "value": "5bfb9062d6c147201c4ace5c3957f7bb6d04ffb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283406, "uuid": "9e3b01e3-7c68-481d-8186-f6e0d1bf7331", "comment": "Malware payload (Mirai)", "value": "72f25539372e5a74e6609c17af47782511ea5889df3e05321f0f74cb743183a5294a1bf5490ceed0b9048819c75f4fc0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283406, "uuid": "38cf6e00-87a7-4640-a5a5-cc5d54fcf9b9", "value": "T1B6A2D019BF28828BC9322E7455D9E9D21293FC72F3ADCC492540C11BF5A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283406, "uuid": "49fc5a38-30e8-4173-93f4-9982596c98f0", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+Zk9aHhib+502F2vwA9dWuMW21bAK1oT0:k98o08kxofBE+Zk9aEbp2F2TWul0c5Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678283406, "uuid": "5f4ea2b8-b13b-4933-8783-8f9bc9432ca3", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678283406, "uuid": "4171de5c-105b-45d9-ba40-2a2ef469007d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283406, "uuid": "72bb0015-c774-42d7-b33f-3d4b6f2a867b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb7069f-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299129, "uuid": "cc621b95-9d65-4ad2-a70a-7223fea6fdb1", "comment": "Malware payload (Mirai)", "value": "6ba20bd6e56cfa09872c2bf5b26277f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299129, "uuid": "baabf1b7-2340-4223-8546-cc7f1d7561de", "comment": "Malware payload (Mirai)", "value": "135df10fa2a83b98ea81baaeae9546611fca03b1bc61029a8d0d8c756a13573e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299129, "uuid": "6cbb110f-3227-4eea-8e82-a3661477f3b8", "comment": "Malware payload (Mirai)", "value": "5df8684830edaf9e5f28237330139f5f0e41a118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299129, "uuid": "56e4dca8-044d-47e8-a1e0-cc59713f97ae", "comment": "Malware payload (Mirai)", "value": "5bff2f84c07e8e174249c764d1c991fd4ea3d4dec676db5f2224db9b037a68320a947deaa5e3429df7058f82a6d8aa42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299129, "uuid": "8814c3b0-9487-4295-ad22-adc43b3da781", "value": "T10AE32B56FA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299129, "uuid": "c50abbc9-ce32-41a9-9649-164fda6869cf", "value": "3072:wBK0/9ARLwh8aJUOwRNSCVpczYr1lvZXUzEM/9sn1QY:wBK0Z8aJUOwRNdVpZnvZXU4M/9+QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299129, "uuid": "d5e359e9-b3e5-4b6f-b35a-4e2b45bd704c", "value": 150626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299129, "uuid": "821f5e32-0a09-4d04-b82b-ccd9cd1b5884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299129, "uuid": "78db5d1f-001f-44c6-b850-0d588d9f3057", "value": "6ba20bd6e56cfa09872c2bf5b26277f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dc290b-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309101, "uuid": "7c3d343d-d2db-4775-8801-8e947af4a7aa", "comment": "Malware payload", "value": "1e844c6de871fc4af1d403054fab16b1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309101, "uuid": "0b215abf-4983-47ce-ab9c-e67b461aa965", "comment": "Malware payload", "value": "13801fe5357092449baf353d61bcf52c37904dc51ae8158092cd679b24696455", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309101, "uuid": "87e5e532-cdc7-4b6b-b260-e4bad47757d5", "comment": "Malware payload", "value": "a665db08dde2c04cffe0c9039a047ae81596db49", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309101, "uuid": "ac895058-ae13-40b5-9913-3732ec2474f8", "comment": "Malware payload", "value": "434e26e99c9118ed4d0a28ea0f49e24633c2a397e5bd10d6252b7bf21319b878154ad557397e04e26c88597e9ea2fcad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309101, "uuid": "026e5a08-1154-4f2b-8176-34e2af960295", "value": "T11B55F10391389E4BE105CBBCBA6F7959110E7C3672C1A8CA354CB74B4733BAA5A7F119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309101, "uuid": "b048a8be-d6c3-4a14-b0e8-2d9c1fc4c831", "value": "24576:QLK8BPtHlxlWQmmav30xNOBDJtHlxFWQmmav30xfZ6FqW/bwLqk106Zqm4Lg:QLK8D7kQmmQ30XOZz7EQmmQ30hZ6sWDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309101, "uuid": "d94a3ed5-384a-4d4b-a422-61775e7cd1cf", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309101, "uuid": "830c826f-8c5e-401d-9b9d-02b9dc52d672", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309101, "uuid": "7cf447f5-c001-4dc5-bc74-c951dc867cc2", "value": "SHIPMENT ARRIVAL NOTICE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff337ae-bd5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678243808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243808, "uuid": "6aef2bfc-09c7-491e-ad60-58452ac174b5", "comment": "Malware payload (Mirai)", "value": "f51cb1b4560362d7eccd2caebf4420c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243808, "uuid": "db960367-0244-49d9-9302-77a3d33b3bde", "comment": "Malware payload (Mirai)", "value": "13ad16820db49445ab28803d550b5bdb41e838c1632fc110b35ae4928d5ae9bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243808, "uuid": "1e6c37ea-9471-415f-894c-341d9916f601", "comment": "Malware payload (Mirai)", "value": "d73a947f87df1db390906dc95da8455cb99cd459", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243808, "uuid": "61cc118d-f8f3-4721-87cc-c5f78240c48b", "comment": "Malware payload (Mirai)", "value": "779b53cd64ccf127f97ebdc88de9b1cb808d34ff219ca1299a7e07c7fe0f85fea7b0770b012063e158a89766358d6c13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243808, "uuid": "16e85f3c-f35f-471c-88d1-016bd7743271", "value": "T140230231890E9EB125303C36DBD5E3937AF126B1C6673123D6180A386F756231E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243808, "uuid": "2c5217c8-cc07-4e59-9bf2-f763d4e12537", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3NAJ9q3UELbUXfi6nVMQHI4vcGpvs:gECFd+A6YHAxN1LRQZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678243808, "uuid": "2bd06041-d4f1-41b7-b310-63a3cb8529ab", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678243808, "uuid": "1a8a6989-8457-4a5a-a8fd-79125c8f8335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243808, "uuid": "73d06ef4-0bab-4627-a47b-b05aacd447a0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e26960-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277807, "uuid": "17c25601-dd32-4967-8548-38aab8b50fe6", "comment": "Malware payload (Heodo)", "value": "96cda0cc962c54fd0b067ddb32935734", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277807, "uuid": "db52db88-f438-4580-a54d-8708e6ecece7", "comment": "Malware payload (Heodo)", "value": "14b1e7ad5210ffeaa8538e3207f1890066bb108d966114d28228dfc281c3c94b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277807, "uuid": "2cf70972-702e-49fc-9205-cf167223e5d3", "comment": "Malware payload (Heodo)", "value": "dba50f54dc1ee34739d70dfe728a3af57e8cb2a2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277807, "uuid": "9893d650-7beb-4fac-b984-a6fbc69f3647", "comment": "Malware payload (Heodo)", "value": "5b7f68312b43bc52162757f9d686fa7013d781b89a68d5656b8d143ebe8e4104edbaedbcfb2b33688a6af78aee93150c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277807, "uuid": "b411c6a2-24c5-407a-8c2a-52747213770e", "value": "T19605233C5F67790FF5997C362AF3847AFCF90858DC96E90A17432A9209AF2056794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277807, "uuid": "73967a7a-3698-42e1-aae4-16e5eb4165ab", "value": "12288:l4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sg:aevtlkdJe4m19Fg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277807, "uuid": "5d712d1f-b36d-42bc-b0f5-0ffbcb69b0e0", "value": 869588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277807, "uuid": "52449428-fbf8-4691-9cbb-8490eb92a1db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277807, "uuid": "245f9ce2-ca72-42dd-bb83-afd15d0f9476", "value": "xhRNphyGIe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf3d9f3-bdb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678281944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281944, "uuid": "6be82852-1200-4fc5-9308-8131c9b6c5f5", "comment": "Malware payload (GCleaner)", "value": "a7d2eaf84e08f5316ac1697bbbd00e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281944, "uuid": "c1281f60-63df-405c-8b44-9a4848b7c45a", "comment": "Malware payload (GCleaner)", "value": "15e8fbd7bf5a5f967c87deaeff5389b9409bdc51a0d75c55d765b2e1b99d9ba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281944, "uuid": "436d7e33-af2b-4dfd-9e2b-8af3fb0bd986", "comment": "Malware payload (GCleaner)", "value": "05b3c914bd54988ce786b39cdc13814d10ef48ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281944, "uuid": "29ca8a82-29bf-4880-92f8-9f9fe244b33b", "comment": "Malware payload (GCleaner)", "value": "1da57d6a3813b45dceeacd18f76abbdbc7d232a8114a6b9b9885ad59c49cf555d2202b967c4fc42f380ab4ba39836c13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281944, "uuid": "8a4d200b-ecaa-4f97-98f7-889876b3dcae", "value": "T16644C00296EC6C21E5325B719E3EC3E56A2FB9A39D28776F32146A1F0DB02D1C572713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281944, "uuid": "f2c432f9-ece7-4183-ada7-b827181ed812", "value": "8a699b19de854b1d45a8cb5567d77787", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281944, "uuid": "cc39cfba-d478-4c97-9f48-ffb88721c4ee", "value": "6144:bbXn4tN/SsGQdxxZdQUV3ruDSsetMF8wV//eA3G:bT4tN/SbQ3xPBKGsBZ73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281944, "uuid": "fa413e25-fc18-4536-84f7-f4c3c35157fe", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281944, "uuid": "a5719506-2d54-46dd-b1fa-6e7047ebf69d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281944, "uuid": "ef599ac8-8d48-4df0-b9f8-3eb11d92b4bf", "value": "a7d2eaf84e08f5316ac1697bbbd00e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651227c1-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248299, "uuid": "d6af152c-f968-49e4-ab1d-e26c3bfc58e2", "comment": "Malware payload (Mirai)", "value": "7b24c3004c59d2a7365e942a75eae456", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248299, "uuid": "834008f8-c19d-4d71-b153-6ee25f50574b", "comment": "Malware payload (Mirai)", "value": "160bc61a72fecffb22302e42ced0558ba67befce81d12bc40fb4935616f38a12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248299, "uuid": "22da76f9-95d3-4aab-bf4b-5f4d4845de39", "comment": "Malware payload (Mirai)", "value": "d98c9e3ffe704e26bb9dd94bfec7d8816ac840a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248299, "uuid": "922e3635-aa43-4d37-ab7f-e7fbcc14e5fb", "comment": "Malware payload (Mirai)", "value": "78822eb774c7fab1940ffaba73e9845bbba4d135d186683034cc8f5395182c33a9b27eb2257d2aa1c41f9f5fe50b642c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248299, "uuid": "1f3faccd-5463-4b28-8f05-bcd844859974", "value": "T12E632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F203BC696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248299, "uuid": "29bf7b3e-75eb-4aa8-9919-da4a5fa658a2", "value": "1536:SNSlxwmii0l1UVOOY/kWsj77i8YHAs78/NRuJAvLWgR:SNvybLtP7i8YHvOFLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248299, "uuid": "9451eee2-fd1a-480c-b31c-72f68d5b899d", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248299, "uuid": "bca60d33-82bc-4531-b7b7-c45b4701a7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248299, "uuid": "e2aa4f80-f363-4721-ac6a-5da065877a49", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289a7112-bd60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678245621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678245621, "uuid": "8f0e4ee5-90ec-4380-94dd-98a9274f8a8b", "comment": "Malware payload (RedLineStealer)", "value": "9992f64c18ad33acf10daf78c3f96beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678245621, "uuid": "48772cd3-f1b0-4779-90a7-5227ade69757", "comment": "Malware payload (RedLineStealer)", "value": "1670e8390a0d65edc5f7bf18568d692d88761f03a9d2e447652d9455b69826cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678245621, "uuid": "91eaf45d-e8d8-4354-9be6-7c6cca95011f", "comment": "Malware payload (RedLineStealer)", "value": "d0d507e7b977b9c16e1ac23b709aac2f338f060b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678245621, "uuid": "cea65e03-058c-4f55-9592-99438f7f68c7", "comment": "Malware payload (RedLineStealer)", "value": "721c07e3630eece1d39a130ce183cc1877201c72caf1431609d3c5bc810fcbf1f982527f220c78babb51fef12a57f50c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678245621, "uuid": "f83fa676-e0e1-447b-9bc4-c1ce6a8775c6", "value": "T162362333111504C4F1F4CD3BB967FCE871F7432A4A936C7BA96AA8C63A291E4E613953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678245621, "uuid": "4321c098-001e-4c1e-8825-995565f48f84", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678245621, "uuid": "73304f59-f3e5-4bdb-844c-ce951f266e57", "value": "98304:tD3+c2j5aLZIsnFFGPG2T9yH58ZBEE6wKdPUF:Ic20JnkryZM/Kdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678245621, "uuid": "87683710-673c-4dd7-9b7c-57cddb4c40d4", "value": 5176320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678245621, "uuid": "2e17fb7d-4433-4a65-b5b6-9a25942eb548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678245621, "uuid": "d190760b-0b10-4b73-928a-c12a2a196b99", "value": "9992f64c18ad33acf10daf78c3f96beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31524ec4-be02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678315214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315214, "uuid": "276e0f8a-b7be-45c8-a690-054cb4b267d7", "comment": "Malware payload", "value": "d048fa80ad87ee99a7181bbe56526a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315214, "uuid": "0cb2a352-7eba-4286-a09d-61c4545fcde3", "comment": "Malware payload", "value": "169d11d066220e7eed9b0f19114f263b9e89fd379124faf4b5ac41934b4d19a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315214, "uuid": "042a81b4-e14f-4d28-8f94-e4cf55f23587", "comment": "Malware payload", "value": "545da6e519c56d3ff36a1b165c2ef90ef760210d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315214, "uuid": "a8ab9f32-b915-4f1f-bcb7-9ac88049a936", "comment": "Malware payload", "value": "079c313c9b30b98df0a8178f0e579e975292947a4360f1be4221910a6b2275d1c665dd8f3920607168bc80f25ba95ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315214, "uuid": "afab3688-6667-4b8c-9706-14a3d43a941d", "value": "T1A0C3D01052D0D827D8A24B3174B87E779BB6DD2196745F8303207F587A3EE81AB2E367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315214, "uuid": "0cf105b6-78b0-4bd2-b616-a1e097064fb1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315214, "uuid": "b7102691-2fc0-40a6-a896-4a3a1053d5f8", "value": "3072:qbG7N2kDTHUpouk4m9bwt1AIoPbPzy5n+7bO9x1:qbE/HU84m9wKPbry5nga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678315214, "uuid": "ef763245-8916-472d-855f-0fe430496a30", "value": 122712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678315214, "uuid": "7a8fb151-ff7e-4b72-a12d-4b5188ff8df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315214, "uuid": "b52feddc-4a6b-4be6-96f5-7d0b9e6bd524", "value": "SecuriteInfo.com.Trojan.GenericKD.65799585.1655.16522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6caf1d35-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678303717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303717, "uuid": "7d2a7c09-5fe8-49fb-af23-8172467c7ef0", "comment": "Malware payload (Smoke Loader)", "value": "5dc32988e82a3848378ed43eaa0803ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303717, "uuid": "359e9f72-57f7-4fce-aaeb-613c5ace1e91", "comment": "Malware payload (Smoke Loader)", "value": "170dd3abe427fc961d381ffd472d1c19c0a5c2943339e820850b09017adb0393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303717, "uuid": "b9dac2a8-3a00-40fa-b31d-b4922f468f91", "comment": "Malware payload (Smoke Loader)", "value": "89b37e43e33507ebe2e9656dc616b14527c3d1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303717, "uuid": "0a4d44ce-3611-466c-96f3-d093cc507617", "comment": "Malware payload (Smoke Loader)", "value": "a1282bb0d4875208275248a597d78f575b5eb520f64f3bda533524b9e66fceae14acf967ebd2173fae873769cec84b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303717, "uuid": "6ebcca90-05c1-418c-baa2-6c16968daced", "value": "T114149E1293E1AC21E2674B795E3EF2F43A2FF8614F7BE79922145A1F09B11E1C563312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303717, "uuid": "93779c36-a048-4aa2-9fd7-72081ed4c524", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303717, "uuid": "6d49d093-c38f-4797-964e-e062ee750768", "value": "3072:zbRgeOosqTLxiASTxxzpagr5sQJcs0Rlx+diMPiajUkF:ZgrotTLxcxpk5wt0QdliM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303717, "uuid": "0df4406d-72ee-4980-889f-bd909116498e", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303717, "uuid": "02233d9e-fbc7-43e7-b5a5-2b8fd6000026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303717, "uuid": "e2e066e1-72fe-4f06-8a79-74000f36339c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932b0824-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678310654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310654, "uuid": "e40f639a-7464-44a6-b5c6-4f23d85f4d4c", "comment": "Malware payload (Amadey)", "value": "7b4ebf09cf37a88ab510a9fc4657f15e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310654, "uuid": "54db8767-3292-4426-a7bf-22e7c131a5d6", "comment": "Malware payload (Amadey)", "value": "1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310654, "uuid": "80d8b2ab-29ca-4413-8670-342550c61358", "comment": "Malware payload (Amadey)", "value": "17fe7c8f1197359f0593bee491bc502debf9773e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310654, "uuid": "14e1bfbc-72e8-4a12-a8b6-f818b716bf75", "comment": "Malware payload (Amadey)", "value": "274df7eff509f5a3e41de1c8bd8a0ae8c3d01288599fceb709e2de5f3942ac8fb6cfc5ab06a50c79a9de565e24169fad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310654, "uuid": "d3b2b2ff-277c-414e-8e75-51633b966d61", "value": "T119357C1BA26601BCD4BB9178CA274A46E775744603309BEB17D05AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310654, "uuid": "81d83319-0e1c-4484-87f5-37c4233a0b75", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310654, "uuid": "8d7e58a8-ced4-461e-b430-8d8b2b946e36", "value": "24576:iMq/RX0hoa8wrC+azFbtZhUYFauTZyRMX3:iioa8wrCHz3ZhUYRAE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310654, "uuid": "6a9a3936-5326-4fab-8206-9635a541b1f8", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310654, "uuid": "36cb0bf5-18a3-4e0d-a8a6-a80c1e9ecd24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310654, "uuid": "b8d40d7c-f373-43d1-907c-38144d3a41f6", "value": "7b4ebf09cf37a88ab510a9fc4657f15e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbe2266-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284684, "uuid": "95556270-6036-45be-8327-8d4587991308", "comment": "Malware payload (Heodo)", "value": "1cd95016fda53db5ed6b3e041f6d0fc0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284684, "uuid": "b6359722-a5b9-4f4d-8e64-ffb99227a400", "comment": "Malware payload (Heodo)", "value": "187b9d905db44f0d4d8ef39fa78c123a80e6261dea5744f1e6791be83a9f908d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284684, "uuid": "59035e5e-82cf-43b8-a038-680154d087b1", "comment": "Malware payload (Heodo)", "value": "23717b4e448486371e8fbd18ae37c86c1dcf2fcc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284684, "uuid": "af665f42-0c6e-4079-b4d7-f09e0ecb14cd", "comment": "Malware payload (Heodo)", "value": "5c341a521037ad50008adc79cabaef7bbbd828719dd3ed40ac9babc2c2daacff3d10f2e81e4877ad5980f10fc66165df", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284684, "uuid": "9c291e37-4cff-4b4b-a05a-9a05938dcfb1", "value": "T11D05233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284684, "uuid": "7376274b-94a3-447e-af66-6849e0e0f6f0", "value": "12288:34DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sO:IevtlkdJe4m19Fgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284684, "uuid": "74f587af-7947-4ddc-b96a-953584b5ad70", "value": 866536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284684, "uuid": "477cdd28-9bf2-46f3-a387-d85d4ef63745", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284684, "uuid": "dfb159a0-5a4b-41ca-a125-c0b7236a283c", "value": "ys486XZP0xKvBff(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29a7659-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309069, "uuid": "08e4a126-2a1a-4f80-acd8-82cc8ceab344", "comment": "Malware payload (AgentTesla)", "value": "0e460b781352fd4125a119637a069bf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309069, "uuid": "26b55920-598c-4b95-97d0-339ad74cc38e", "comment": "Malware payload (AgentTesla)", "value": "18a67faceb538ebfb7af84c177e16975b48e0a99d5f97528557a517bed5135ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309069, "uuid": "9663b11d-ba9b-4b3d-b850-c77faeda3baf", "comment": "Malware payload (AgentTesla)", "value": "aa7a386dffdc3ea7fab9157da5902b94817558b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309069, "uuid": "9f7da376-ecc2-49d5-b02d-c28a56b23f25", "comment": "Malware payload (AgentTesla)", "value": "c8d58ccea50a69642f113e55d6b40922ccc35b1909ccef87710ca844fbb57bc9f0af8bc9b965a9804617ab5b98e782ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309069, "uuid": "810e483e-c31a-4a8c-919f-f885ac0490a8", "value": "T1E355F1039138AD4AD102C7BCBA6F7959110EBC3671D1A5CA364DB34B5733FAA5ABF108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309069, "uuid": "fa514bfa-a442-493e-89e4-710b76f44847", "value": "24576:ULKeBntHlx1WQmmav30xZvBs0tHlxwWQmmav30xJ6FIa8hx0XEM:ULKev70QmmQ30HCK7FQmmQ30X6WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309069, "uuid": "94edbd6b-7f8e-4c63-9202-d607d3350552", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309069, "uuid": "2334e6d3-b8a5-443a-813c-f0ed5186e358", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309069, "uuid": "fa46d57c-a2f3-42ab-92c4-6c87cd11cf97", "value": "Inquiry-457-JPY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d957138b-bddd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678299605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299605, "uuid": "8ce47b5e-136f-4275-a1dc-aed42d45cea0", "comment": "Malware payload (AgentTesla)", "value": "62c2fe82c0e9e0a6e68fc2a1da63b3c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299605, "uuid": "c9bd3149-f4bd-4b90-a178-c1f514818b86", "comment": "Malware payload (AgentTesla)", "value": "18dc0c7dd6e62d0eb7a1a359bd7e0d4ff49f3af676d2b23c2133f479ff144a5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299605, "uuid": "eabf5e70-8737-4dd1-9dc8-8a48107de577", "comment": "Malware payload (AgentTesla)", "value": "51c58cdfe70b76982b99156e8e18ebba27611237", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299605, "uuid": "c18f960d-0a35-44a1-8ddb-7647e3965838", "comment": "Malware payload (AgentTesla)", "value": "cdfd8a32e146930161162c6cb7520555783bb24d208bb159aea71eec2fb8770af033bdaa79a91d2689946030f2068668", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299605, "uuid": "32b6af4b-2b63-4ea9-b93a-9ee3eb9f0afc", "value": "T1AE94237ABB1FE4AE75D2390EDF11AB9028A82E150708368C14F61571FE860AFD6F6135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299605, "uuid": "5c578feb-e146-4fcb-be4c-125b173e8dff", "value": "12288:qiUZ4amtjTxe8FReNy/qKsqvyz69d+qMf2rgS:W4/t5e8FReNZKsqK29MRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299605, "uuid": "0faf1e6d-d6cb-4f84-b4d8-a45fee0b2605", "value": 448456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299605, "uuid": "aeb11ade-4c4a-433a-aed9-c69301d90ac8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299605, "uuid": "cb8a3c9f-a6d4-41f3-9435-8b216a41b586", "value": "PI_08.03.2023 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d054936b-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678278115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278115, "uuid": "ab0aed01-4b73-4ac8-8f54-9b5737dcc6f5", "comment": "Malware payload (SnakeKeylogger)", "value": "c361028b8a49cb6686572effc5f18bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278115, "uuid": "94985001-e029-4144-a43e-eb81e91aa21d", "comment": "Malware payload (SnakeKeylogger)", "value": "18f55a945ae83f15c75eb486ff1bf45c423bac4fe7ab87a289844a5181fbc285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278115, "uuid": "e269e6df-b730-4e55-8d39-e5672c71fadf", "comment": "Malware payload (SnakeKeylogger)", "value": "29deb9a6282aca784e1c31d734f55971e30eb4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278115, "uuid": "154c471c-fd46-4476-9fdc-a1f261f73756", "comment": "Malware payload (SnakeKeylogger)", "value": "2580be7b4b7cbc96adb2f1b12a3a99c5d136c9d6b65c35900757757df26bda06f0600ea1e675b4f10f87e0ce716809f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278115, "uuid": "f3292370-6fc3-42e5-bb32-3867af6b63b6", "value": "T11A05CF5972B15463FC8F41BA192BF29C2D7171433365E23B5B3B3AE1E6119BFB288601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278115, "uuid": "fd563456-8ea0-43e5-a223-8d8ea6fe4654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278115, "uuid": "8dd9a9db-99ba-41d6-b72c-692bbbe9cfd0", "value": "12288:ya/5u62iNbJql+x4lGcpRZL9vQz0/Jm0q3cpwa7RQ98UJ6bx:ya/5u61tkl+xIR5pvP00qM3O9hJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278115, "uuid": "a9127459-8810-4abd-8bd0-8172e3b979d7", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278115, "uuid": "9986b5f1-5c13-4a31-9476-e11a8f23379d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278115, "uuid": "84ff388b-ffef-4af2-9683-2d5819cc213f", "value": "MT103 Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf1c029-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309623, "uuid": "eec4df3f-e0d8-4e85-a68b-847562f8fd22", "comment": "Malware payload (AgentTesla)", "value": "c642796ae4f15a91db45d41939e174c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309623, "uuid": "4bb1187c-52f3-4612-b074-276717c92613", "comment": "Malware payload (AgentTesla)", "value": "191d0aa37225c04908c0d3503ca7faa81afec28c28528ab0eb23eab6f003651d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309623, "uuid": "afdfba36-bfe9-4b8b-a4cf-b084796b6b93", "comment": "Malware payload (AgentTesla)", "value": "55c97dedaa0ff75ed5f207db33df9626084259db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309623, "uuid": "413fb4a5-13bd-4324-adec-5152dc793639", "comment": "Malware payload (AgentTesla)", "value": "17215b45c06db2610db680c75fd72fe8e096115f3d321dc92b6f402b44e719fd1e5b2546fafcdbbb20dc63f5deb322d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309623, "uuid": "8c6ccd27-8a98-44af-8757-c05d81094df4", "value": "T1AB15CF99B2715133FC8F81794927C5CF2D40F98B7611E237573B7A82E2591BF7A88222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309623, "uuid": "fe5b608c-20c6-44dc-bdf7-99fdf117cf39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309623, "uuid": "66009861-931f-4499-b31f-86ec2b01f86e", "value": "24576:9EP78/122Ur8PP76SIT9O5LSNAxI62l7LOI:dw2UrmP+Txb89g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309623, "uuid": "4e3746aa-2393-48ed-a380-cea7e8e06fde", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309623, "uuid": "9aef891b-a455-4946-b1f2-7c8eac14a91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309623, "uuid": "7a591ed0-cd42-4751-9e62-c8ccce572e6b", "value": "DHL_AWB_NO_#AWB 2450847453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd29950-bdb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678281040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281040, "uuid": "ef844e8a-857d-4827-b26c-432583f21e47", "comment": "Malware payload (RedLineStealer)", "value": "f4006c4e6f3575eb5dd28d933e787962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281040, "uuid": "1099b3e1-e8b4-433e-ab28-a084b5a6d0de", "comment": "Malware payload (RedLineStealer)", "value": "1a05e9fcc4a4f16f3dff7e6447847604eeb050fb0f5eb96aeddfdc2069165f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281040, "uuid": "f6c03884-0757-4002-8f12-cfe3b5e7393d", "comment": "Malware payload (RedLineStealer)", "value": "b8b8c2ff9434c35ec4cf9b3be3cf51dc2c69bb9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281040, "uuid": "21fa1407-f6cd-41f9-8d9e-735f1b64f306", "comment": "Malware payload (RedLineStealer)", "value": "7c14e92e8aa89a7bb93c9062c4b1cb2f61e977de8c8ae06c0bd9dfcfad62f2ac27faa24f1eb40e73f381d150fcf41ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281040, "uuid": "ec1a611a-e280-417c-9430-d82639bf244e", "value": "T1FB64C00263AD6821F5765A719F3DC2F42B2FBD638E3936EB22146B1F18702D19673712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281040, "uuid": "8de5210b-10fe-4186-95ea-1acf81c46ad9", "value": "2115960edb01d3d9bd07271fe70d5d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281040, "uuid": "225f56d8-eb28-4506-ad3d-f902f0cf9ce7", "value": "6144:+gpXOYsaKT8L2scYKROO3mEIGUFnc/Hzd/VGcvaJLH+de2LFbZ/:vNBsaKAXxa3n4ytccvuHiFxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281040, "uuid": "22cb0874-b654-4b94-8fa3-857a6bcc4092", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281040, "uuid": "19604212-2416-4c08-98f4-e67df5198f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281040, "uuid": "4d4448a4-fbd8-4f23-9594-355cf472352d", "value": "f4006c4e6f3575eb5dd28d933e787962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c8b83b-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284705, "uuid": "0c9db0e9-5e1e-4d23-99cc-1794ee6d3c25", "comment": "Malware payload (Heodo)", "value": "d09e093d27212411acb482a2a9b7d95c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284705, "uuid": "37830500-dda2-4437-b33e-576c310ffadf", "comment": "Malware payload (Heodo)", "value": "1b85c8baae5056a3f8ae34421db4064d193cfd71acf67c70b44afea177a59858", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284705, "uuid": "7efe1fea-581f-4bc7-9325-393e27317c4f", "comment": "Malware payload (Heodo)", "value": "69ff27ed426438d57ebc6506dd9027bd15940147", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284705, "uuid": "0610062d-0f93-462e-aa19-e4b8e2c496d5", "comment": "Malware payload (Heodo)", "value": "88b6da4f55dd9a8fd42d98d5d4a20a6cf2418091c6c7177960fa20d5375ff1ab02c8e90452c70516bd8c84d2e674f282", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284705, "uuid": "ebfd224c-7745-4846-b91f-713e2d1b124f", "value": "T12215233C5F67790FF5997C362AF3847AFCF9085CDC96E90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284705, "uuid": "276ece13-3cd7-4888-8993-ec11a7c93172", "value": "12288:O4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sc:5evtlkdJe4m19Fg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284705, "uuid": "dbfbd754-b340-4f6c-b2a2-22a1736b82c0", "value": 882808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284705, "uuid": "698b1122-611e-477e-bfeb-6e4b06e978e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284705, "uuid": "ef96e169-189b-48e8-ab16-cdec217f644c", "value": "B33szwF8(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fd00ae-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309393, "uuid": "9a56cefc-77c3-4ab8-a1d3-943d1376d13f", "comment": "Malware payload", "value": "d7e4fbb654ceeff3fc64df813fbd17c8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309393, "uuid": "9c84a0f3-1d40-4810-bedf-8eafdafc3ce1", "comment": "Malware payload", "value": "1c26aede6afd12f6f4a1abadf43220ced6a51fa437f8a7c0ad9b00f4d3f3d324", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309393, "uuid": "979f7aef-91bc-4a06-9d03-7458cc8502c4", "comment": "Malware payload", "value": "2c5fd3eae8877fd52ba884c2af2fd646016309be", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309393, "uuid": "daefde1b-d4fd-4f06-a6a1-55d12aa9f3e6", "comment": "Malware payload", "value": "75e5a99aefd4ffaf51f24a3caeb3ab961a97ffbaecec772d9d543bafecf86cad4c9bd7a9a979defee13f1c1f98dda438", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309393, "uuid": "eb8e2085-7c91-4184-b9ba-fb1cb7314bd7", "value": "T142457C60CA1A26194E5F2B9AED820D4584BDC83942374939FD9E23CE750369CC3BFB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309393, "uuid": "b40182e9-5419-4ce9-a523-ac4b38df352b", "value": "24576:4u5/AaM/dH/TpQKKssZpLKtAWSQjM71zonO7jE6OaL:Vmp78nHKqAxaEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309393, "uuid": "05340080-17a0-4014-ba71-ef8e765c7923", "value": 1180016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309393, "uuid": "18d04b88-42b0-4516-9035-ae474af158fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309393, "uuid": "3e3ee6fa-3f5a-4d2a-b59e-d0737dcc1abb", "value": "Factura de entrega.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe7daac-bd72-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678253659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253659, "uuid": "aea8810e-964f-49c0-876c-3a8706afa549", "comment": "Malware payload", "value": "6ef64f8a06d49a93a14808066a4a2829", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253659, "uuid": "0c3eecc9-dafd-4aa4-bade-93fb2327f5a6", "comment": "Malware payload", "value": "1c4d9ea008e43baf6b0d8b1b2264313185dcd8a1a78de3ee3c71563f8083b6b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253659, "uuid": "a62ec3c4-9261-4f47-a558-27b2c885c821", "comment": "Malware payload", "value": "91bdf718ddbcaf7c3c245d6e7d003de381302930", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253659, "uuid": "0573a3e5-8df9-44fd-9c25-0148e495c5b6", "comment": "Malware payload", "value": "37b14ce196f8bd01474a1835dbe88708bbbdeb2e614f744dffe40dfe1d76742d7e55553271336777f03f6b836726fbc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253659, "uuid": "c0be20be-fc9f-4a61-88d7-baaca7b45e32", "value": "T1473623B39262015ED5C9DC399637BDF571F603278B43FCB4A5992DE626220B5F2038A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253659, "uuid": "bca78699-94e4-4e75-920e-52ad9057f4bc", "value": "cd55e5b024486f2eeb25bd5ac3043912", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253659, "uuid": "12a52e2e-70de-4845-85b5-b3dc1145db4d", "value": "98304:AHqzr/hMf+StJFW5J30/kOB+o5uB8hV0Quhzfi5MEcPR1x75MFPB:AHqzr/hMff/W5JhWRu+ifEqd75MFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678253659, "uuid": "86182eb7-de61-47be-be24-65a515960d7a", "value": 5021184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678253659, "uuid": "286f4617-0e48-4197-a49c-471bb2fa7240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253659, "uuid": "a8fdeea4-0b35-4b02-a3f4-4a96319fe9a5", "value": "lmd.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71048d5-bdd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678297051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297051, "uuid": "71440940-176a-4f8c-93e4-9cc04faff605", "comment": "Malware payload (AgentTesla)", "value": "69b2e1e1f59d2f99be41767cd6cd5500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297051, "uuid": "6a9828b7-7036-423e-ab74-8009509936af", "comment": "Malware payload (AgentTesla)", "value": "1c83206073dde5d3a78ec0cd98f52c764f520737a88c2f3e255326c9b328aa76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297051, "uuid": "c9788ab1-a630-4488-9085-049e5107e9cd", "comment": "Malware payload (AgentTesla)", "value": "89bc718c37fc2c323e29bab2dc402e9e8f4d3790", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297051, "uuid": "5c29cb3e-6cd4-449d-a0bd-dde7ae8251b4", "comment": "Malware payload (AgentTesla)", "value": "aa86cc0f3bba3a26f619134e5cb6a1dd380b3c91468e57fd4e3a29e5074484d3d3571489261e8001826cd48faea019bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297051, "uuid": "0e20df03-315c-4e25-b963-a9dba0143e38", "value": "T1AA15BD57F249A81EE8BEE730DD867D44E830B0727216B51B75DBC09887ACAF19B101E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297051, "uuid": "b5b48202-4469-4ed0-a625-5222715c120a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297051, "uuid": "b674cb47-38be-42a5-9758-1329ee470f5a", "value": "12288:Ne3yg24K+JfeJujH6MW2YDjw9TCT1yfBj0t26BBi5+obRhH3iXJpmyLG:Ne3gLJujHE7OTo1wBjq26BBEnniX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678297051, "uuid": "a6376c7f-ed8d-4466-9b90-ef783d3e7712", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678297051, "uuid": "c6057e3a-964e-4eab-9507-93a588022243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297051, "uuid": "f0d3c17d-f0e2-4143-a443-86b7f58a5ff5", "value": "rPaymentConfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141cae03-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267491, "uuid": "f3c05f26-b4c3-4629-bf2a-32b176d3410d", "comment": "Malware payload (Gafgyt)", "value": "afd7aab4f33849423ae9686caa67a382", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267491, "uuid": "f2ca4eeb-e132-4fa5-9cdd-6ce478b6fd14", "comment": "Malware payload (Gafgyt)", "value": "1d31a2dd4ada22304aca3c1c5a962e2bb62e1328424bd459ac834718870f92a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267491, "uuid": "1d75a1f7-2fb6-4dc0-8a32-deb32e7c655c", "comment": "Malware payload (Gafgyt)", "value": "e4e7b7ac68ec3f0d9c530e656edb08cfb9497d17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267491, "uuid": "780b61d3-682f-4f66-8757-b238860049a5", "comment": "Malware payload (Gafgyt)", "value": "989d9dd5272d80eef803f61022df9e3a0db7ab3426bb064e55af74524f607ffcef70c59ebfb5e9814924b3415bc4509b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267491, "uuid": "2ae93764-a3c6-4c6e-98bf-016a6f27dba0", "value": "T1AEB3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267491, "uuid": "5e6dee6e-b80a-4e02-a813-bc2ee317325b", "value": "3072:C/4g3Kd1r25hZmxgA9OKdwwjF9GhsR1Ae:O9an25hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267491, "uuid": "a57c676d-babe-4f05-9f6b-89eba62e62be", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267491, "uuid": "91cb9f21-79a3-4c75-b608-fba407f51564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267491, "uuid": "96ed0465-c2cd-49f9-a2cb-685183565edd", "value": "afd7aab4f33849423ae9686caa67a382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136be421-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678275650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275650, "uuid": "3dcf28fd-bc37-4687-9617-c4640eb000cd", "comment": "Malware payload (Heodo)", "value": "f71655a5a6d9b4d704e088f143f8d87a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275650, "uuid": "1563913e-5bd9-4415-a071-7f29943a37aa", "comment": "Malware payload (Heodo)", "value": "1e58fad4c96f592ef4b5f1b1ed8f072f4791733b6c336029df1a17485820dca8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275650, "uuid": "8bfba0e0-363a-4809-b920-ee9a5a893e26", "comment": "Malware payload (Heodo)", "value": "98e0bf2481cdb3b0aa2de176ff7e69230bef430c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275650, "uuid": "913f02f2-cab3-4163-9101-dddbf0496d55", "comment": "Malware payload (Heodo)", "value": "cd242e1d6c6b59108121898ccf7cc285628604a7955ead2fa569fa49356d80724f4504f9dc17c66dedbbe4f0d4e9983d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275650, "uuid": "52eb671f-c23a-4d6e-a6db-96dd1c35ad3f", "value": "T153E412B036D5721BF684367553D69923DAA93BCBC183702A12040263A2F37EB776BD21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275650, "uuid": "565a3ec5-e1a0-49ca-8bb7-f2bd0e16b450", "value": "6144:FNSIG3mSp/X+aupc0VviBPZRiGNNjBwbvrh:Fs32Sp/X+av4vitnJHjybvrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275650, "uuid": "6a9d3c0e-bef0-49d5-ac6a-f2aff5240d39", "value": 706660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275650, "uuid": "0f847a11-21db-4f30-98d5-8881aaffaedb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275650, "uuid": "b1f359eb-57ed-4c8a-9fff-b903942bdcfc", "value": "fattura marzo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6f93db-bdd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678295907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295907, "uuid": "a971c67c-f339-4286-b2fb-862dc9fff490", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab4c66749297e0c6eb0684dcb428275", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295907, "uuid": "246f0806-cfbc-4ea8-918c-097a76d06214", "comment": "Malware payload (SnakeKeylogger)", "value": "1e8283fe92b562190030bad75a368449bef1f313ea1c0fa78c41bfcf725e03f7", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295907, "uuid": "b5929727-93bc-461e-988c-30411027447f", "comment": "Malware payload (SnakeKeylogger)", "value": "024bbe00a87584f8d41db0cc097a68a1ab8a929c", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295907, "uuid": "4556ea38-5ffa-4c14-bf6d-36e1bb38817d", "comment": "Malware payload (SnakeKeylogger)", "value": "2644ed80818b13a00f06fb7a02231a605a27e55d5d318954086285bfd0d42f84856a2aa0390fba6f9f88f216403a84dd", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295907, "uuid": "c2210064-ce0c-4f1c-8df5-f7719d8de5b6", "value": "T12565BE99B3315563EC8F80B90917C5DF2C44F98B7611E237673F7A82E2591BF7A88212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295907, "uuid": "6ee4e0a7-c7e3-4ee7-a057-fedc3b0daa4f", "value": "24576:rEP78/16gMbCFHS9VPK31tmG+EhijMa3dG5:/RxIVPK/mNECMaNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678295907, "uuid": "a025203c-c838-4b2f-8e37-8ed43aac6535", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678295907, "uuid": "4c3fde8f-5721-4563-8c7c-30e3c7120a9a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295907, "uuid": "8713431f-ae5b-4ee4-b778-c923b2cf2600", "value": "nSWIFT.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c899dbd0-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309455, "uuid": "aa7ddcb7-45d4-4b0c-8533-808f4c1949bc", "comment": "Malware payload", "value": "a8284ebd5ff6a394c032ed4fcb4152aa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309455, "uuid": "72e6bd2a-fe21-4dc6-84f2-d0055c100646", "comment": "Malware payload", "value": "1f376dc0340885dbca75f8cfab71de7e0623bf06a4d276425b3c2485a6985c46", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309455, "uuid": "c49fbb75-d6f9-48d6-801f-9ac423641493", "comment": "Malware payload", "value": "60440cfba7d78395f88dbc81e187e365570263d4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309455, "uuid": "7c700861-8df4-4c63-a2f7-c8aa997ecaac", "comment": "Malware payload", "value": "5c54ed81a632a80dae6f51cab75af4a5d26a884f9045004d5b5123026de8e8423fe0fb2bc99caeb19fe0dec990a131e2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309455, "uuid": "b498e6b5-ca66-47dd-ab2c-0dc62be65d1f", "value": "T140536CFAAD5C12480506D2A6984B14BCF78FCAA2457344772B1AB3A57F0A3342D7F5B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309455, "uuid": "d946b6b1-7176-41fa-a6c0-ede582d5d2aa", "value": "768:iKv6ZiULwu+sR8g1Cg5AuUJQR+Es8QBU5ZdECy8DTXKrSpPUCIgMb2w9walGGc8G:AR8g1CuALnUZLy8p4bokGIRpj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309455, "uuid": "c11214c8-e199-41b7-98af-f1c4450af85a", "value": 61834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309455, "uuid": "e13882c6-9cc0-4eb3-9302-7db4aaa1d7d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309455, "uuid": "fe077281-c321-43ed-a244-d0aec1b8c4f5", "value": "08032023 Confirmaci\u00f3n de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a436100-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262777, "uuid": "90c9f346-6030-4cf4-9d8b-191781b92331", "comment": "Malware payload (AgentTesla)", "value": "f300f686821deba927b954a36cb74874", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262777, "uuid": "d0ce285d-acac-46a9-952b-ff8d53b6cdf4", "comment": "Malware payload (AgentTesla)", "value": "20899b27a51843830df2084dce88cc97d752a7e2dd1a64ad3238080a145fceaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262777, "uuid": "e0d8801a-4b19-453c-b380-365f082a695e", "comment": "Malware payload (AgentTesla)", "value": "1c076c17f47e2942035fcf63709aa85213c4f83d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262777, "uuid": "b171c1ca-9cbb-4ac6-9bc7-b5b96a2bd5cb", "comment": "Malware payload (AgentTesla)", "value": "127f1b6aadb432ed753db4db0f5d6a8ccfe50c5a006affb83bdb8302edda07b5268e8cd64a474beb4dbd169082962b54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262777, "uuid": "39d7ceba-208c-4daf-8f38-86edb920917e", "value": "T1B4226C3CDA02F926C111047DE14682F0EB2D54A7EA92BA3D215672DD47606C38BDEDAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262777, "uuid": "788535f5-fe0d-4e82-a7b2-13c3618ce6aa", "value": "192:ScIMmtP1aIG/bslPL++uOAl+CVWBXJC0c3De:SPXU/slT+LOAHkZC9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262777, "uuid": "2661050a-278b-4f2c-ad74-4276ef758141", "value": 10404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262777, "uuid": "99a0219b-4de5-4467-82c8-7682f11c97ed", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262777, "uuid": "826c94d9-f2ff-41c8-a044-6e4690814a57", "value": "PaymentXSlip.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eb9dc3-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1678303807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303807, "uuid": "4eac899b-1dfc-48eb-ab7b-c4b5f0a09dd4", "comment": "Malware payload (Stop)", "value": "f435d8f9460af029f5f5e833e95b9ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303807, "uuid": "3860dcec-62d7-4d81-9abc-c490eb1141c9", "comment": "Malware payload (Stop)", "value": "210dd5fc781ed257780772f5119da596b87f0208d87d8c36b1729e4153ab7ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303807, "uuid": "e3361bd9-b523-4f94-84de-cd08eba63d82", "comment": "Malware payload (Stop)", "value": "a72748b0387a7bbd8ca9104e0d839b60ec909f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303807, "uuid": "1732dcc4-07f9-4fd4-b9ad-da36d03de30b", "comment": "Malware payload (Stop)", "value": "c80beb52f933d9aa49020d6d49b2d71528c896a2e30dc5127326bc7b39c40a3e910e08dc790ec41f27378e8ba9f3ec82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303807, "uuid": "283559f1-671c-4bfd-a805-48c1ebe76c71", "value": "T1BCE4131252E1AC26F27647714E2AF2E4666FF8E35F7FF6D912201A1F18F11E2C952312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303807, "uuid": "32801d3c-1271-44cc-a8f9-e4b4ea634400", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303807, "uuid": "a2e599a7-acfd-4f9d-acb9-834d6921d9b9", "value": "12288:+tNFECIrmUz+Q+xcc/iMxMr4vLjfEkF/hcCTJDW5powJaTBQgWTsZFUWViVR:+z89i6/MxMrG3EMRTJDmpD4BQ3TaFUWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303807, "uuid": "cd83e555-44a1-463e-8bba-279f078eacc0", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303807, "uuid": "519fd436-19fe-4320-bb8b-902f7adb4995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303807, "uuid": "f40d2f6f-04f2-4589-88b9-5fdab3718279", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d68efe-bdfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678312744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312744, "uuid": "53435ec9-039d-4c39-a0a7-11945294dbcb", "comment": "Malware payload", "value": "7ffafcc236a0e41da928b164908364fa", "object_relation": "md5", "Tag": [ { "name": "rollodoors.com/sdvaner22.prm", "colour": "#BDDFB4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312744, "uuid": "a7209197-e35b-444f-89d1-dae184bd2eea", "comment": "Malware payload", "value": "218d1d76e87114c72f0c11ec4b5bc5b06ba01150c7dc1f5661e6c369290e98a9", "object_relation": "sha256", "Tag": [ { "name": "rollodoors.com/sdvaner22.prm", "colour": "#BDDFB4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312744, "uuid": "a6d302e1-a0e5-479b-90b6-cbae38d380ab", "comment": "Malware payload", "value": "af4dc0262deec6810ee135dd0ab52e9cc544641c", "object_relation": "sha1", "Tag": [ { "name": "rollodoors.com/sdvaner22.prm", "colour": "#BDDFB4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312744, "uuid": "18ca645b-12f3-4b91-9165-ca010a4f9e38", "comment": "Malware payload", "value": "a3a9328d967e8d2b94cd6176fb7c354ac60adac1729e6ef1d2d4862e3d59f9d0edcb131921844e7bc6ad423111e7c809", "object_relation": "sha3-384", "Tag": [ { "name": "rollodoors.com/sdvaner22.prm", "colour": "#BDDFB4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312744, "uuid": "7812a598-e8f2-4562-82c6-02cb70a4a8c7", "value": "T182256C61DB1A26294D5F2B9EEC824D4649BDC02D42370179FEEE138E610769CC3BEB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312744, "uuid": "b5448466-0c87-459c-8e3a-340441cf0327", "value": "24576:YhsTDkMjm1FgCLStbAto+MDE59spV8XqSiHW+V:YhNMa1D2NX+McspiXqRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678312744, "uuid": "cc864070-a4d3-4401-b54a-efe2291fd97e", "value": 1028831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678312744, "uuid": "838c05e5-bb1d-435f-ba51-aa5cd7d13b41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312744, "uuid": "25b17a85-5dbb-432a-bd02-6f6dc55eb8a3", "value": "Richiesta di preventivo 070323.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f656cde9-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678286339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286339, "uuid": "06570889-228e-474f-905d-11c1812e848a", "comment": "Malware payload (NanoCore)", "value": "8d26d34c1ec3a121b6be8296b84c0538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286339, "uuid": "40d85bc2-e55f-4d17-b345-63f6ca3af84a", "comment": "Malware payload (NanoCore)", "value": "22bad1da863df7a01a4313e5f1a78745c09154ae1cf841c5424a929dda8f96b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286339, "uuid": "f276c280-105b-48b1-ba86-2e7a34250533", "comment": "Malware payload (NanoCore)", "value": "e586833c646f7de4920c1a37b20741d4a82029af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286339, "uuid": "e30e4580-7499-4503-9dd9-6e4700c5334d", "comment": "Malware payload (NanoCore)", "value": "59e3c174f43cb28b8f005c94d0b0d86bff65cd76c268f741adf4a88a2e4775d6a6e7c96c32f6f4d4e4b3f9b4bc34444d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286339, "uuid": "3dadfcc1-c895-4983-bd5d-23b678410ea5", "value": "T1E0B4BC5EAE848942C13D3D72C432F7730E23D8625B02929B5578EDE9CDEF2805E1696F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286339, "uuid": "9c037d8f-4d04-4065-a144-8eae3bb77a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286339, "uuid": "8d43696b-8da0-4d54-ad45-b8e813a686d0", "value": "6144:jZIRAknzF+I2IXrM2GGNrCHnJOgjXI2Gau1wN:jZcAGX3origOgjY0uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286339, "uuid": "d8c1a127-474e-4a72-812f-b27f7312c92b", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286339, "uuid": "8c5d78b2-6e4a-4a71-9a26-ee32cc7cf890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286339, "uuid": "e9e21054-f760-42b9-b6d8-349a637423b0", "value": "test_enc_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f99e40-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276596, "uuid": "1f3ff5ea-c816-4997-b6d0-8faa794b09d0", "comment": "Malware payload (AgentTesla)", "value": "8e4e7a200226d1efd465e94790aaea61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276596, "uuid": "68e311c3-1166-45f8-93e4-07aa2fccab6c", "comment": "Malware payload (AgentTesla)", "value": "22d0d0c5b3370c3bd0daf3573a3257dcfe6826b3d5fb9ad381060f22b1324114", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276596, "uuid": "4febb598-149f-4fe6-b631-2ca4b6f851af", "comment": "Malware payload (AgentTesla)", "value": "b02a1655abbda9d182f4d103331011c38951c9d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276596, "uuid": "95e79a6b-81e6-4448-b92b-eee90b8fa0d5", "comment": "Malware payload (AgentTesla)", "value": "ebf2bc83fab5197608d2a1ac781c42e71c36a7d2885f96dc667e3673a28d92831ef7ceadef170339acf2b866f64014c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276596, "uuid": "49a8f545-0bc5-465d-b9b6-d7aa8ec0561b", "value": "T17E257B3DFD692AC9E276F2338593FA50F2F484F37321C8466EE2548446B1A74B28E51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276596, "uuid": "ec435467-a7e5-4d22-a6c4-dd8ae446c50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276596, "uuid": "04da1e9c-f566-4085-bceb-33b43796535f", "value": "24576:0Az299W5VBxLYwoj27pgJEfJee7BX9LdYcPZ2KcBgzop:Z2rW5VBW1SpgJAvYcBOBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276596, "uuid": "98ff7ad0-a9fa-4d0b-b9d1-d8f4b555e735", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276596, "uuid": "23589009-f474-4c3c-819b-67676c8a2b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276596, "uuid": "354cfc44-d32a-4cb1-9de5-7b52ff128553", "value": "Fuyao Glass L460 - Overdue Statements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f86a51a-bdff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678314030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678314030, "uuid": "4fbf458e-b834-4af6-a89a-b762c9e31371", "comment": "Malware payload (RecordBreaker)", "value": "9b9c79caaffcd3cc93afad14f200108c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678314030, "uuid": "5720173e-fae2-42e2-889e-b93cd5471ef7", "comment": "Malware payload (RecordBreaker)", "value": "22e2b816a20424bb37abf9cfc22605709173aa4208b9e383fe10266469b2f916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678314030, "uuid": "d71464b6-802f-438e-b048-e63431601fb5", "comment": "Malware payload (RecordBreaker)", "value": "de4806e7b6308e29a56439ffadfbea3c152b592f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678314030, "uuid": "6d6f50fe-3411-483d-b853-330e633bb8bd", "comment": "Malware payload (RecordBreaker)", "value": "4acbc363c99cb009af1feae14f270bf62073bb4ccd373b1e8fb0d3e6ffac2f13a0edb74075e758778356d56176886c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678314030, "uuid": "5e2d729d-cb43-4c6e-b247-500af0a82cc7", "value": "T14DE623F561F91042E2A68E347FEA7D19B1F5355242C1973E708A29E52B32740321EFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678314030, "uuid": "10f87c14-f18b-4594-b5fb-d664b122c60f", "value": "16cf5db3878b2dcf0f97ac9d337625cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678314030, "uuid": "53066c36-f186-4b21-96f6-cab4ad264b1f", "value": "393216:kccC5cYkegfafcwvHgApo65UQea5MCjQXowha8xPgs:7cPdegfalY4oAJdc4mNgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678314030, "uuid": "8f4324db-1321-415e-843b-9626f1589577", "value": 14124032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678314030, "uuid": "5df83693-714e-487a-ae08-bb51a4fc2ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678314030, "uuid": "d1503dee-0e06-4444-9186-24c63aeb8c87", "value": "9b9c79caaffcd3cc93afad14f200108c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6c864e-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261146, "uuid": "3e31a0aa-b2f4-4839-92f0-8a6b33ea3d2b", "comment": "Malware payload (Gozi)", "value": "361301f6ad56d5f44ed70afcbf223df0", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261146, "uuid": "a2565cc1-989b-46b6-b8f4-b1f041b6ea6b", "comment": "Malware payload (Gozi)", "value": "2362e52e347d77a6b101b80057d9770e44a44599889385a83822625901631583", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261146, "uuid": "be0a8ff4-29ac-451c-b8ff-d99afce3b403", "comment": "Malware payload (Gozi)", "value": "1195b135d96ee1214531ba0c6146318f2524bea8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261146, "uuid": "aaf338b9-f790-4fe7-b37e-a4f517586fe3", "comment": "Malware payload (Gozi)", "value": "35c033bae2196cbf15f0fa8035d20f5fcc1590578e1ead52925163366b34199ccccd698a07bad3030a42c7bf6c7d3b41", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261146, "uuid": "e27d461e-3f97-4885-869f-92b792ec8d70", "value": "T147C022048A0A80AAC102480E9058BC28AA0EB01928EAC86C2285D98B9CC04C6CD08EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261146, "uuid": "c93b2253-4544-4982-920d-7e588f1910c4", "value": "3:HRAbABGQEb5oQsQaGaTKk0j8XkAoIvycAI9RyJ25YdimVVG/VClAWHyn:HRYFJb5bsZGNk0j8UNIvyc1yc54vVG/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261146, "uuid": "d7f4519b-2086-4860-b0a2-e48510fa868f", "value": 191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261146, "uuid": "cb9050d4-fd61-4693-9274-28c5d95c9e5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261146, "uuid": "b6a54681-8468-454b-ba39-8f4e6469e39b", "value": "AgenziaEntrate url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0958bead-bdfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678313429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313429, "uuid": "64b93bf7-e0a7-4153-83cc-2e59c45539ca", "comment": "Malware payload (AgentTesla)", "value": "174e78cfa74be3d0d0f7eeb4eec0450c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313429, "uuid": "81c90199-5508-427c-b5d2-ab555c5af0d5", "comment": "Malware payload (AgentTesla)", "value": "236ef5e6c521e97852b9b70fa11757ad408e21e3560bbe41d8f45701093b30c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313429, "uuid": "2108be58-5656-4bc0-8326-94faaee39c8c", "comment": "Malware payload (AgentTesla)", "value": "c29649fcaf5f90bad8ee97d2bc02abe5e5eb8ea7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313429, "uuid": "b889c6a7-35e1-482c-9d16-88e5387d69c2", "comment": "Malware payload (AgentTesla)", "value": "4194c48d62cce883b5a366470b006465834b0209cb858df9274c033fee80c4b0e0dac55454393fdf89c523f3d8b61edb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313429, "uuid": "1913f1a4-85f0-4605-bcdd-21e4de442def", "value": "T1E315CE99B3314173EC8F81B94917C1CF2C44F98B7611E237577B7A82E2591BF7A88622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313429, "uuid": "e166c1f2-c5ba-4b5c-84cb-038db7494561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313429, "uuid": "782806df-7094-45be-a99c-67d16b60fe8f", "value": "24576:aEP78/1IaY53axrrJFwoU2HTfd6Tm5LaLJdsERQ1d8:uXy3irXwL4Um5L0vREd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678313429, "uuid": "c3fbe9aa-b5bb-4bee-93c8-f76b9421ed22", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678313429, "uuid": "b9871836-e4e2-4c0d-9084-0d89cf3742b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313429, "uuid": "a82f7993-3d7d-4e3c-b96d-6531fe44994a", "value": "174e78cfa74be3d0d0f7eeb4eec0450c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01984894-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267460, "uuid": "4670a750-428d-4c35-91e1-5084d8601ca2", "comment": "Malware payload (Gafgyt)", "value": "a9724940bc93d2c58ae3dc2a7d176fd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267460, "uuid": "c49c6507-69ae-4f84-8c15-fa43c67b1981", "comment": "Malware payload (Gafgyt)", "value": "23aea01e3d9ae14b48d97400ebeac8000cf68954c74b312872e675fe9f8b70fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267460, "uuid": "91d26aaf-e700-4f04-a40a-fd54d85a24ad", "comment": "Malware payload (Gafgyt)", "value": "8889df02641d5ac1e0176e88b36ae6378de86b76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267460, "uuid": "2e6b6d03-d78b-437d-a37b-9daa7f35bd5c", "comment": "Malware payload (Gafgyt)", "value": "8379bdb37891f28419d1882f5044d5e5a8cfabadc58afdad21fa979fb6201be2135cf63a6f781e77b76d5d0704c739c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267460, "uuid": "dd4e296c-d2cb-465d-b076-30b5e3134a7f", "value": "T108933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267460, "uuid": "8db588fe-6b4c-4b42-87b0-117419e31f43", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5X5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/b5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267460, "uuid": "1a70b111-9c49-4914-895a-081de27bc308", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267460, "uuid": "6ce81ea1-ab07-4045-82a7-04de1c098a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267460, "uuid": "c334961b-9391-4c10-a330-cf81ede20d5d", "value": "a9724940bc93d2c58ae3dc2a7d176fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3549bc6-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678307728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "d535e471-508d-4e3f-867e-1fd0d27846f0", "comment": "Malware payload (RecordBreaker)", "value": "87733fcae4d3eaf12ace0d7480cde010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "cdafb65d-7ab8-44d0-8a03-3a30d125092a", "comment": "Malware payload (RecordBreaker)", "value": "23e6ee7b25d1b4dd70cb7658550f8f6d87cb39eba9a57de83aaac4472bac28f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "56f61055-995a-4bec-9a39-80f955caf921", "comment": "Malware payload (RecordBreaker)", "value": "ac35891dfaa76b819f12cc41c6d2888a9a1fbd66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "853cacf5-aa0c-4347-aef0-22be22ebf53c", "comment": "Malware payload (RecordBreaker)", "value": "6ad0d675d8d9cba874dec13a40482490c387236e4d5e45aea51586ff9af08c336abfb3fff016a5f0482aabacec514cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "97f5ee65-7ee4-4882-9eae-33bd01be5dc7", "value": "T19A05284AB7BAFA63C308073AC1DDC81047B49E509A53E72BBDD42BD3A403B57DD16662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "4603d5ec-e52d-41c4-99b3-ac2003966a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "db584d83-5f66-499e-8510-76266ca3a2a9", "value": "24576:FK/RcT2KF9owQ6TC1MbtXagLMmx7+vvKoO+Jezmq1R+QUmX5:shq1R+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307728, "uuid": "5f705087-46b4-4e6e-9084-fb637dd39da6", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307728, "uuid": "bc385fdb-334c-4de0-a9d5-cf07a1f3233b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "c56b101b-47f6-4a93-a2bf-e4b4367310eb", "value": "87733fcae4d3eaf12ace0d7480cde010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58115867-bdb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678282208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282208, "uuid": "3b33d7fe-9a80-4dbf-bbb6-0baaa92098bf", "comment": "Malware payload (CryptBot)", "value": "ce832fd91d8a73245b55401cc517f63b", "object_relation": "md5", "Tag": [ { "name": "ce832fd91d8a73245b55401cc517f63b", "colour": "#934FD2", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282208, "uuid": "47cc3d57-f016-48e0-a261-89700de6cf33", "comment": "Malware payload (CryptBot)", "value": "245c2379816c8ab8c0c83050dc7da5375fc724788e6844540cf2ba537f6b727b", "object_relation": "sha256", "Tag": [ { "name": "ce832fd91d8a73245b55401cc517f63b", "colour": "#934FD2", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282208, "uuid": "b5c3df2f-9605-42fc-8a52-e1a98963b324", "comment": "Malware payload (CryptBot)", "value": "61d5d7692a8230986504352a26f4a01a82c88a9c", "object_relation": "sha1", "Tag": [ { "name": "ce832fd91d8a73245b55401cc517f63b", "colour": "#934FD2", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282208, "uuid": "38622c5c-ef34-4b7f-ab35-4d1cd42f7252", "comment": "Malware payload (CryptBot)", "value": "37f51d47d972d7845878df2797555f2f280179318ab4aadafd125f49dd4aac3b270d7938677b47310da3e223229bcab6", "object_relation": "sha3-384", "Tag": [ { "name": "ce832fd91d8a73245b55401cc517f63b", "colour": "#934FD2", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282208, "uuid": "06bc4bbc-56ee-45db-acb2-b23129c19d46", "value": "T113050120A5C0C174D7665972C93A4A6B9B303D77AD25E4CB73D4BA9CBB38502E7122F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282208, "uuid": "d773fd81-544d-45f4-a70c-f9a0d8c23863", "value": "24576:ICz8aXYAB989spgVQu8+O3ijE1wi/s8/T6H:Zz8OtB+ah7iY1wiUui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282208, "uuid": "981eb390-81bb-423a-b239-92aacf6c1891", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282208, "uuid": "5a8b27ae-d5dc-4ed9-8514-4beb0f7ee76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282208, "uuid": "8265f9be-307b-46ea-a404-d2e26b1314f8", "value": "ce832fd91d8a73245b55401cc517f63b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ec26ce-bde9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1678304726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304726, "uuid": "27847236-c062-4ee4-af52-91e24d23f4f7", "comment": "Malware payload (Stealc)", "value": "7f1375b1b5b0c31dd26374c47a716ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304726, "uuid": "461ea38b-ba84-4a58-a77d-66bd71923763", "comment": "Malware payload (Stealc)", "value": "2498f4ddbb9d9491433ea8515d6347cb0a55175a3794bda83425e247ced1e8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304726, "uuid": "3defd5cf-498a-447f-bfa4-db9d780afe1d", "comment": "Malware payload (Stealc)", "value": "344ef97e2f53e16af78fc5ed947c47d694cc13a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304726, "uuid": "79bdb71b-1b2c-4b5e-8abe-72f405b9241b", "comment": "Malware payload (Stealc)", "value": "b555fd6ddd827e75ab45ff93b22b4c78db8646590ba75e8db5f59e1f55d758f4dc36e1b56cd35fa24a1212dbce70eae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304726, "uuid": "d779fe2e-06a5-4a6f-b581-b68f0c1b9986", "value": "T12CA418293DFB6016F3B2ED3029947315CE5F3F726D5C949A9245234BA227210EDB2E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304726, "uuid": "0034d1f6-3153-4350-bae9-f4492bbb112e", "value": "01b33103124fc9184c622a68adc0db2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304726, "uuid": "a16fdfb0-2e17-404a-94e8-8cd3c30430bd", "value": "3072:SoQiRu7nujjhvpe2B9a+dvmH6JrAdg0FKYlUxuDbD4vcIb5RDUwObZUQBx:3ynUe2//Jr+FKAUxuvADUwOlUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678304726, "uuid": "f26dda39-433e-4e1e-b938-f737432fd78a", "value": 476760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678304726, "uuid": "f31ec744-89dc-4729-9988-93f7467049dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304726, "uuid": "a4d900c0-a5aa-4679-a3ea-6d7331a0991c", "value": "7f1375b1b5b0c31dd26374c47a716ce9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c0c06b-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308343, "uuid": "946d1a1e-4a29-49d8-a340-2de8f72ead0f", "comment": "Malware payload (SnakeKeylogger)", "value": "2698ac98acd5c6d8f720274b95787a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308343, "uuid": "f1f904a0-146f-46ae-b94b-46b933e5d98a", "comment": "Malware payload (SnakeKeylogger)", "value": "2561cf63e82a6252154212b50f71d0705250edbe123b76e552b785d3c74a8bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308343, "uuid": "b6b109e1-a0b8-4244-addc-2b8b16986582", "comment": "Malware payload (SnakeKeylogger)", "value": "4011457242db5a9614fee4502fe7f364ad6c1e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308343, "uuid": "1f018c8b-3982-4534-994f-5a9f19f76dd6", "comment": "Malware payload (SnakeKeylogger)", "value": "f2bbac5c332f13fe21b17173e053f9c6090a39d3cd98bc6283d90a3a96f1dc0ac318525783f94a7e20280a68bcc76066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308343, "uuid": "7b5f1e64-0966-4947-8689-2c6cd28261da", "value": "T15C15AD5BF249AC1EE8BAE770DD45BD54E430B0767202752B75DBC08847ACAF29B102E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308343, "uuid": "1abb5206-d305-44ba-834c-8ee716e9ee6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308343, "uuid": "2d27b818-d3be-41eb-a748-c778dd1b6b33", "value": "12288:ne3ygT4mLCPqliiTdJ/9S9+4Zg74sGu8bzR+dJ3S2vW3jJub4Xux81tN58VLPkKX:ne3hdIQFUg8sYbV+vPQjJuqu61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308343, "uuid": "ed664601-83cd-4d59-b3a9-a23e3326473a", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308343, "uuid": "57f484b2-1922-4507-a434-f4039d5cce42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308343, "uuid": "9ed6ad98-9500-4a18-9f15-408d4717fc3d", "value": "factura 230255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba82ea4-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261168, "uuid": "fb95f991-6eaf-4e23-9bcf-bbe6d437d6da", "comment": "Malware payload (Gozi)", "value": "c57ce09111a84d1110b24a8505ff5804", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261168, "uuid": "59100b32-5ca5-4e0c-ad64-ed5fc5a67011", "comment": "Malware payload (Gozi)", "value": "257413c17f63500a76f9d0216a8dee283021299a61dc0539e6e870fd5d78177b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261168, "uuid": "f7d1032d-0f34-4e7f-b2d6-f090fb28476e", "comment": "Malware payload (Gozi)", "value": "9fd1e2577f10a24c2678803e073d35e41b551eb2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261168, "uuid": "0924fe34-fe69-4401-bcdf-834d855799aa", "comment": "Malware payload (Gozi)", "value": "17b0226809b3127d586ed8e3efcb236a469981cb1e91fb475d8595448b03279f2e9879941a5f4cbc866de358c393a4e4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261168, "uuid": "27659624-d83a-4558-8971-f00b26db35a7", "value": "T1BEC022048A0AC0AAC102480AA058BC58A90FF00828EAC82C22C5D9879CC04C6CD08ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261168, "uuid": "43c9f217-89d1-45ae-adb6-801e1f35216c", "value": "3:HRAbABGQEb5oQsQaGaHvkj8XkAoIvycAI9RyJ25YdimVVG/VClAWHyn:HRYFJb5bsZGgkj8UNIvyc1yc54vVG/4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261168, "uuid": "9c85ebbd-be43-42fc-999e-d44ad72fc41d", "value": 191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261168, "uuid": "3a168c00-73ac-4db6-839b-04c34dce473e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261168, "uuid": "8f62fe27-8592-42d6-a5cf-f7a62d8c8ef8", "value": "documenti url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2f98a7-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247618, "uuid": "a5278c13-560a-48bd-8a4a-17a075f07584", "comment": "Malware payload (Mirai)", "value": "e132fa96278c001d78ba006511a3c5bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247618, "uuid": "53f8084e-2276-40ff-a238-6272626f7f22", "comment": "Malware payload (Mirai)", "value": "259654ef0e43b79a27b89f5a93cb1a9e9b887a68417e54580d49854eb39c9963", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247618, "uuid": "73b21551-4b6b-4fdc-8b15-e120a84ee0b9", "comment": "Malware payload (Mirai)", "value": "24ab8c48cc9b57c464c91848158b1105a8931f15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247618, "uuid": "42c9c435-b860-48c3-8f11-59ee20634902", "comment": "Malware payload (Mirai)", "value": "0f5c41692dcfbe5e1a9e9eeb0ed6b934d358614e72e9d43bb232ffa4df86fa6a61a1c45dd6e4e967876f1de5a7957b0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247618, "uuid": "40064490-a0ad-4610-a730-d87b81a0db60", "value": "T142B2C0CD60443184C98D7C7C178D4A674F6CA180BAED9B26E354CDE877BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247618, "uuid": "0f5508ea-fa84-4f83-a2e6-21f6123165a7", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpOZqEWvH:/QlS07FUXqIYSXQKquCq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247618, "uuid": "e904bc5a-c0e4-45ae-b2c1-902262a3c609", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247618, "uuid": "499d97dc-93db-43b3-9620-dabe74942810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247618, "uuid": "d778d0ec-1922-48c6-9e10-fa817adb6dd9", "value": "e132fa96278c001d78ba006511a3c5bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f211cd01-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678309095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309095, "uuid": "cb003d9b-ef90-480d-974b-d0f3f2dd843c", "comment": "Malware payload (Formbook)", "value": "12c87026c144f87df2338e40f2293b19", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309095, "uuid": "94b25b0e-d7bd-4e33-8c88-4496c6097525", "comment": "Malware payload (Formbook)", "value": "2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309095, "uuid": "a668cb9d-bfcb-4d85-bd7d-1f493cf4bdd2", "comment": "Malware payload (Formbook)", "value": "b8caf6a6c738f7050523381c4e7fcbba08ec6433", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309095, "uuid": "dd393501-c9af-4055-9981-a286d5ad63e2", "comment": "Malware payload (Formbook)", "value": "2d779c1341461a59c87b63f06de8c808d81c973477ca773d78173291d4fba9246d5b738ab0b6c5e2ba59b3a9e7ec6a79", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309095, "uuid": "57812f39-e9f5-428f-848f-80b78aa839f7", "value": "T10755F1039238AD4FE112C7BCBA2F7459510E7C3631C1A58A764DB71B0732FA65ABF219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309095, "uuid": "4a2e9e82-34dc-432a-bbaa-bbd6070ddcf0", "value": "24576:QLKrBwtHlx7WQmmav30xJB48tHlxGWQmmav30xF6FIW60z0tUo4QcZRx:QLKro7aQmmQ30D2S77QmmQ30H6Q+Qif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309095, "uuid": "b1480017-67c3-4655-a542-160db778692e", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309095, "uuid": "ab7ece05-c0de-4c77-a2b2-a61d5936adab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309095, "uuid": "cb9e19fc-0581-4ffe-9fc1-f187e3854c58", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6defa1b1-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "45e13218-91b8-482b-bb41-772a4cfa0cad", "comment": "Malware payload (GandCrab)", "value": "e10a2d2e8ca5f56faa1608941e5bae1a", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "683fa1ed-2696-4c98-a559-ea6a727c216b", "comment": "Malware payload (GandCrab)", "value": "27111a1c877e90a66e6ad29c2f94d05f03659d8e7c1e6d37ec2efadfd1c055a5", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "a881ca42-339e-4513-bddf-ea87fdb7f0cc", "comment": "Malware payload (GandCrab)", "value": "c1f88e9e52269a3774ac947afa0654f9ece4261c", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289975, "uuid": "d78381ba-01d7-4714-a7dd-d210185cf1a1", "comment": "Malware payload (GandCrab)", "value": "715789dd31f70a56894fae5ffb55db7ca536912e3f483a927b24e12af79fd1f680e34cc2f53c16db87b9279e2ad68feb", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "c5cbf1e3-bbf5-4ef1-a35d-1988db1aa51d", "value": "T1BA636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "7a74a20d-eae3-4fa9-a829-1de7569ebbb5", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "2b278a9d-8351-4a6e-9d4a-644b0f9a6b33", "value": "1536:OZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:td5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289975, "uuid": "46d3b5b3-38b9-42e3-8111-4b6cfb866d5c", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289975, "uuid": "6b7849cf-7753-4d77-9687-10c245f4929f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289975, "uuid": "eb48291a-5596-4304-a1ef-ce42f139ada7", "value": "2023-03-07_e10a2d2e8ca5f56faa1608941e5bae1a_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d344753-bdb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678281411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281411, "uuid": "47d853bc-59ff-48dc-a196-b787b1cb521b", "comment": "Malware payload (AgentTesla)", "value": "790c28d1122dacff4d1becbe630ed98e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281411, "uuid": "bc825ddc-9a8f-43c8-9ea1-3fa657464d94", "comment": "Malware payload (AgentTesla)", "value": "2779b729bdaa3807f8cb81e680a8497a1694345b5214db7648e7624f545991b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281411, "uuid": "af487094-9f3a-407d-b88d-fddccbd8f2b4", "comment": "Malware payload (AgentTesla)", "value": "8fe7626796fdeb7bee159e4b66dcb70396a6a634", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281411, "uuid": "d2b5cf0b-579e-4f76-8556-941d6b59007a", "comment": "Malware payload (AgentTesla)", "value": "207793f5aacc49d0a53f713e19c50b245c1c6272ef19c0b53358040d583ccc81f10f7cf1f9012d3c61efb98a62f87d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281411, "uuid": "a6728d5b-3d4b-4008-b6f6-4cfbe3893314", "value": "T145A4125839808F87DCB817F94EB6684013F9D93D3972DA291E9131DA6693B404CB4FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281411, "uuid": "cd43389f-b69f-45c4-b715-0897a807486b", "value": "12288:qn+YXzV+OJ7b2xCqJlG/+/+RfwlbMdx2:qn+eYOpSRlG+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281411, "uuid": "abf45907-2a18-4225-ba0c-1935f66b5017", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281411, "uuid": "2d5b863e-372f-442e-9dcd-df2c4ad2531f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281411, "uuid": "835f7375-6811-484d-9a76-54e9acd09e48", "value": "2779b729bdaa3807f8cb81e680a8497a1694345b5214db7648e7624f545991b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf0044b-bdc6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1678289784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289784, "uuid": "3e54eca7-fbd8-426f-adcc-1d509594562d", "comment": "Malware payload (Chaos)", "value": "b431bf2649aee55b729f1668a7bc4b12", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289784, "uuid": "8f228521-5e85-474c-942a-6079717c502d", "comment": "Malware payload (Chaos)", "value": "27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289784, "uuid": "a02e11e0-fc6e-4237-90f4-4da1368ff9af", "comment": "Malware payload (Chaos)", "value": "f618c191798cd8a809120bbf6b09ff79d8877138", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289784, "uuid": "f688f0fc-e6f7-41fb-b43d-1a08dce35c3c", "comment": "Malware payload (Chaos)", "value": "b40b122e7aae0db2df34d940173849d54087e8e1303ab6a62480f89e231b18a8d402af7410c5bb4cc167016a775b09fc", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289784, "uuid": "7c26940f-8fe9-425e-b48a-fedaa5a9b970", "value": "T1BA74A6346ADA5026F333AF745BE2758D999E7EA33B22881C209633490733B42DDD572D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289784, "uuid": "4a5db433-c141-4390-9f81-42cc921eed4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289784, "uuid": "8eb24bb1-3e3e-407f-8829-68cee8a8f799", "value": "3072:L3kLEir9ihicEQ23lcjxXedA3MYRjuOGK2OIcVtkzuwOYHYHYN4YHYHYcSuCexyM:Ur9ikcL2mj4d6riOZ+qSHej/Kd+bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289784, "uuid": "3bda5bad-53ff-4945-99f3-d34f4c36ae4b", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289784, "uuid": "8b26bf54-4690-41bc-9575-0d29002ef24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289784, "uuid": "ea11800f-5e87-4bd0-bd4a-00802999ae83", "value": "2023-03-06_b431bf2649aee55b729f1668a7bc4b12_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e89f216-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309599, "uuid": "6a886c56-a361-49b2-8428-d1820ee24729", "comment": "Malware payload (GuLoader)", "value": "9885eb66291aea0880b86051389cfbb8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309599, "uuid": "3dde6e7f-d659-4280-8337-448e5e18080d", "comment": "Malware payload (GuLoader)", "value": "27e842c3102b6ee4f1e48233732903ae6a3a2bcbbe65a18857f3c34455364f55", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309599, "uuid": "dd4f7cf0-3d54-4409-8e83-8c9531c76188", "comment": "Malware payload (GuLoader)", "value": "3d1f660cf46430abc6e53fcbd4530bf04806ed4d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309599, "uuid": "f7a960fd-ebed-492e-9b68-2ec1c1549935", "comment": "Malware payload (GuLoader)", "value": "7909b59f35b6df3c071e224cf1fc9d574953ca11a4d78a66d31ce109097434cc0e730219fe3e6e1d0607e802de4ed245", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309599, "uuid": "32ee9aa6-30ec-4197-b23b-e1d9973f9e90", "value": "T19425114D69A0D70BE35445717AD1A05ACD30BDACFC24895ABF937B1AA53030186FBE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309599, "uuid": "2f6894c4-089d-4922-87e4-74edf3fe80f0", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309599, "uuid": "b8e294ec-d1f9-4ed7-b5df-9a80d2ee51e8", "value": "24576:NyFWaRBd2EFfUS8iPx5C7eG+WYf037z5F:Nd6f58gx54eG+WiazP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309599, "uuid": "21f8ae84-edaa-4394-927a-07f05c2c854c", "value": 1003607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309599, "uuid": "d4f3aff0-7354-4bfd-8f06-f0a28ef861c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309599, "uuid": "f6da2b36-9909-4f58-8f9d-08721087957e", "value": "DHL_AWB_NO_#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc6f9e4-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289972, "uuid": "0339336b-176b-4769-9876-3c392f7b72ce", "comment": "Malware payload (GandCrab)", "value": "cd593bd92685b16491a77973f9f93e2b", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289972, "uuid": "cc7d2c5f-910e-47c6-a100-a654787266ce", "comment": "Malware payload (GandCrab)", "value": "280c59b74b704c80b5c9dc22ec783b89667adc9c92cd2d8fb5314f8446676e23", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289972, "uuid": "d0ffa7a6-e998-49d8-a8ef-63d0775075e7", "comment": "Malware payload (GandCrab)", "value": "deefdb3ba77a7930cb57df8fd7fa96ce9c134dac", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289972, "uuid": "a04ac289-125b-476c-a509-563b39b99a14", "comment": "Malware payload (GandCrab)", "value": "714875c1879f7673895192ace4f63c842004a2bd70609d79a68f1eefe3b1960a6a47dba2e1a0b8dc84b187fdf8f8e76b", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289972, "uuid": "e33a993b-b50d-40a6-a933-3a0d1d18930a", "value": "T1E1636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289972, "uuid": "061e58f6-69ea-4321-b04c-b1b6298bdcc9", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289972, "uuid": "f6781e31-bef0-4a8f-8b1d-12c7fb887d63", "value": "1536:9ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:8d5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289972, "uuid": "8f3494b2-8322-482d-b463-c34a946ea80d", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289972, "uuid": "bf17a445-d303-4f23-95fc-2ba9659b9dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289972, "uuid": "0099cf9e-e71b-4a58-b843-c2626eb63536", "value": "2023-03-07_cd593bd92685b16491a77973f9f93e2b_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5419f2d6-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268028, "uuid": "03d2062d-e410-4e50-a339-59acda481dfa", "comment": "Malware payload (Heodo)", "value": "f2bf2803e26b5ebc65e873a66778721a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268028, "uuid": "c05c3122-bd67-4865-a3b4-317f1bc0b129", "comment": "Malware payload (Heodo)", "value": "2928bc0c408c487048ff4fd2a83cf5d1088703661d80f159dd9fc78bbf3cf9a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268028, "uuid": "1501bc23-3185-405f-b82f-6f907e6aebaf", "comment": "Malware payload (Heodo)", "value": "c9a279035c9f0357ee032b7702873b122807b564", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268028, "uuid": "3fe36649-ab1d-42af-abff-57c071bf3c71", "comment": "Malware payload (Heodo)", "value": "953e70c8872034407f0fab480832af66ca0d1ffd3199622ae5932b6ad6c45eff4a814d660fe27c18e00c8b21e713383e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268028, "uuid": "736973cd-6370-4df2-b8ef-a2e8dc4bd22e", "value": "T19315233C5F67790FF5997C362AF3847AFCF9085CDC96A90A17531A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268028, "uuid": "d347acc2-bbea-462f-8edb-a650dd2939e6", "value": "12288:j4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sX:sevtlkdJe4m19Fgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268028, "uuid": "23e1e18a-5020-450a-a2a9-4e3f3405ebb0", "value": 888906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268028, "uuid": "56d5027c-cdd0-46ca-aee6-e302b6ad216f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268028, "uuid": "3397abcb-5163-49fa-9846-191a1f9c63ef", "value": "CNKvBixWKjSzvosbS9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b1343b-bd99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678270411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270411, "uuid": "b56abc56-73a8-4e24-b9e9-25df28a1e871", "comment": "Malware payload (Gozi)", "value": "2f691532aca6d401f39f7d23be9c560f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270411, "uuid": "f8a3996f-ad82-428b-b5f2-71b56b3a1991", "comment": "Malware payload (Gozi)", "value": "29547f7ced48000841e1ee6e5da03bcfb21722d9e60687356ab2d1e000733f21", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270411, "uuid": "fb352508-5b4e-4c7e-ae13-6fcb0ee0764f", "comment": "Malware payload (Gozi)", "value": "b76ebef436b0e9cc0e96a35d155f685231973817", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270411, "uuid": "5c59e2fe-74e9-4b55-955b-3c14619066ef", "comment": "Malware payload (Gozi)", "value": "b46f5003844a19e7dceee16936a96155e16388e25230318f121a1523a31d88d2277484e791d6b2b7d043c1912e219d5a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270411, "uuid": "c538f232-f5fd-407a-809f-0bb07491f1f1", "value": "T132F0ABF0A6A9169DDC3F42FC60E7439196B4A3A50C61184EC4E178AC8C96A932B45625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270411, "uuid": "85eba3e3-acb9-478c-8602-8e6e4cd622c1", "value": "12:5jvVmcrW3xqaFbBzb/1gMxfT/xWC4ShdQJ5:9drW3oaFb1BgKT/QCJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270411, "uuid": "dfd2202c-b1cb-44d7-b182-c44f18575632", "value": 477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270411, "uuid": "56312076-de4d-458a-8452-8b165822b0fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270411, "uuid": "eb25f864-52cb-41d8-93ea-a15ad7fadeeb", "value": "Direzione.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf36ccf-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279372, "uuid": "22eb456c-ff7a-42c6-8986-58a4e90e286f", "comment": "Malware payload (Heodo)", "value": "e12d9bbf518d0699f86b491c56ce23f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279372, "uuid": "41f229af-aec2-4355-aeea-d160b839b9b1", "comment": "Malware payload (Heodo)", "value": "29a3337b885b86b040868f436b7ed515f14645e017d150f88420ce5edba8d3e8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279372, "uuid": "751a7f7d-3d79-44b6-8a61-fd1000e7a3d6", "comment": "Malware payload (Heodo)", "value": "eb6cf563fd12d06c7b17460900ebc21870e6a89a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279372, "uuid": "9a6cf823-92c0-432d-8cb7-905ae101ecc3", "comment": "Malware payload (Heodo)", "value": "b7e9d778b689da1f2491a709cf79b0ed92f63f71bb0d95b420dacd772248ac84646985e6af4242ef82b3a9ca3cdb0a33", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279372, "uuid": "0ab5d140-4542-48a4-ba73-41df372ef194", "value": "T12715233C5F67790FF6997C362AF3947AFCF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279372, "uuid": "01e604be-8df2-43ba-92cd-a164ecd92f15", "value": "12288:L4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sR:EevtlkdJe4m19FgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279372, "uuid": "800d4098-70ef-440a-953a-829fe2227f66", "value": 880781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279372, "uuid": "00d92fe0-813d-4924-b075-8f660a08b785", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279372, "uuid": "f62be3d8-a5b9-40f2-a401-4e6eb9cea736", "value": "559937fsTfB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a6dffa-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678310596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310596, "uuid": "4dae8dc7-0c0b-4628-a564-d89885f4d635", "comment": "Malware payload (Amadey)", "value": "d0bf0d14fe6110f185c8b98423c7b152", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310596, "uuid": "b2593b7f-ac1e-4ffc-a3cb-859f0ea72b09", "comment": "Malware payload (Amadey)", "value": "29d6627890f7bc1f2ad490bcf08f16f57c14f6ac6015633beb6e5079d3360e64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310596, "uuid": "fceb2ba8-3c43-44ae-a673-89174b0e71ce", "comment": "Malware payload (Amadey)", "value": "0d29823c897e041816b6c5ebc5f1e17e4d3b2b63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310596, "uuid": "4243b70b-ccfc-445c-bb0f-2845422c609d", "comment": "Malware payload (Amadey)", "value": "ddbff5a5c1de0fe319b185aacf51c7b5710c726320170408b66c3925f5e9ea5986b0f183a07cd45a544fc940772e40ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310596, "uuid": "f550383a-8550-40a5-ad2d-ee07494bd71f", "value": "T1D0357C1BA26601BCD4BB9178CA274A46E775744603309BEB17D05AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310596, "uuid": "ee3fc04d-7a0d-4f71-8999-621868b88ff1", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310596, "uuid": "d9e09bd0-c6db-4759-830a-b31850cd46c0", "value": "24576:AMq/RX0hoa8wrC+azFbtZhUYFauTZyRMEB:Aioa8wrCHz3ZhUYRADB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310596, "uuid": "0d16cee3-ebf2-4127-ac22-a9ac93940531", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310596, "uuid": "d99df1db-ec89-45a0-bd09-29152cfd161c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310596, "uuid": "bfdc480e-4104-4879-b392-0bd683714258", "value": "d0bf0d14fe6110f185c8b98423c7b152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82819910-bda9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678277125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277125, "uuid": "1c304957-38d7-4cf8-980d-2043c9df8a15", "comment": "Malware payload (GuLoader)", "value": "a514bb17edd4f17598fd3a7ebf844626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277125, "uuid": "b51fb2bc-fab8-41d5-840b-25d9087a1aea", "comment": "Malware payload (GuLoader)", "value": "29da2190a5e040e36cf79c7948eca244100b64eea9236b7279f97381fdc3e695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277125, "uuid": "706989db-678b-40a2-a97c-eb72de9b1dee", "comment": "Malware payload (GuLoader)", "value": "d97d40727ccd6e986d1dfaa29f2fab0a120d4570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277125, "uuid": "b824f038-914c-407f-9be7-5d81562b4d2d", "comment": "Malware payload (GuLoader)", "value": "933f15d947d2d9db49a52d88512f4b407071e768279151b7c3805c1656b4a4c6ef777ea6bbfc7881e2f2a60edebd5553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277125, "uuid": "762450fa-b355-40f5-b8af-d0929c1a7745", "value": "T1205413A152B8C4C7F5B2583348322E1B4BF6D9371110676723E4AE8DBE367C3561B6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277125, "uuid": "912e3967-7785-4641-a00d-7a7e164527e7", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277125, "uuid": "9e688309-3685-4317-9a42-b56ef0f3774d", "value": "6144:qicFyLNwIpC0p/iGtKC1WHPADZEKyKIRAZ8epLAof9YF:FPiIpC2tKGWHCH6AZppLB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277125, "uuid": "fa6eb024-c918-43a4-8fdd-1353025b132b", "value": 289456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277125, "uuid": "16b62ca0-a476-4a54-b62b-c8f5004bd8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277125, "uuid": "a29ccd8b-5171-4a4c-83d3-e4395f000219", "value": "29da2190a5e040e36cf79c7948eca244100b64eea9236b7279f97381fdc3e695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741f6e16-bdac-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678278389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278389, "uuid": "62ea2692-3a80-4a54-a48d-f3611afc5344", "comment": "Malware payload (AgentTesla)", "value": "d23f5c35ebc0343a1f8dbea894afdbcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278389, "uuid": "9b3193a9-0b3c-40cc-a7be-07ccd4b18b73", "comment": "Malware payload (AgentTesla)", "value": "29efaf03dee08b4e3f4e23e41b9581513da070dc49e746e91aee2022fef12088", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278389, "uuid": "48afcf5b-fe0d-482b-9dea-d6ec24b46fe1", "comment": "Malware payload (AgentTesla)", "value": "565c998663db4134a155180e97506ec74c555054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278389, "uuid": "4fc36f02-9857-45de-88ef-194fa1aaa7c2", "comment": "Malware payload (AgentTesla)", "value": "0d18b2f173283980052cd32ea388e11be04814bb73a528f91166fcfb5db46180e753b195b2b3a2ac1fadf1b5df0d8b2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278389, "uuid": "aed9f171-07d4-49bb-8d96-5f3a9bad24c5", "value": "T1DEF4F18036DD1B68E8AE57B42835B0805376BE1A6975D72C7DCA30DE0E327464376B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278389, "uuid": "50836c4a-ad1b-40b9-b891-de696869d46f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278389, "uuid": "c938c83a-5921-4ec0-a3cc-ba1be608e1e0", "value": "12288:0lptpZh6q6/TKPzG7qe5oXBo+rfVTnPAyzWIGCkrwm6Cg4Z2N8vtC535WrlI8rc7:0lpRY/TKPzG7qei60BnFWdCksmXrjrlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278389, "uuid": "9b6b82cf-8627-4814-958c-9deb75337604", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278389, "uuid": "77e98637-79b5-4b91-b9af-69116ccf0165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278389, "uuid": "5fff4d11-a219-4162-9577-54df25590a4a", "value": "29efaf03dee08b4e3f4e23e41b9581513da070dc49e746e91aee2022fef12088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cc2080-bded-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678306229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306229, "uuid": "1e1cdd19-cf4c-4ace-96a6-18f6c4f4edb4", "comment": "Malware payload (Vidar)", "value": "a1a76ba5f87291d86ac185c347f08d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306229, "uuid": "be3285d4-85c4-4cfc-9568-9b5c48f7e55d", "comment": "Malware payload (Vidar)", "value": "2a1884b9a7105976a3337292739cc3b803494c670ba49e974bda2a1b2fd39ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306229, "uuid": "49ad9efe-f6d1-427b-b40d-f008d47cc373", "comment": "Malware payload (Vidar)", "value": "3a8ed72e3b6e78bfddf234911ea7180db1b8c526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306229, "uuid": "9c55d7d9-0fea-4c4c-811a-a08aeb11e539", "comment": "Malware payload (Vidar)", "value": "6cf695820b4047b5746cd0e5e93a020ba5fe7b2211079ba3da7b14d20f26d61d2d1bd1e5e2dad653ec70b57b4329d211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306229, "uuid": "675e0868-5f11-4e7f-b4d9-e4a3f7cce19c", "value": "T1D5849E24F614E43AE0520174BB5E9BBBA87C69B51317A4C3F3E40DA92DF12E11A3971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306229, "uuid": "50d196d6-de6b-4a48-a5e6-fca540354075", "value": "99f187ed44bb12c4baf6a0325071b47b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306229, "uuid": "efa6a9ec-15cf-458c-af92-a831b491b164", "value": "6144:iVv/3min9NW2AzQTShI21g6BCW7zfmSazcn4v479Hwy0U5AxuY5KAl:6v/33ntA8A1phKJcn4vsQyWbnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306229, "uuid": "6a375345-7059-4885-b041-4886dc00f76e", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306229, "uuid": "790c3e8a-a819-4363-bac1-65c0707d12d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306229, "uuid": "87fa817d-3b25-436a-9fb6-44125deab927", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453e2aa8-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284753, "uuid": "3198b189-c4ee-4065-8e5f-105ff4db8287", "comment": "Malware payload (Heodo)", "value": "79c0aa2b3cc994e0f349be3d7055795b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284753, "uuid": "db0d5007-c4cb-42a9-a0c1-797d026d9f13", "comment": "Malware payload (Heodo)", "value": "2a7b65c958ee11668caa1efadf2cb35d51025ba447c7610c6142cd870903054b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284753, "uuid": "1e9eeac8-5b86-42ef-8bd4-d0a2dd70d241", "comment": "Malware payload (Heodo)", "value": "ba52ab9f924287f80a340575ff359fa760a5ffa5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284753, "uuid": "dbbfce98-7a12-486d-b1d6-d82617ff6831", "comment": "Malware payload (Heodo)", "value": "2474464baa607cd89f51e67c0d8fcef7954c44cebbd1d19c17c2778ebf8fb2f444885bce357011a8fb6a54a18f4de778", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284753, "uuid": "12abe65a-e02b-4f47-8bc4-92649b43a33a", "value": "T10215233C5F66790FF5997C362AF3847AFDF90858DC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284753, "uuid": "be22d19d-d69a-4e7b-806e-b076f9fa2fdd", "value": "12288:f4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sE:gevtlkdJe4m19Fg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284753, "uuid": "85a8b0fa-3c82-4ae8-a173-2ee837838e81", "value": 891983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284753, "uuid": "699a78b4-8fdb-4610-b7cf-3ef759fc1540", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284753, "uuid": "4f7cd34e-ce78-47e6-891f-7459970d2d8c", "value": "9EA4X4t44VGyKpJBnvXs7ug3w9Sn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba39c25-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277811, "uuid": "4199aab3-12f6-4d6d-ac15-c80264bd8880", "comment": "Malware payload (Heodo)", "value": "4120ce5ca54a7f066241491889178897", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277811, "uuid": "f33a2cf3-b4e8-43c6-9e8e-d46430124401", "comment": "Malware payload (Heodo)", "value": "2a85d34f09898cfd4390fd4fdfd5e181a9ab8b76fdeb19e48c4121c642d713e5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277811, "uuid": "97dcf8b0-ce12-4302-b922-e455f1116307", "comment": "Malware payload (Heodo)", "value": "a4af46b0d854ea7b030d90b29f18b926885626d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277811, "uuid": "8d3aaa7d-fa3c-4135-b4f5-aa9dc1b1e89d", "comment": "Malware payload (Heodo)", "value": "94309efc1c54075a9dd12249cfcd57ad53d911517dde9be415ee267c5fef4e4cc32eb04ca23573d4ffa2b523e303d504", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277811, "uuid": "d8d24678-e179-4b6c-9b1a-2535bf2f6788", "value": "T17815233C5F67790FF6997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277811, "uuid": "726e5147-140e-4185-9db9-12b76413dbf3", "value": "12288:I4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s8:/evtlkdJe4m19Fgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277811, "uuid": "21c69cdc-2dc0-4098-bd7a-c57af99fbd04", "value": 883848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277811, "uuid": "7d104776-357a-4f0c-9960-3b878e61a1ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277811, "uuid": "ca003cc5-3910-4477-a229-b09a0e3b1f55", "value": "8iiDrwsKLfcpr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d13a0e6-bdb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678280122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280122, "uuid": "f79d112b-edf4-417b-bfbf-b4326877ae67", "comment": "Malware payload (AgentTesla)", "value": "0be37234dd34ed5ab4576c03e784b816", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280122, "uuid": "b8f23efb-05d0-493f-8c01-e43c5588625a", "comment": "Malware payload (AgentTesla)", "value": "2aa7830bd0c60930dfdb814f1950addafb6887093bce8bf8f010b42f240cfdbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280122, "uuid": "1d7d1104-6435-4156-ad5f-35156dc2377a", "comment": "Malware payload (AgentTesla)", "value": "35243aebb55179136e7574ac22dd8f5ad5bb4a62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280122, "uuid": "6ab961e6-3353-444a-a624-78cea2d9e62a", "comment": "Malware payload (AgentTesla)", "value": "ba769ef0f445dcd1d295f85c1c5ff80965d675a68db2bf23ed02fb29391c24020adcfb7ea0e73fc950b77c8fe344a32c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280122, "uuid": "22745360-a2c9-4efa-bb2d-cc07402071fa", "value": "T168F4BEBC7794FD4FC0178FBA84142D00A661B4775B03F383A44B15A99A0EBEE8E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280122, "uuid": "03c08076-4161-4c1a-b892-48173c31aace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280122, "uuid": "dd3ef255-fe85-4683-ae7b-e17b1c54d091", "value": "12288:HCc3shfZ+qzQLhdcN87src0zL2TcBV3StRca2JuOogyzrw5e5Tcy2paOw98SxYSD:HCRfwqCfkX0c7yqaEu3RrwppUOwSeYSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678280122, "uuid": "39b556ca-cfe9-4804-b78c-ee78b52dea0c", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678280122, "uuid": "c6e17fd5-fc92-4b3c-b2a1-5ef20116af31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280122, "uuid": "d0b405bf-746e-426d-9d64-95e04b91c296", "value": "2aa7830bd0c60930dfdb814f1950addafb6887093bce8bf8f010b42f240cfdbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7705e37d-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678270663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270663, "uuid": "0f4fe1d5-4183-4e17-b774-68a82c9b74d3", "comment": "Malware payload (Mirai)", "value": "05a87a315245d2d48f46b647137b5efe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270663, "uuid": "3fcaaef7-3a08-4a4b-abd8-1468cfc3302e", "comment": "Malware payload (Mirai)", "value": "2b1bb016b4efbaaa89bed005df7e42ba418ec1f9d19a7ef8371d50b349a53d17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270663, "uuid": "314a26a4-8222-4a44-aebd-ecc0d665830c", "comment": "Malware payload (Mirai)", "value": "600c79583c6149cda103bde54861247c391b5f66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270663, "uuid": "2aefca7b-e232-42df-9125-844da4d086e4", "comment": "Malware payload (Mirai)", "value": "10a722eab4823a291a18e5d820ad1a6bcd57bf702f4883b1e2792b72c922f3ef6fb0081d733f961a3e08b25274fe5066", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270663, "uuid": "43b91737-179e-4c06-8fd0-cdc2369e7af3", "value": "T1C563AE3BE8065A44C086017074A88E796F23A5D893972EB72AF9C2758447FEDF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270663, "uuid": "04ea222b-f03f-4c5d-98ab-e289407ea206", "value": "1536:gaX/FKVtShlkma2/C4gxuCaD6i+KwMs/wA2JCEsSvTGh:g69Kby+ma2a4gwBxwOA2J5vT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270663, "uuid": "099fd024-c805-4ac6-b438-74161c2edd1c", "value": 68468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270663, "uuid": "016585bb-052b-4cd2-8bfb-a2ee1f8653dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270663, "uuid": "4d8249af-1f9f-474f-ba2e-d810e6755e07", "value": "05a87a315245d2d48f46b647137b5efe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed8a239-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678270542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270542, "uuid": "332408f2-f4c0-4adc-8529-3f79d24aa477", "comment": "Malware payload (Gozi)", "value": "b53e7a4f7d03dc6b34760a66dc7fefdf", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270542, "uuid": "41e31ba4-3027-41ac-a3bf-2435785db20b", "comment": "Malware payload (Gozi)", "value": "2b31a64f7d221dfd8ac33edaf101a4c1ac73f36dcd7abb976517fb1e90750544", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270542, "uuid": "240e8d84-2123-4af6-8012-8513c155ad1f", "comment": "Malware payload (Gozi)", "value": "e4bb248848451813b7325c001910defaf262e58a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270542, "uuid": "c845c60d-1ad8-4f23-8e68-1c634617f85a", "comment": "Malware payload (Gozi)", "value": "94b409a7b2f261893a79fc1b3eb651e1311101fc4d874187c095ad0fe82438e2409860633389c2503410641838c285b6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270542, "uuid": "e14d0e57-92e3-46f1-a0a1-4bb9ffa09fb2", "value": "T12F148E0253ED6C21E1725A719E3DC2E4662FFD539D39666B2214EF2F09B02E1C573722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270542, "uuid": "aa57e858-8abd-4645-8a53-07b25376df6e", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270542, "uuid": "9580eddf-5250-4a71-a1e6-620fb52ec869", "value": "3072:6F3QsFXipai+ZJY0glWqUeMV7oog/Mhej01QDnLjmH52c:bWX8ai+Za067UnVU/0hS01QDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270542, "uuid": "d735de9c-065d-4cf9-86db-07a7b821497e", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270542, "uuid": "d78dca03-3a05-41d4-a404-3f7a40c6c07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270542, "uuid": "ec651c16-14d1-4f66-8f29-9d84d926423d", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d685c5db-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299170, "uuid": "afa5cb04-a571-44d4-88fd-f8ba47efd5d2", "comment": "Malware payload (Mirai)", "value": "b4553466c366fc42fa2d60f1be2cdfdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299170, "uuid": "69aaaf63-30a7-4ed4-b8c6-5332b3107549", "comment": "Malware payload (Mirai)", "value": "2b7835a60b8531b9052faa7c281f39b2359c16c51eef4aa09f6dcf9a97e07a67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299170, "uuid": "df0678bb-cd4f-4d8e-ac02-899016143968", "comment": "Malware payload (Mirai)", "value": "1b29fa573e366cab8764cce9fb7b45340ac6bd70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299170, "uuid": "ebfcc90c-31e4-4698-aa0e-52fa751bf935", "comment": "Malware payload (Mirai)", "value": "868e08d20cfe9b33cd6c67d97fe561dc39d29cd9011d0dfc14ec1a7ece65e25661a523dc45121d835f8dc90a5ebd2efb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299170, "uuid": "56cb35ac-9abd-43d5-8abd-d02cb51cb597", "value": "T13683A51E7E218FADF76D823147B74E25A79833C627E1D645E16CD6002E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299170, "uuid": "fa29fc63-e9fe-408f-a477-e72149944260", "value": "768:Gty6IP7s/kq0INRhPe92EI9tl/dOCV6YAHSRHsgc4Eo60T+LzT6LfGG7HBP3riyu:Bakd32EI3OC8mJHT+L6L9NbeNHMWsrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299170, "uuid": "b0b81924-6c3d-40b0-9fbc-eb4d5acb2ec1", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299170, "uuid": "d31904f3-37ac-4bb9-850c-2aabc8f43319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299170, "uuid": "1ecdbe78-f928-4641-9557-770fb3134963", "value": "b4553466c366fc42fa2d60f1be2cdfdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756f5b6a-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276674, "uuid": "f268ee31-00f5-44e7-8ffc-4746ec4d2489", "comment": "Malware payload (AgentTesla)", "value": "d78432b598f99365e936d3c65f9b4b93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276674, "uuid": "5614f484-f838-48d4-b47f-fd7a46704b71", "comment": "Malware payload (AgentTesla)", "value": "2c7dfa6906765652008e5cf9836aa622f3bc1a0d2dada84db3b4acf1f8d33d1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276674, "uuid": "0f4bb716-cade-4f80-a9ab-378520a27c49", "comment": "Malware payload (AgentTesla)", "value": "8c0a6550380e867284d138cea54c0cbfe6a1ada3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276674, "uuid": "d99dff1d-5d50-4046-8906-bb50dbf9ee1a", "comment": "Malware payload (AgentTesla)", "value": "aed960112636d92cffd67b4de491dc95e5bf9188c195de8ac9bb132b0ee7501075642e6272e2c9a3bc409071ec70e4ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276674, "uuid": "3bbbf871-6752-44e3-9021-66845d4e345b", "value": "T15105AE9977B46573F8CB01FE5838278C2D2025177609E22F9B77BB91A2709FB72D9102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276674, "uuid": "e2c85f6d-3c19-4334-a70f-f3653c02e924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276674, "uuid": "86ecdc62-5d8e-4e0f-ac85-8630149ae7f6", "value": "24576:cky9IISG13K86w5TSB2mQ/6RE7QHFnBAxeP+w9f:KJK8REpIOySJSxO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276674, "uuid": "d8fe96ed-7d54-4585-9c8e-5acb40f70a9d", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276674, "uuid": "06118ed7-d9a1-4d29-b49c-5b0a66b4309c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276674, "uuid": "a80286a8-4f35-4424-b6f9-a4b1218e5f25", "value": "2c7dfa6906765652008e5cf9836aa622f3bc1a0d2dada84db3b4acf1f8d33d1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b373c966-bd58-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678242418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242418, "uuid": "755737b6-cbb8-4913-819a-d933fabc2952", "comment": "Malware payload", "value": "3164bd50674c7af7f793631116a76e11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242418, "uuid": "abbf2b1f-6735-4b79-a9a1-5b82eb891ae9", "comment": "Malware payload", "value": "2d8af9c0a950b2cdea226fd9821b607fff86970f091a98520f4a82b9deb39239", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242418, "uuid": "5baae4e0-3c3d-44de-97ae-cb5a1e64d31b", "comment": "Malware payload", "value": "177f9dd98c1994bb72c176f243e5a660edd032d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242418, "uuid": "0ca5379d-f8d5-4b41-b644-157d67fc5138", "comment": "Malware payload", "value": "d6580ebb50319305edcfb18d92a8492645a8dc2956c07417fcdef59093c612ac3411d68bb0eab25a3fb2fa9c3d3a460e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242418, "uuid": "5cb8a9e5-e65c-4dec-8e99-05a8226f47e1", "value": "T108E3D702BAAAC9E1C2D96777C5E5401427F4ED92E563DF1AB5CB33DA0837B668D03603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242418, "uuid": "100fba66-6201-4177-a739-c9de32553bb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242418, "uuid": "c6e1ab4d-3db0-4de1-ae75-3fea27887660", "value": "3072:SEWlGwmu05wiqsRTedN/cl1ID/6WymLmOi:bWRi5HdTqUM6ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678242418, "uuid": "0534c8f4-a1a8-4cb5-8122-a0341995a895", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678242418, "uuid": "add7b022-43eb-42a8-a1ef-623b4ec8044d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242418, "uuid": "a2aed041-8725-46cb-937a-e0819d182265", "value": "3164bd50674c7af7f793631116a76e11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5404cf97-bdd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678296804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296804, "uuid": "f6791df5-0fd9-4ec5-9c2c-e85a4271118b", "comment": "Malware payload (AgentTesla)", "value": "26b7a806abbe957083d02a19925f6f86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296804, "uuid": "e3f50e4b-a7aa-492e-87ee-306fc81a71b6", "comment": "Malware payload (AgentTesla)", "value": "2e08e5990d18ca8f59e41b3224cad6032e533ac94b734f9ac4763cb6069ae990", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296804, "uuid": "ecfb9e5f-32cd-4719-8478-1711046faccd", "comment": "Malware payload (AgentTesla)", "value": "8a37e8227a0ff8d3cc663a70e2ae43565b1f4bfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296804, "uuid": "73f8770e-1d2c-41f7-9030-556bfd275494", "comment": "Malware payload (AgentTesla)", "value": "23466b34611e1aacd5c14218f3662e8e2a8c163fe13cb535105a6c7b2ac7f6c4861910da4d8e9188da006df03ae3b040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296804, "uuid": "0f3ea0ca-6755-4db8-aea3-eb8c116df1c6", "value": "T18A154A3CFCB66BCAE236F7734657E610F6F880F27311D9162EE2844446A0671A2CE51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296804, "uuid": "9ec83965-9345-421d-8fcd-e03c3fd97d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296804, "uuid": "fe9ea2a0-804d-4360-8c67-f06e418bca80", "value": "12288:DQOoIPI3/g25Bfsjs4IWbkN/vZBTlGIrsBcwRQfBQfX3DSDr3ui:D56Xis4IxXPlGIrERaCDA3ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678296804, "uuid": "9bfd00e6-ba6e-44ca-b934-fa23a8f6b6e9", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678296804, "uuid": "7391e78f-2ef9-4fc3-bf5f-ea59ebb8214f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296804, "uuid": "da01cac5-1c62-469e-807e-522c4d68b06a", "value": "sammie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1923aa0a-bd4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678236146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236146, "uuid": "47611940-a9ea-4c71-9b87-8f5d78c8ac07", "comment": "Malware payload", "value": "ced2f9f51660a7843a2f63a3579a9275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236146, "uuid": "5c4752ec-be56-418a-80a9-ef059d4f21c4", "comment": "Malware payload", "value": "2e574712e1a0abafdba35c386299efdc02b758534abacca1843aec4c4b7eeb37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236146, "uuid": "f3b1798b-843a-48ac-a460-f9420e26909f", "comment": "Malware payload", "value": "ce5ce8ad511a5aa299d5e79025fa114511e5a99e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236146, "uuid": "adc36ea5-e0d2-43a8-a2f1-eae7d33eaa63", "comment": "Malware payload", "value": "134c21510905566d1e2076cdb38c19a9398f76bd6a2c1d510120efa9207d7c1ae33fd67f2f040c802279f9ad6d7b0247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236146, "uuid": "ee14fc3b-9097-45ab-ac6b-94bcf6b380c0", "value": "T1010633C7F69C9769DDAA10B181F6CF01C32389662055CF776A82F26A8DB319587B7C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236146, "uuid": "adb59c3a-227e-4084-945f-0d6bd8260e25", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236146, "uuid": "f0eea204-c0d4-4bbb-9ae4-11469638a882", "value": "98304:R3dWuUPeZBYHmE6rGO+v7WUTBXo0U3p2d/dT5:R3dJUPeZBYJ6qOKTrUi/F5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236146, "uuid": "b8afdb0d-a4b2-4e76-8262-3f149ebab232", "value": 3769344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236146, "uuid": "e725b415-fc87-4431-b009-563ce10f35c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236146, "uuid": "fbe2daec-6f59-44a7-a8f1-25e148638742", "value": "SecuriteInfo.com.Trojan.Win32.Themida.9202.4364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afea8ddd-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309413, "uuid": "599003b0-6af7-45aa-a5e1-e00dfe41ec84", "comment": "Malware payload (GuLoader)", "value": "aa719986e00551f6abd0f1c021ccd28b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309413, "uuid": "ebe6bd58-7f02-4fbe-a865-b47257aafb2c", "comment": "Malware payload (GuLoader)", "value": "2e66f8233cab52547712918e51a8c53bc2562162f396f344ff710c8e31a1e234", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309413, "uuid": "1e3a0e0b-b425-4713-bcb7-ac22b2f7d177", "comment": "Malware payload (GuLoader)", "value": "2ab996c9300be3816fc21b19dc05d2edc6022938", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309413, "uuid": "97b24f71-26a1-4251-9895-329913ad4e98", "comment": "Malware payload (GuLoader)", "value": "bfb2be14810da2206436284fcc3d8718959ddeb1589e47a7b1ec9893e46d6180b146b706cf6a446e910b637bd931b9b0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309413, "uuid": "d18d8a85-307a-4b72-87f8-09abc7a734c8", "value": "T141536C6DAA873E48055F7FAE848B08F8B04C07B27435557D3828B5ED1B01F36AB5B4B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309413, "uuid": "d58c83cf-a8b4-45d8-bbdb-5d02acf63408", "value": "768:mMnUrtopOyqAsi3VSPjGjybiXSypcsEb8ZLqDbNGmibPJQkFY17zZ:mMUrEnll3VSPjr5yesEoh4chFCXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309413, "uuid": "2ef76605-07ed-41d7-a472-bbe2ffd13f0b", "value": 65592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309413, "uuid": "31481934-7a39-4f6b-8b91-fb252117501f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309413, "uuid": "aad7e85d-08ff-43a7-bd02-20e08171f058", "value": "Factura de entrega.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c686be-bda2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678273981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273981, "uuid": "3ee19062-fd7a-47c0-a00e-b9fdc4ecf14f", "comment": "Malware payload (AgentTesla)", "value": "87da86532d8020b5f09a43d00c1f6d68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273981, "uuid": "0351eca4-166e-4569-a9e4-9afe9e10a13b", "comment": "Malware payload (AgentTesla)", "value": "2e99a044f7b869992835fd5bbf9d5d74f55b94c2fcf7d29e3781be3bb345a128", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273981, "uuid": "354ccbea-f10e-444e-a0fb-d7059dbddf2d", "comment": "Malware payload (AgentTesla)", "value": "01aca40f58ef65d3a9078cf153dad5c2c81c2712", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273981, "uuid": "e2b2f25e-84a4-482e-96a6-1013d122faaa", "comment": "Malware payload (AgentTesla)", "value": "0b1e64a38b7fae03d670393d231979000c06e8d2de3aab99933dfc7c4661b90c2ac3c7bb6df493bcf2c6eb04d81a14e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273981, "uuid": "bf6b313e-057c-4996-a2ea-38c02dbf0d97", "value": "T15AF34BE892CA8E51D72D41F4C4B0014427B2E1479217E7AD5FB1ACFA3E467C3762F8A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273981, "uuid": "2a152c44-36ef-46b1-8474-1ae04802797e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273981, "uuid": "4165dbd6-2bbe-4ad5-b003-caedf6e0b1c9", "value": "3072:gfVyinxYvLcq4/Bb6R+rP5EmUFYpZAhvIOk9yV9O1mBmrNTRVz:oyiWNh+L5VUFPVw19NVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273981, "uuid": "d06c907f-dc3b-4a3b-9399-52eda8c548a1", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273981, "uuid": "8d23c7bd-5be9-4622-b101-6c1c1ef3ef77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273981, "uuid": "94742155-b4e1-4af3-a9a2-ed7aaa24a3cc", "value": "2e99a044f7b869992835fd5bbf9d5d74f55b94c2fcf7d29e3781be3bb345a128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fe6623-bd49-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678235896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235896, "uuid": "748491eb-22f6-4e18-bc2e-4ed5c725afeb", "comment": "Malware payload (RedLineStealer)", "value": "0e598ae27453b8349302a232a8fa3c8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235896, "uuid": "6babd34f-b52a-4908-b587-2cf144ab231b", "comment": "Malware payload (RedLineStealer)", "value": "2ea0bdd6a345b67435ffb4208a1fd0d05057a590cf2030e6b49887815ae6dc44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235896, "uuid": "f319f660-3082-48f4-b1d7-79c9a621b048", "comment": "Malware payload (RedLineStealer)", "value": "c314d820ba348ec2a155a2fb1d177af33d36d0be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235896, "uuid": "2f492d46-a1d8-45ec-b56c-11c068ae759f", "comment": "Malware payload (RedLineStealer)", "value": "732f90481d24c7368549d390cadbaa739268c98a9b0190219ed903cd3f9d0eb602743a5b1282a739b328abfcf4b11e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235896, "uuid": "51291da4-bad7-4a73-bdc3-383645876165", "value": "T19784D013B7E17FE0D56646B2BE3EE6E87A5EF5548E05A72A12388B6F08741B1C173301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235896, "uuid": "db72c6b9-1356-4436-8c51-ab62c47611ef", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235896, "uuid": "a7ccd959-7a34-4af2-913b-f8d00449372c", "value": "6144:FwX8LaJrZVRMbVLFOvJw0rbeEbPmGO6XSP5liYopP4eUM:2suJrXRMbVwSubD+lkUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678235896, "uuid": "5bed8a1f-5583-47ed-adc6-a9ce5b809ff4", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678235896, "uuid": "525f7233-1947-4614-974f-cdc5761324fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235896, "uuid": "9a4171b1-f9d3-46c2-b461-940ee5df5657", "value": "0e598ae27453b8349302a232a8fa3c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11ad211-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1678309496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309496, "uuid": "4010521d-1712-4336-9f36-b25d044fbac8", "comment": "Malware payload (STRRAT)", "value": "adb36749976a14db121304c1612c7188", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309496, "uuid": "ef816aad-225f-4ed5-9099-55ba9adea202", "comment": "Malware payload (STRRAT)", "value": "2eaccc6e1fc6b97d37dd32875a0eb94e322183ee5aab3a3780490e67b2523660", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309496, "uuid": "e205ffb0-5d55-4efd-b0e1-8c7689a2f776", "comment": "Malware payload (STRRAT)", "value": "09abafbc2ccbc193553f25608956b98dfea4bf37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309496, "uuid": "06d4176c-0645-4c1f-a675-a4965d11b959", "comment": "Malware payload (STRRAT)", "value": "3caf1537b2efde5e477c1c76a27d8018a0397c112fdb72f52810309c8542f5bcf9a6bb32c428c878fd6feee6f48d1988", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309496, "uuid": "a2c0cfc0-b66f-4e73-8ab4-15b68ecae3b5", "value": "T13D748C2570AC12E5F764111EFCE6BD1F8BE05B466874FC4B2125ABDE6F2EA0A840F14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309496, "uuid": "b4aa7b7d-ede6-47a8-8702-319ed6ebfdfd", "value": "6144:GQK61SLbw3aXKzuarfLP3N1gGmpBm4W5aiKKEdaKLdEx+cGEh5b+Agqksqkv:Npw/w3fzn1qvScKEdaKSrGErPkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309496, "uuid": "04047016-a9dc-4c7c-9788-4d39511aa9dd", "value": 340777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309496, "uuid": "a20c1819-0ae8-4085-ad29-a67298cfcf13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309496, "uuid": "10ed0ea9-3b64-4912-9277-42ce410f3710", "value": "IR083766363023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f165f5-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678309561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309561, "uuid": "f4615428-26b4-46f2-b6d1-cdfcafa91817", "comment": "Malware payload (Formbook)", "value": "59c136d7e714c16d71eccd5866a2f947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309561, "uuid": "775a8bcc-ceb6-432f-b347-0f4d7fecca07", "comment": "Malware payload (Formbook)", "value": "2f040ceba0282e33a44d08e54dd69ad0f3cf323421975ff3ad4161f7aeb6655d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309561, "uuid": "66f3ffdf-f735-4970-9882-7f3c847a4505", "comment": "Malware payload (Formbook)", "value": "3e9c7a762714ec22538c32650699771b5f8a75a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309561, "uuid": "28b53b29-2380-421b-8fc9-b20798f3667b", "comment": "Malware payload (Formbook)", "value": "b6b61209f281b125d3222857b0f28c7d0875e9104b6e7da837f65c8cfda63963a846d0d1e074df0669f23129167a3309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309561, "uuid": "1f7a8de2-3dd7-4f35-8a67-21a882624fa2", "value": "T1B644131C7738C2E7C8A34B711C391A6C67E0E0621156865B87B0D95EFF126AA7A0FB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309561, "uuid": "0cb05fde-71cc-4060-98ed-5c4d5d09301e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309561, "uuid": "99569dfb-79ea-4d0b-93cb-4dafdc2294b5", "value": "6144:vYa6Hxg2uIn0WLudQacB9S2xG9vXwNx27kP:vYVkW0WLudQ/vG9PwG78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309561, "uuid": "ea40abbd-a9df-482c-8382-7f4e06d84972", "value": 256415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309561, "uuid": "eb974b08-d7bd-4489-bc0d-29ec48573a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309561, "uuid": "efc6fded-0494-4de6-a35f-52bd05862905", "value": "payment slip90987hsbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113f9918-bdfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678313442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313442, "uuid": "c00ac149-68c7-4c95-8910-affa6fd5d6b9", "comment": "Malware payload (AgentTesla)", "value": "edcfb2ab44f71460cac094e2ce2237b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313442, "uuid": "7f14495f-05be-47f6-a79f-73b79e22b1b0", "comment": "Malware payload (AgentTesla)", "value": "2f158e546b8b058f09ca3ef1ca87a4d6d03c13b01ee6d2cf0eb9e2b308dd9c1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313442, "uuid": "dfb27dd9-5695-4cac-a58f-8e49ba19d634", "comment": "Malware payload (AgentTesla)", "value": "859348357a5d520927db89f04d3c45dfcf636b04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313442, "uuid": "dd4e05c0-250d-4951-99ab-c4b4dc9ba45b", "comment": "Malware payload (AgentTesla)", "value": "8b8238c88e59e570c6feb89a10e5e3067e719461da8265548ba9146ef8f441c0df4e6342fe3c6b96b0117eb4fe82fc39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313442, "uuid": "c846a6c4-744c-4345-a3d6-c3120e2ff628", "value": "T17E44126637E8C923F0F956719F7ACE43FEF96E241748559A43500BA73F21991C40E392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313442, "uuid": "159034e1-0b8f-4395-91fa-ca3cab444b5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313442, "uuid": "4cf77023-1101-453b-9c7f-b173cc3e2886", "value": "6144:PYa6+dfs3EZPXv3aRNmTODVrHTvcyf52wCzXrmStdCSDsF7:PYghs0ZPXfaRYTOxEI4rzaStdLk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678313442, "uuid": "58b379e4-b810-4b92-b98a-3ebd5b4dcd24", "value": 274131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678313442, "uuid": "2688f091-0ae5-4d8e-befb-7ef326b22c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313442, "uuid": "a7c12953-623a-4013-899b-22341dcbd550", "value": "edcfb2ab44f71460cac094e2ce2237b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7aaf40-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279501, "uuid": "30c38eb0-6612-4575-bcf2-3c6342a2da87", "comment": "Malware payload (Heodo)", "value": "32dbc84f568d672ffadb35483d16a68f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279501, "uuid": "ead90a78-55d0-44c8-b8e7-2fab8a329234", "comment": "Malware payload (Heodo)", "value": "2f25effa257dce27b6dd816731c973d0baf26e3372abb6080b740a73bbdde3f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279501, "uuid": "80167dbc-3f2a-4a87-ab79-0c44feed1cf5", "comment": "Malware payload (Heodo)", "value": "bddf33bebcb493518bce2ea7d8da40ce8903bfa1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279501, "uuid": "f6b03b99-e042-43e2-a478-44df3b369b39", "comment": "Malware payload (Heodo)", "value": "8834593740ac4769adca2efe111a37d26dacefccea6f7abd19cdec8e6173ef4f78eb010a6247e2592b1fea9deb79d410", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279501, "uuid": "bf3f7fa5-e41f-4c77-a5ea-359022827609", "value": "T13D15233C5F67790FF6997C362AF3847AFDF9085CDC96E90A17431A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279501, "uuid": "f7789277-90df-4f30-bdb6-e26296bcb825", "value": "12288:j4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sa:sevtlkdJe4m19FgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279501, "uuid": "407fdca4-6283-465f-aeaa-dcde6cb8f535", "value": 890947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279501, "uuid": "029522d5-afb0-432b-b330-18444ee0e66e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279501, "uuid": "88d1d782-313f-4bac-afdf-def4ce1f1d74", "value": "stqeHoQcf2VM69.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e7c8b9-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309442, "uuid": "a83f5a9a-aab7-459c-b6ff-2bde463aa82c", "comment": "Malware payload (GuLoader)", "value": "4089966cc6a9016979a367081f0b3792", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309442, "uuid": "d18806c5-09c3-474d-9cec-df2d16c7ac9a", "comment": "Malware payload (GuLoader)", "value": "2feafb78beb7381d337724f432bf18c5ac0f5721a7172607f890e804661152cf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309442, "uuid": "6227a346-cbf4-42c9-a465-79edb4cb3f0a", "comment": "Malware payload (GuLoader)", "value": "ff0fc23d647274c7912cfa1b403e4d35d3379e7a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309442, "uuid": "f453faac-bc4f-40d3-857f-3ddb64d270f0", "comment": "Malware payload (GuLoader)", "value": "7997074e2630cccba80262082751b86d4f88599ec69eb4b8946149f08c89302268d0394aaca1b56811fcb6830045f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309442, "uuid": "31ce42f5-ba5d-463a-9155-03cd7920deb6", "value": "T16CE439FF9FCE161D0A0B3A5F8C4509C589A05B391E12042B5ABD261FFD061CCA6BB7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309442, "uuid": "7ee38b21-9f77-481c-8afb-4c735ee0a913", "value": "12288:zxfFUQtu76NGddw7cinDrkbvglXjNq2Ez9eYPNRRPAfFjF0f:zdediF+/rOfFjF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309442, "uuid": "61f26946-d59b-48d4-a77a-2332d037f001", "value": 676110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309442, "uuid": "73720895-8755-4491-8658-f8c99037aeb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309442, "uuid": "d6cc2054-2a09-4d59-9c09-f136a4d7b41b", "value": "017060_Factura_Z23-21350pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8360c9a1-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266819, "uuid": "e9fb7776-c824-42c5-89ec-8fad62499054", "comment": "Malware payload (Mirai)", "value": "457c0a56b9b3be299915511b068746f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266819, "uuid": "e133064e-a648-4d13-ae12-f0b95762b14f", "comment": "Malware payload (Mirai)", "value": "30f50b7ac25ced1ad28d26242bd09cccc686d6459f5b836c816d296b94a6e0b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266819, "uuid": "a6dd70a5-bf1f-4f21-86d9-3037e42b7fc7", "comment": "Malware payload (Mirai)", "value": "b1ba011f5b2d28e86b8a4a58f0c81ee3172dd685", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266819, "uuid": "f28589d9-3ff6-4e77-ab7f-985c379f1d3c", "comment": "Malware payload (Mirai)", "value": "bc8c0c8f64eeb977f7f2a5d7c89af509587a9ed4c4e10587f151f6f5397dbf2cd0b9bda575023ebb6e4dd2445ead3fa7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266819, "uuid": "d5490c49-98d5-4241-877d-c48a56ea98c9", "value": "T1FC635BC4F983D8F9EC5B0970207BFF375A76E5BE1124D783D7A59A72AC51602E102A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266819, "uuid": "a68b6e7b-2f4c-4041-8a26-642ae9b5984e", "value": "1536:NCMc+l7avJFYoSF5yHUG/PCBnGQsDLrgYc25J8EmrSMn:NCJ+l7avJFYoSMHFHCBGFPgJSiEJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266819, "uuid": "8dc01b93-fac0-4437-aea6-fe946deb9e30", "value": 67216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266819, "uuid": "adebc4ed-0d78-4a63-ba26-b76e9160db19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266819, "uuid": "84486678-1b14-440b-a07f-d97a1550abd9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df47c3f5-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299185, "uuid": "77005226-f8bc-433b-950e-23603535b3f3", "comment": "Malware payload (Mirai)", "value": "2593a961173f1e8210a161f4e6673eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299185, "uuid": "9f9134bf-528c-49d4-93c6-15fc1fa4bef6", "comment": "Malware payload (Mirai)", "value": "31031bdc0304212a551f0e8f5aa1bf2e3091aff0447d48f328295914f7b742b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299185, "uuid": "c10cd8e2-7b8a-4a9b-8bd9-5fce4b53d5ff", "comment": "Malware payload (Mirai)", "value": "666179dd36626ddf88c361a4a7f10d16fea1a9b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299185, "uuid": "b8d8cdfc-19be-477b-9b68-c33e03cd7edb", "comment": "Malware payload (Mirai)", "value": "796ac7b898a435368d60dc1b7260bc15fe9cc794069a96577e46992377721e21205efb5f8c2cededbb40506ae042d58c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299185, "uuid": "0b7d744e-2913-47ef-9a02-18d6513c5473", "value": "T114435BC4FA43C8F5DC9715702077FB379B72F1E522A8D647D3B49932AC52612E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299185, "uuid": "5d1461c9-db66-4fdf-8e76-9a4c7c60eaa2", "value": "1536:FEytfbaM12r8ZBG6rMnWR+bxTwSoaEDrkMML:FEytfbaM1zAZnWQbhT3Esb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299185, "uuid": "021ef5ce-3432-406b-bb13-8e9be1c6bad2", "value": 55600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299185, "uuid": "4ddb6cc7-133e-43cd-ad14-0052d568d625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299185, "uuid": "fa412607-62f6-4ee2-b21f-fd4d980afd4d", "value": "2593a961173f1e8210a161f4e6673eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383da912-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268410, "uuid": "e9b3be15-69b8-407f-9385-746c85e807ac", "comment": "Malware payload (Heodo)", "value": "944876d54eb98e7544221ef4d75f8f83", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268410, "uuid": "976b566b-4876-4ce4-9a0b-338da6009130", "comment": "Malware payload (Heodo)", "value": "31ebc039e17d2b7a093ec4e07f5b09bbf291aa0e1c44f87cd6b221a6775fd421", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268410, "uuid": "19c80c60-4e7b-4855-8663-bb5bac751b7e", "comment": "Malware payload (Heodo)", "value": "f015a4572af214aed6955c91806004aad3221c83", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268410, "uuid": "29aa36c1-db3d-4645-ae87-1ab78b54db8e", "comment": "Malware payload (Heodo)", "value": "d7662b69c9b0d700893cec43c607c1360dec9c29591cd417278bc1ea096c92048a6faccd6b6f54f53d535b072a7e03cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268410, "uuid": "36077a62-8f55-453c-9132-5b13aab48028", "value": "T1FB05233C5F67790FF5997C362AF3847AFCF90858DC96E90A17432A9209AF2056794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268410, "uuid": "7cb639d2-2c7a-4609-8b97-6d667a4263bd", "value": "12288:f4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sQ:gevtlkdJe4m19Fgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268410, "uuid": "655498b9-c3a9-4de2-a461-a4ca2e34e0af", "value": 868585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268410, "uuid": "19fd2d70-78c1-4b3a-95c1-4a0f77faf53d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268410, "uuid": "f1096b1b-492d-4f23-8415-c1d0442ca8a3", "value": "MXK2LSdR2XzCx1OT1YzbTO5gHzkc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c35e8b0-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247533, "uuid": "00aba1c3-edbc-410a-9562-a3d85cd7af41", "comment": "Malware payload (Mirai)", "value": "ec5602b582560edb25d07fdc63fa699a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247533, "uuid": "d4ed50bf-1a5c-4ce3-be9e-f97c3e0341eb", "comment": "Malware payload (Mirai)", "value": "31efa39dc88af7bf12790824e436867c80e5da278209c9529bb902a695650e2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247533, "uuid": "bffb6af8-c410-4419-b6b2-d6c8a020e692", "comment": "Malware payload (Mirai)", "value": "ed5848b1dc09f3950f432fb19046c55893789d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247533, "uuid": "4facd827-3789-49bc-8cde-0e6064ad372b", "comment": "Malware payload (Mirai)", "value": "4259a3ad12286e4042c6032b4b62bc79ec922072e6e6edbd3f5edce655ca021c39be84ec33540e9f3f21ea32e934d6cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247533, "uuid": "7686656f-005e-4e4b-bb1b-127a4fbd99fe", "value": "T110C2E1E0B726FD30C4206C3EE52A4D893951067891FF383664259D399EC265A63E44FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247533, "uuid": "2341c94e-2a6f-4740-983c-d4f25616926f", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrmf9q3UELu1:OKy4qfqoeJdXWgmOLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247533, "uuid": "8dc64442-4248-4a2b-a604-035cf0ce77d0", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247533, "uuid": "6bfda863-d934-433f-824d-10bb2d491f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247533, "uuid": "f86361df-e9e2-4cbe-9447-a081a0248d7a", "value": "ec5602b582560edb25d07fdc63fa699a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e547c4ff-bdb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678282445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282445, "uuid": "a47876c6-5f58-432a-a4d4-35e7d3f6f39b", "comment": "Malware payload (AgentTesla)", "value": "ff48431eb8f8aae5c1c2218c2221e134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282445, "uuid": "76d0f95b-fbae-46bf-a096-cc95037b1926", "comment": "Malware payload (AgentTesla)", "value": "321bcda7d38de0888c3bfe28e8f3488689ea9a7005645739a59cf5c66a72d00a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282445, "uuid": "cefc7daa-93f6-4a0f-873c-cd6d24f85908", "comment": "Malware payload (AgentTesla)", "value": "f41004a9345f1bfb502657830d1015a5b14af1fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282445, "uuid": "bb12f7a5-64fa-4a41-904f-c8bb888622d5", "comment": "Malware payload (AgentTesla)", "value": "afbc15f81499671859262444b52b198ec75735f5d4b22513238247bc1ec8a9293d4c21e7e822622a1c16c36ac3c44fc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282445, "uuid": "82c627a8-9f15-43e3-9245-a3918690cc9a", "value": "T1B515CF99B2714177EC8F81794A27C1DF3C00F98B7211E237677B7A42E6591BF7988222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282445, "uuid": "1265a083-0660-4e9a-8f71-4cc327695074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282445, "uuid": "34604ff7-7d2c-4442-aed7-caf466ef065c", "value": "12288:7JEP78/2iNJLjQSdpbD/sI8wqN4qCXb2ut1qUcRIjAPRG6w9zIzLO+P82JLgH:NEP78/1rFfsIeN4qCXb27npGT0zLEcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282445, "uuid": "bbde42e2-d854-4d32-8532-e9adc66507b1", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282445, "uuid": "bc23a1c8-e29f-4ad6-a935-d86efa3bd285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282445, "uuid": "ce3c40c1-8d79-402b-9733-89cbd1a09c8c", "value": "Order Requirement_6000025581-Pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e88f33-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1678276508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276508, "uuid": "dfcd4038-3ccf-4985-b185-12d20791a684", "comment": "Malware payload (DarkCloud)", "value": "8c0b014cf34b210a027894cf98541ea1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276508, "uuid": "b1658ede-bce2-4482-88f4-7f6b981d7360", "comment": "Malware payload (DarkCloud)", "value": "32fda33b00a03bd42a13fb93fc6e5bb63d6845c6fe46d3e68274f13570d68b7a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276508, "uuid": "868cd072-9e24-4b52-8fa8-ff42de705bf3", "comment": "Malware payload (DarkCloud)", "value": "c1a884c6c27d738522bf1ce865bff92fa9fec859", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276508, "uuid": "ade2fb46-d373-403f-89fd-82d0b5524de0", "comment": "Malware payload (DarkCloud)", "value": "9742c02f2bc1f2b1d2513b59da6e39c57323dc586568ffcf5c42075106682dc2823389e447da5d53ef103a4ddbf64ada", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276508, "uuid": "aff2f473-0634-44e8-824c-edbe52a75c0f", "value": "T1F6B57BF19E92FD80D7EB1DA480DC2AC05C581F9B82A98548FCCC3552E6B56A4EFCD1B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276508, "uuid": "7bfde183-3bf4-4a31-aead-55e6cd48d387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276508, "uuid": "97da7cc9-9076-4c26-ab0b-5047aea4eab3", "value": "24576:5ZAlKJIAzfjFsK+6JVTvFCB7BptT73OkzwVwyGe/p6FwEclNY7LvCpMfMV:p/+6E77IGefcCmMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276508, "uuid": "1b9645ed-ea02-4a82-a7d3-a34079aedf74", "value": 2425344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276508, "uuid": "043ee72d-adee-421b-acf0-730607c17065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276508, "uuid": "e3edd9c4-0ac4-4504-b43a-31fce191d1b4", "value": "SALARY RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71cff2d-bdad-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1678278904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278904, "uuid": "ad8b19e6-36ff-4b6d-9c41-624cf6492649", "comment": "Malware payload (ManusCrypt)", "value": "92569f0bc4733fd80a974d67ddb9435e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278904, "uuid": "27dbbe67-12e1-4725-b5d2-24d5d584c4a8", "comment": "Malware payload (ManusCrypt)", "value": "343b71456cdcc0f09baf79a2b0f5befe7043f329899f205699ac3ca2424c8282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278904, "uuid": "1894dc44-0fb1-4738-99b5-f3d9d465c828", "comment": "Malware payload (ManusCrypt)", "value": "90096372609f205dc6d386c1be238259e2676aa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278904, "uuid": "34141b48-aee6-48f1-b83e-7e85f014cdb1", "comment": "Malware payload (ManusCrypt)", "value": "8097cf995bd6370e17b7e18d11fd1bcc4cbe0e37ee99e844eb13790eb599dae2c83d3011ad4373d5929cd5e43e48d003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278904, "uuid": "454e66cc-f281-4a56-b6d1-3e297e9181fb", "value": "T1897512F53FF14F20F31781741398C390B4A2F96EA486FBB91A4E2B5B1EC2D960067995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278904, "uuid": "9fc23a1c-9c66-4116-a926-5e192e72ceca", "value": "caf9bf1d191236de3d7b150ac6f71de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278904, "uuid": "6cf80e40-2ab2-404d-97a7-5dc71eae31ad", "value": "24576:c2AmVweVO6i4qtX/GWa0KPjGvXb6HRn6fM+TzHzx/OHWJKqWBtkrpUAMTF3:NAmZI6i4qBva0KPjGPqnEM+YWJwTF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278904, "uuid": "beb05f6d-e6f0-4b4d-ad4e-0e8c4eac7a89", "value": 1626528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278904, "uuid": "ae33fc81-b242-4a2c-82bb-5f53956ff8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278904, "uuid": "ae44fa60-4405-4159-8707-f071ce60f2ce", "value": "92569f0bc4733fd80a974d67ddb9435e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae56655-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678286078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286078, "uuid": "7bf651cb-ff8b-41d4-afbb-08c830a8eda6", "comment": "Malware payload (Mirai)", "value": "5eee2207d6b136b1a4b1676b2e8b9fe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286078, "uuid": "891697d4-7066-4e4e-8483-d8f4cd3273a4", "comment": "Malware payload (Mirai)", "value": "35026317461bcb62e2507a7aed184317a3ede5ed592b76a95847465b496829e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286078, "uuid": "51f2ccbd-dfcd-41ce-aa17-e72daefc623b", "comment": "Malware payload (Mirai)", "value": "bcd821840fdf1d42a7ecc38e1235f53bdee106de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286078, "uuid": "e7b2eebf-ace2-473e-8013-fe93564892ce", "comment": "Malware payload (Mirai)", "value": "65670f3bdac6a1f05b86eb92d8fe32ba98d5a8a35bb178cc7b00e57e73005e70f2727e170b9cba59bfa7feafcfb34283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286078, "uuid": "24f30e68-badf-4a02-ac26-1b764fa53f99", "value": "T162A2D035D68ABF95FECDDD704AD1C2E13E6A8BD133A9C8F301DA9F1260060865345EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286078, "uuid": "7ff12164-d573-4062-ac0f-b94da7ea46ba", "value": "384:M/JywWc84Tp2YshxqlDmeT6vklefYqHRjDkORUxVdJdI9eHnrtM4uVcqgw05VxJk:MRxsSVsMDmeNl29KfxT3IGW4uVcqgw0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286078, "uuid": "258a63ab-b003-4e94-bd7f-88a456caef13", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286078, "uuid": "139d67fe-738f-4d3e-b3b7-bcbe548f481c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286078, "uuid": "a55550e0-8e44-4a41-b538-af0a7760b070", "value": "5eee2207d6b136b1a4b1676b2e8b9fe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50638198-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308394, "uuid": "a21782dc-a94a-49d7-b4f1-2d9aedb79b0b", "comment": "Malware payload (SnakeKeylogger)", "value": "979f5b5fbaa3513a5240d0121d70cf8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308394, "uuid": "f7044d75-a910-49d9-b742-093038d4184d", "comment": "Malware payload (SnakeKeylogger)", "value": "3557c86a8e99ac9a2b803da17e337187eb4f2d7645760889ed3738730118ed6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308394, "uuid": "019630b6-50a4-48f4-aefb-1cfb8140b40d", "comment": "Malware payload (SnakeKeylogger)", "value": "503d170ceebb160d1eb19412899b2bb6d3e9cfbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308394, "uuid": "51a8dfc5-a743-4025-aa89-2e2bc627e2d4", "comment": "Malware payload (SnakeKeylogger)", "value": "02bfafd99b3a8be7ebfba6774f42a7e7df85ab8dac8c65ecdf507e900c5ce0404a044f8b7e265d830d2862f476831e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308394, "uuid": "87f17067-c131-487c-a6c3-0dd5ff8a6a9d", "value": "T1052582203DEA901AF1B3AFB55EE475A2896FBF673602940D2051374B5733A42DCD293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308394, "uuid": "a4ed6982-06ea-4d68-864b-8711e1e07551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308394, "uuid": "f8c1495a-6628-4162-ba96-5b8a853b2ef2", "value": "12288:OYlTysSXMKl8hsQl45CJB3adX8OWGNGcTUuxguM2dxgKTNld9/opzkslhzEIivQ2:O5zlxeJRa9TDXPo65Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308394, "uuid": "60170aef-d9a0-4855-9e51-0966bc94dada", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308394, "uuid": "ee476ecd-de20-4f8e-af5e-3f68127cec9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308394, "uuid": "5396c7ae-3787-4630-81f4-db896cd2462a", "value": "979f5b5fbaa3513a5240d0121d70cf8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfad712-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289974, "uuid": "6f33b5e4-2d01-4db9-84ac-436def41ecf9", "comment": "Malware payload (GandCrab)", "value": "56d6c09f8c5e04a11a7981dc3a18959a", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289974, "uuid": "95dc6a4a-5139-4aa7-bfe2-6339d2c73624", "comment": "Malware payload (GandCrab)", "value": "356bc09d9031765a64dbb97d5b5ece70ff65ee892e6fd45baf91c0faa1fa291a", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289974, "uuid": "9ecbe4ff-daad-4b0e-853d-0762f98e4529", "comment": "Malware payload (GandCrab)", "value": "946f56c2c734d119d17c86cb733afb981190998b", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289974, "uuid": "06a0552e-42db-47e1-91dc-b37e60dda9a4", "comment": "Malware payload (GandCrab)", "value": "3d57e2c1d023e9b3d5c1374b6bc6d5d8470f0322655a014b9cc9c8e29b8a96bb7fc1d215ad9cb7c273ff0471fb32d7a0", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289974, "uuid": "1544013b-ef6e-4846-b281-748f80bcea8b", "value": "T136636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289974, "uuid": "ba1623ed-4a47-4688-a1e6-41e7ac705ef3", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289974, "uuid": "9d916e0f-b79f-4748-be01-43a82401d8ae", "value": "1536:BZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:od5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289974, "uuid": "80ce3829-0fe2-42a2-8cd1-efb715d13ba4", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289974, "uuid": "a0c78f65-5dd3-4129-ae0d-28811442d13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289974, "uuid": "b0216a45-418c-41d0-b471-fd187355ff22", "value": "2023-03-07_56d6c09f8c5e04a11a7981dc3a18959a_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a101bfa9-bdad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678278894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278894, "uuid": "30c7a80f-0636-48c3-944a-2d25f0e4a636", "comment": "Malware payload (RedLineStealer)", "value": "7c1ede3dd17e1e51e2f13379adc30be2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278894, "uuid": "1318c8ba-c197-4666-a657-726174c7c3af", "comment": "Malware payload (RedLineStealer)", "value": "35a289dffa420556d0ae105d13b138fae7207dee808971fef93f642556b16e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278894, "uuid": "861033be-0c0b-4b6d-aed6-a0514e9df423", "comment": "Malware payload (RedLineStealer)", "value": "3b42121ffa43d4d7cb8e47657e9cacaae640bab1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278894, "uuid": "fd7a402d-5ea1-4ace-a091-4f54eb78d7ba", "comment": "Malware payload (RedLineStealer)", "value": "a8e7b455bb0009affa85bb7262b5ba929291a266c665d3b6c1c2cc2b4f6f61857d2e172163a9348de4930ca21a0bcd49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278894, "uuid": "59a2daec-6792-4211-aa6e-701d0d3d4a2d", "value": "T130561241FCD790B1E502157209A7D3EF3B35B8091F329AC3DA14BB6AAC776E11D32266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278894, "uuid": "2ebee9d2-a9d3-4e5b-9f97-84e1a26b79c2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278894, "uuid": "f56b65b6-14f0-4753-8501-04538e409121", "value": "98304:p8i2Pa0qJP46XsU5SpMH08JHLoEZ3Hu9qsQyB4MBNXc7MJoemvkxbYbAjJ8:uirZ4izqGLLZXyqhyB4MB6NemXIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278894, "uuid": "cc965487-ba55-4552-af1a-f37b04e4a7fb", "value": 6248048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278894, "uuid": "4ba5db7f-540e-4cee-924a-abb0baf9dc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278894, "uuid": "2cd9dac0-5032-4ec4-8680-1cc0fb9c43e6", "value": "7c1ede3dd17e1e51e2f13379adc30be2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29e68dc-bd5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1678244134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244134, "uuid": "048cb1c4-a63d-4e32-b094-222fcf46b0d4", "comment": "Malware payload (NetSupport)", "value": "930dafe31a08adcef3cc066d16d40982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244134, "uuid": "72149997-8c15-48e3-a173-066a24edc477", "comment": "Malware payload (NetSupport)", "value": "36347ad88c3fd960152b88022381308c68b39dde29a1e2d471148cb01e76bb3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244134, "uuid": "614474d3-1f79-44f7-b772-5913db758d48", "comment": "Malware payload (NetSupport)", "value": "134c131779666424cc98fd15e384d174cfcf16e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244134, "uuid": "bd25a833-8776-47dd-b1c7-974e476db25c", "comment": "Malware payload (NetSupport)", "value": "5094d599bc7138e4cd2b692c47144fe03c09077d88660d80685c8e4da2e1e7c443b172ec2e24b2c86d5acc1fdbf6a121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244134, "uuid": "e76c6427-e5aa-4514-8ede-cab5e59f18ce", "value": "T17DC5E022BA52C1F8C5B112F0C850C3FA9DA6ED6ED714543B430D3F66B7B42866ED1AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244134, "uuid": "505d8f6f-7e9a-459d-9c62-9c7efb54f197", "value": "1f4f257947c1b713ca7f9bc25f914039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244134, "uuid": "d41868ac-cc47-4866-8076-cdf82adcdbe6", "value": "49152:suJdxkp92TMp2OJSyli/TlV56nNeDyQ41Huw9If8DQtqKPi/IBF:Bd6Ugp2Jx6UyQ41uw9IkDUiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678244134, "uuid": "698b7ebb-d461-4822-9893-afcf583b95e2", "value": 2573832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678244134, "uuid": "89ea1ceb-ff2e-4511-b617-1ca07d68a827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244134, "uuid": "71aa9924-27c3-400b-aa31-ee9dcd0f500f", "value": "930dafe31a08adcef3cc066d16d40982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e9ef52-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678277377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277377, "uuid": "789165b0-4823-4cf4-81a8-74069f092b75", "comment": "Malware payload (AgentTesla)", "value": "fbad22ee4fa74101bd8b4fd7a325b100", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277377, "uuid": "32fa7645-f88b-485b-9488-7d632311eec9", "comment": "Malware payload (AgentTesla)", "value": "36c8948fa9b21ad5722af3e6f68474e8d5f82bb687770228ba402f2a7a04fdd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277377, "uuid": "0ae75313-8dd9-4f2f-8cd9-d04d3b155151", "comment": "Malware payload (AgentTesla)", "value": "4192c217a2090e3b8befeefc39bc72381cb31fb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277377, "uuid": "fb60786f-ebf6-4f7a-876d-e4e03dd9197d", "comment": "Malware payload (AgentTesla)", "value": "072f1b58368439c47c472536ba8f486e1629fbcfbd4573a579eb183f9a3363779ca31a667636662021e4a7262f23996b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277377, "uuid": "0a4c765b-5628-4a0f-9a7f-268b5ca57deb", "value": "T112043939A2C9A952D32D4074C4A001580BB2E3575617EF6D1FB3A8F63F467C3B2ABC65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277377, "uuid": "4d72ed19-98e5-43b2-8bbe-de15de6e12bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277377, "uuid": "e4241139-6fd6-467a-8c6f-74d8bec411e5", "value": "3072:TAgbq4Q4gTznYqquwRw6APgmNinwIiwpEYAroL2xBmRMTRvCy:TAgXgTzZquwXAPgmniU62HmRMTZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277377, "uuid": "d6051256-3c22-405e-ab53-521eb042a02b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277377, "uuid": "ada4fd15-c0ef-489b-902c-650b81f55c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277377, "uuid": "b2f7017f-99f4-42ea-a397-c867cd59c351", "value": "36c8948fa9b21ad5722af3e6f68474e8d5f82bb687770228ba402f2a7a04fdd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614c8290-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248293, "uuid": "55dcb87c-d993-41a0-9070-f5508a6a2a6b", "comment": "Malware payload (Mirai)", "value": "ead44b73757cc243a98c164421cf76e6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248293, "uuid": "61ae73c9-3935-4aec-a331-a5c033967865", "comment": "Malware payload (Mirai)", "value": "37a35395033d2a308f2d5a5286521f433fd513c5b6d6a3df43dd04724ad35936", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248293, "uuid": "619147f2-d9b9-4f00-83c8-dca4637c0cca", "comment": "Malware payload (Mirai)", "value": "886c11f5fe70c3b6f7a1211b7ed88e2adbb4f96d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248293, "uuid": "2325fe48-2b43-474d-ba91-c09aa0f452ef", "comment": "Malware payload (Mirai)", "value": "b9d532485685d2b64b230b5c5a70f7b6f9984d485bfcc6c843a7bac692f53a2412cbb24acca6819e18ba663241a9ec75", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248293, "uuid": "714dd798-877c-4cc3-8dcc-cf81d86e4ee2", "value": "T10C534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248293, "uuid": "1cf38064-0493-4b98-8662-a0fa1e3bcbe6", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/bDiQ+LiKimfFoktCe3fYRM1:WShU3q7cEDlCK/bDm9i8Fok06fYRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248293, "uuid": "c89ca833-1596-4e55-b0c2-6859091101a5", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248293, "uuid": "aff33ec8-aeff-4d5c-8d87-aea95b03880a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248293, "uuid": "0b829c29-abba-45d8-8f4d-f58b16cef07e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1bceeb-bd6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678250625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250625, "uuid": "616f1a7c-afe2-4192-8740-264eb02b6dc5", "comment": "Malware payload (Mirai)", "value": "d6dfac76042647e050266b6b8a7c20b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250625, "uuid": "dbc10617-14f3-4444-8398-67889b34c0c2", "comment": "Malware payload (Mirai)", "value": "37bba574edc98f4af7d5438d04bad7fc9447236c0a40d57f5cb1abbb3d1a9430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250625, "uuid": "b3536c5c-c479-4ded-a8f5-6b4c836ab9ec", "comment": "Malware payload (Mirai)", "value": "b46c043631d7ee1b41b5320332a5a2bffb97527c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250625, "uuid": "8c51978a-5412-4f2e-bc33-ae898d331fb7", "comment": "Malware payload (Mirai)", "value": "2e9555073694f974f22ff277bef45efcef0767b3587da8007d2594dd0c7469bc48c038e939c61d8ef48e0f381f9360ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250625, "uuid": "aac7bf87-4fbf-46c5-815d-ddcc7aed80cb", "value": "T154632AD9F801DD7DF81BD77A4457090AB630B3D502831B376397B9A7BC731A82922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250625, "uuid": "b43b42ac-b490-4529-b52d-d67ec2565170", "value": "1536:txIAtIod4LJDYvhz8V4nq1jxes8NdJDL4t5uSRQG/W:XIgIoGVEvhzq19ebN/3SRT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678250625, "uuid": "191e719f-d0c3-4773-a03a-895bd22a9dd5", "value": 69616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678250625, "uuid": "e85b0e66-2e2a-40ca-b0e7-bcb578b0b03d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250625, "uuid": "1761bdeb-1cf6-4ca1-8c21-3e4d06a9ac77", "value": "d6dfac76042647e050266b6b8a7c20b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc4e082-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268041, "uuid": "ef658025-ee90-42c7-a6df-d1f02a20b6ce", "comment": "Malware payload (Heodo)", "value": "925296888593a28e151053644b56b86d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268041, "uuid": "15d2e37f-bcad-46f7-a8bd-1588e981e9f0", "comment": "Malware payload (Heodo)", "value": "37c4531329fa012f60ff5ca4b66b6658498bf58b8ba282a782d9da4d8a84104f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268041, "uuid": "08385aa8-b0f7-423f-bdbb-424c7f09b569", "comment": "Malware payload (Heodo)", "value": "efcfaa7d86755b003ad4a4b7f0ba8c836beefae0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268041, "uuid": "34f3fe78-0cfe-4e71-8e5a-bc76df585c88", "comment": "Malware payload (Heodo)", "value": "94357115452c9d64713b34456b2a9b2b4b1cb85198bd3fe834bbf81339cb5b999551b52794eb244962aa39fb3b809f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268041, "uuid": "29480643-a06a-45b5-bc1f-89021ddf9b5a", "value": "T14915233C5F67790FF5997C362AF3807AFDF9085CDC96E90A17431A9209AB2056794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268041, "uuid": "f619a1eb-fd13-4a4c-9c93-273c74d33c1f", "value": "12288:S4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sn:levtlkdJe4m19FgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268041, "uuid": "187ebfd7-86a6-4cf8-ab68-a96a96bd04e3", "value": 876732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268041, "uuid": "0cd37e1e-5898-4a2b-9962-0a427385fa93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268041, "uuid": "952686cd-8ed9-486b-bb17-6f1b1e5c6f7b", "value": "Olggolg3aHWcYpAQtYdrGEo5IC3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1132ba-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678310615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310615, "uuid": "aab4c178-0a9d-4857-8b02-75ef054da4da", "comment": "Malware payload (Amadey)", "value": "57cf7ce2696f4ac87b27879886a089bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310615, "uuid": "3e50ffe1-2826-4aac-a79d-3a098edb179e", "comment": "Malware payload (Amadey)", "value": "388abaad8701de54dcc5e0d8380630e1b6f0b323f1a9cf4377e38399753842b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310615, "uuid": "c4772fa4-6b4d-4e90-9bde-31f73af9b12f", "comment": "Malware payload (Amadey)", "value": "897fc8605b17f47fd51272a8a5f5605d939c744f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310615, "uuid": "77b518aa-2be1-437d-8a98-064fbce4d238", "comment": "Malware payload (Amadey)", "value": "a9ec94380184ab7146f29e4361cb29d1567c345b6122943350d96084a95a5135e53cda62db631e5e0880d5472e918c52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310615, "uuid": "475bb072-5001-464c-88f6-9c8389e88ac0", "value": "T1B6936C1030D2C071D57E55351874EAB68B7CB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310615, "uuid": "b7cdb346-9f93-47ba-84c4-ac0c785eee9b", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310615, "uuid": "a0bc2659-4589-4a08-bf42-c728c04c29ff", "value": "1536:Ro4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUE8aB89p:RoUCWbBNpplToUs1uNhj25LJU5aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310615, "uuid": "0139bcdb-c6b7-4998-8ff6-949513faeb4e", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310615, "uuid": "c4b44d73-325f-486b-9f49-531d4a72dcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310615, "uuid": "cabb9476-4ede-43e4-82ab-67026f351a89", "value": "57cf7ce2696f4ac87b27879886a089bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf1098e-bd4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678236607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236607, "uuid": "61f47a14-c56b-4cd0-8715-c2d1b9cd8c7e", "comment": "Malware payload", "value": "279019212d392755d44c95356f34cc3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236607, "uuid": "f2756d32-11b6-49fa-9dc2-830737aeab01", "comment": "Malware payload", "value": "388cb2fa24c6bf1de868e721274f2e402b51ddac8113a6d13b1ca57e6eb58c9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236607, "uuid": "5faf6eda-932c-4ada-a90f-549361d45d89", "comment": "Malware payload", "value": "14d6b82b419782be5e9ba99a885a525d48635f5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236607, "uuid": "1e37ac3c-7b67-4c90-a057-245d4cdc461f", "comment": "Malware payload", "value": "5cb11b739ad3f66c38861ece46eaecc3d06c0c56220dd31745f363e4e5484bb19c43a549876de4d3481745ce19363e01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236607, "uuid": "d2ddfa5f-13c5-4fdd-bf10-8789898f249c", "value": "T1D113E84AFA819F01D49721B9FF9E52493343AF6CE3FE710199206FA123869DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236607, "uuid": "95c458c0-2c04-4ea6-9b9f-800632cf965a", "value": "768:uRnjPG5CFV/P9tGi6zbq4KjDFWlPXqiD2RiE9rMtOXczfeuYD:uRnrGiJ1tGi6zbwPFWlvqiKRiYryfZYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236607, "uuid": "102e3ecb-ab77-4811-9456-01f5786353eb", "value": 45164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236607, "uuid": "4ed9fbb5-7c01-4bb2-82ba-0ffd6d83aa06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236607, "uuid": "b755b2f1-b030-4c88-9941-07b9c0acb2d0", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a5169d-bdef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Petya)", "timestamp": 1678307245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307245, "uuid": "b2cd2535-df05-44e7-ab86-de9711bcec0a", "comment": "Malware payload (Petya)", "value": "e3b7d39be5e821b59636d0fe7c2944cc", "object_relation": "md5", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307245, "uuid": "f154e9b4-68b7-4d0b-a8cd-51341a67cc8f", "comment": "Malware payload (Petya)", "value": "389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97", "object_relation": "sha256", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307245, "uuid": "90d3a511-f01b-4b3f-8e94-4882d226c434", "comment": "Malware payload (Petya)", "value": "00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88", "object_relation": "sha1", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307245, "uuid": "dcca6321-a24a-4db5-b14b-7ca805fbb256", "comment": "Malware payload (Petya)", "value": "5e7f77987a941834ff54ae334273323a75be5aa45aa9eb395c0b60796929167a074dfe24463ce1173e4facedc4addb04", "object_relation": "sha3-384", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307245, "uuid": "d95f1d40-1467-4d39-b812-865b1cab0017", "value": "T122448B0D7990E92EC4B222719A38E7D2FD3B79314F24919FB7C4695DACE08C19938B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307245, "uuid": "dea83287-f0de-4caa-aa45-19df45307efd", "value": "eadbe699c9f56194b9bbdf2dd7631233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307245, "uuid": "53119a77-cc7d-4aba-bf07-0e4664709ded", "value": "3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307245, "uuid": "3121eec2-ee11-4e77-a50a-33cc88a0d805", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307245, "uuid": "41cd8280-8cc9-4fde-91bd-b915da56607f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307245, "uuid": "2473ec66-33d9-4a5f-8318-f0d0b85f3737", "value": "GoldenEye.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128e8867-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274790, "uuid": "a683c10c-1a2c-4ac1-9efa-8eb7ce06f63a", "comment": "Malware payload (Heodo)", "value": "1bcec00f05b805299fd51fe61eb2996b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274790, "uuid": "10e5d074-a554-4a31-b7f8-ffa14a838ffd", "comment": "Malware payload (Heodo)", "value": "38ffdecbd0b59624ccb255236a86c936e9aed02d3e74ef2928c654a422b67251", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274790, "uuid": "dd04c7b6-c2d6-41b0-9e85-8e3e7a70c9f2", "comment": "Malware payload (Heodo)", "value": "c0a6208c30ab15bbb9bc1f82dc769c301f117915", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274790, "uuid": "e34ee570-5088-4004-9012-65587aee5b88", "comment": "Malware payload (Heodo)", "value": "a4fb817678f05aeea9a953749653216ffd9116d029d316f451c2cef2c9ee74879b19501e65b226f9b52b6ac2ca81973a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274790, "uuid": "86105137-e5a2-44c0-8fbd-6e2ae15ab241", "value": "T1B415233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274790, "uuid": "825d86c4-bfeb-4950-9b37-26761533af78", "value": "12288:I4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sr:/evtlkdJe4m19Fgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274790, "uuid": "d704b216-1393-48e8-b242-12cb6271832e", "value": 886920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274790, "uuid": "42a37f49-9c44-4efa-b549-e02a76110c11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274790, "uuid": "e7f11ca7-9127-40cb-9069-47a4ed41294a", "value": "hvi0NkQmJEUSzdrrNWPeGwnScI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0846ceaf-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678267471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267471, "uuid": "18f373ce-ee9c-4212-be36-578e7f86bc71", "comment": "Malware payload (Mirai)", "value": "c010fb1607d907c27695e7610db536d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267471, "uuid": "2363c13c-b789-4f92-ba22-be44b4d42655", "comment": "Malware payload (Mirai)", "value": "391abe8d22b3dcebc681315ee179da9775acd9cc14bc6547a52dbe4eda9fddb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267471, "uuid": "875570ce-27fa-4285-be4d-c93eb3731645", "comment": "Malware payload (Mirai)", "value": "40005e9c80f1812ef12a10eed84f0b5fe625d2c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267471, "uuid": "8106e201-494e-449c-b4c0-ea8f10103951", "comment": "Malware payload (Mirai)", "value": "36480622d0ef63fcb0d1ebcd1718f72a352497d375615f341b2751876b4971060ebd6ff094278f009206ee1ce246ae9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267471, "uuid": "d25acc07-bcbf-406b-ae37-8a1779f59a2b", "value": "T12E934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267471, "uuid": "f79c03f8-aaae-41fa-a372-314f5c37f245", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZym5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjji5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267471, "uuid": "56ca23ce-c2c6-4e5e-b4b2-794f674ef76a", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267471, "uuid": "7e082b94-befe-4f94-a5d6-6633f90cbb13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267471, "uuid": "66b2a458-a345-4796-a126-492aac6d5795", "value": "c010fb1607d907c27695e7610db536d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a562ab-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279511, "uuid": "26ae87ab-8490-4def-816a-e93c01d20f80", "comment": "Malware payload (Heodo)", "value": "9ca31373579e6cc1a8f1453af6049f25", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279511, "uuid": "fad4d8f2-6d0f-483e-b065-3d8ad36727b2", "comment": "Malware payload (Heodo)", "value": "392cb53bff82744b2b00c8069e7a8f5eb734eb24085023d961e13123207913b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279511, "uuid": "0ed14162-fc64-4c33-a69e-b82eeccb6ed0", "comment": "Malware payload (Heodo)", "value": "5087aa02bed5dccd5cb2497af6595ece1f58f911", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279511, "uuid": "cbab175b-66fa-4788-a9e2-107fa008f5af", "comment": "Malware payload (Heodo)", "value": "b0b56125f6da36c8247806ce60fc7728ca3da1f1b1713dbfbbef27ac89d043b8ea794aad317a228a7d21481578c47dfb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279511, "uuid": "2d7b546f-b2c4-4004-8ae4-3a498e50e046", "value": "T1CC15233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279511, "uuid": "67bcea57-f255-4621-aafa-4a9a8471bba2", "value": "12288:D4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/st:MevtlkdJe4m19Fgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279511, "uuid": "e6f66f69-269f-4568-87ba-71348fc5a72b", "value": 905218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279511, "uuid": "51047ddb-452d-4598-b23f-65c8a89cc900", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279511, "uuid": "90a55f8c-4902-47c6-b59d-f51f33d8bccd", "value": "AV8ugOvkLs27zOzIuIAluY3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5416d9-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1678309486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309486, "uuid": "cf661ed9-22cf-4c8f-9ea2-e772450b894d", "comment": "Malware payload (STRRAT)", "value": "d866406ffccfd8b63bcc68255f2d1d26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309486, "uuid": "e7f53e88-1957-4a8f-8f37-0dead088ab6b", "comment": "Malware payload (STRRAT)", "value": "3938b2d2e6bddf6cca32f3ed8e84131530180071d16ad394e0a08829b265f3a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309486, "uuid": "662d1096-a8bf-4223-bb29-d95ba6720558", "comment": "Malware payload (STRRAT)", "value": "5afd91f42993170847105e0a19428f17e0fa2c83", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309486, "uuid": "dfb5ee40-e9db-42bf-8c4b-9836e572dcd9", "comment": "Malware payload (STRRAT)", "value": "055deaabbc91513f0f311bcb14996505d4e25cffc6df7d9fe68aff7fdb2a8cc9b961f516a6b7898398611b6636637bd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309486, "uuid": "e8d6ca75-b565-4455-818b-bf6d7f2615c2", "value": "T144748C1D70C88F34977F347A136B39367F909A96B035BEABA2214B2EAF6374800C555D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309486, "uuid": "37959b5d-deff-4053-8c96-51b7c3f326d6", "value": "6144:GQsAqIYM/ucFursRlpA6IL5AnRZHwu70Tocq+tiijKgN7WIdaiohnTC1sim3We:NmInmcIntinRyuf+tCgNRDyYspH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309486, "uuid": "0770c254-3d42-40cf-897e-8b9562cf6d50", "value": 351965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309486, "uuid": "13bdbef0-cbc6-47f0-a3c1-e00c2564f767", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309486, "uuid": "026ae334-65d8-4908-af5c-2b0273bb31d4", "value": "SO#9105632-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59165f7c-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284786, "uuid": "2e7951f8-a2a2-4e7b-951d-0246ce62ed74", "comment": "Malware payload (Heodo)", "value": "5f90895d89815fbbf4cbaa0718fc1edf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284786, "uuid": "072d030d-c703-4b72-8779-4abd00f2429a", "comment": "Malware payload (Heodo)", "value": "39b544bd9338d4f01de2998d00ef6a56a4613001cda5289b8294049d9d8933fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284786, "uuid": "21edb630-411c-482d-bfc2-7b4008ff8490", "comment": "Malware payload (Heodo)", "value": "328560edfab60fecc2d6294a92d65590deaadd92", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284786, "uuid": "adae4e4e-e5f4-48da-bf2f-33f081595d5a", "comment": "Malware payload (Heodo)", "value": "83f40bf9e8753c0017b5eebf48541137a21cd77b79b24c6a3110658789abc6afc4d1f5553e4bc4ab89d47fd9b6cb2972", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284786, "uuid": "f620b4a5-15ab-4972-8b08-2c3bc6650453", "value": "T1A815233C5F67790FF5997C362AF3847AFDF90858DC96E90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284786, "uuid": "a11962c9-e7cf-426f-9572-c1659009e684", "value": "12288:44DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sa:vevtlkdJe4m19Fgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284786, "uuid": "23c7ed0a-b0c4-4488-9f9c-993534e9f34e", "value": 881816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284786, "uuid": "e92948d2-030c-48e9-aedf-a46345b0361d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284786, "uuid": "86104c85-3ff0-45b6-8e53-e5f714c5493c", "value": "fYtf1JXMCcmtaHbHuZ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bac8021-bdee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kodex)", "timestamp": 1678306641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306641, "uuid": "91688ea5-b249-49c9-b56a-966f61dea95d", "comment": "Malware payload (Kodex)", "value": "15422f2c3c6e0895a20f5719e52883b0", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kodex", "colour": "#D569C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306641, "uuid": "53109041-f86a-422c-a336-9a88d56106e5", "comment": "Malware payload (Kodex)", "value": "39f4395ad419c5b61fbf7bd110a9f69a35474ceffd4892dd89ba7b9bb64c7b00", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kodex", "colour": "#D569C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306641, "uuid": "3c18e25e-8290-414a-85a9-a51f4aaaa7ac", "comment": "Malware payload (Kodex)", "value": "e8dfeeff470a80c0a5968fbc54ba7a9b1708a3a4", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kodex", "colour": "#D569C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306641, "uuid": "f5c24807-b5ea-4637-a32a-d300761150fb", "comment": "Malware payload (Kodex)", "value": "ebb0d042f2cfc5bda96d093f8ef7b397b823c32484ef3eb373eef25dad508dd2e01a28874ee9f02542aa9628001bc256", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kodex", "colour": "#D569C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306641, "uuid": "186a6c8b-756c-4354-a981-c628218cd405", "value": "T10A563348226105B5E82A813DD892D137DB72FC974BB0E34717F48A131F17BB16DBABA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306641, "uuid": "be5cfd33-0fbf-4152-ac46-0f393b1b21f1", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306641, "uuid": "29787e8b-4072-4659-b37d-53c64079f329", "value": "98304:Nr+0h/ssB2uW5MI0md9g+DltLGMY8DI65KiaYGgQ30LJd2UqLjkLqpR0VKeXbPb:N5kL2Vmd6+DXLZy7YM30LzajzpsbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306641, "uuid": "3bedfe86-f8ce-473c-a296-dfdcd1dd28b7", "value": 6375216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306641, "uuid": "e775ca27-1652-4544-82d5-e3a28b434abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306641, "uuid": "111e0e6c-3b4a-4800-8bc3-0d4ba7d3494a", "value": "15422f2c3c6e0895a20f5719e52883b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6928ab8b-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678308436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308436, "uuid": "d787ca5d-add2-4110-b75f-9ad53fa6cc58", "comment": "Malware payload (Amadey)", "value": "f9c4abab19aea1f38f879f8eb8df6300", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308436, "uuid": "b8d3dd3c-4ffe-459c-9d63-b0bc6c1f421b", "comment": "Malware payload (Amadey)", "value": "3a1e6d5f76e8d2cc7c78dabeb6bfbffc298324fa712a55d137a1e095f762dacd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308436, "uuid": "0e472e8a-d55a-4cb0-8e78-463e2dde32b2", "comment": "Malware payload (Amadey)", "value": "8c2925e1897b8c2d38073910f2a5cc1c508441fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308436, "uuid": "f2ce6367-a8a5-4fcf-b2be-7ed126eab188", "comment": "Malware payload (Amadey)", "value": "5d169bae7de845d2d4e6976db1f2e0d7079cc94627b01f4ae3bce6a93f5d8cb3b95a084371b1c37c5c4c7bda854989a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308436, "uuid": "4b9c34ae-8900-43a8-ad2d-74afed9cb1d7", "value": "T119E4025243E06C30F76247359E3DF2E96F3EF9615F6BE6C922195A1F0AB11E08672312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308436, "uuid": "8d2b7ecc-4362-408b-96df-f0874ad163b0", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308436, "uuid": "fb221dcb-0bc7-491d-a10a-c25fff554761", "value": "12288:7QNDQNdxIYGmjcZO0xasAnjm6ILGJiKIWwrkzuoIen+U6DnVAuv+dq:7PTHLjckwAj4GJWWzzFr+Z37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308436, "uuid": "1e7988d3-f08e-4394-bcc1-a0f347c28124", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308436, "uuid": "317dca45-9917-4768-8feb-b038269ff1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308436, "uuid": "4e5098af-6bba-4e1e-a922-8187af2bd929", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca4f4a2-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678308817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308817, "uuid": "ff702bc9-cd81-4dcc-bec3-c6dd7ee8cdfa", "comment": "Malware payload (GCleaner)", "value": "0e64802a39def8b062a90ac724456d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308817, "uuid": "b22f242c-fa78-48af-9e40-b13c6feb0d1f", "comment": "Malware payload (GCleaner)", "value": "3aa97a5e2d24316daca7529266216886cf888b6643b77c1e6c51ea42600e61c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308817, "uuid": "7661d445-5f30-4f1e-8d95-f03d04d1ff2a", "comment": "Malware payload (GCleaner)", "value": "7745f11285f663d01c01bfb55e230f7a871e7f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308817, "uuid": "b09cd50f-0b1b-4813-bd24-1a31a1b37d30", "comment": "Malware payload (GCleaner)", "value": "424bf53e43bbed91f5a57189dd926a576e30bdd033c4e70e172927f78bc5b8ca79d96f4814af086318cf2c3c52057009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308817, "uuid": "8934beec-969d-4c70-9911-3ca533a62229", "value": "T10744CF0293DD6921F5725B318E3EC6B97B2FF8A39D68665B23142B2F0D702D1D972312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308817, "uuid": "9d198277-2730-45fb-86a5-752af8438dba", "value": "8a699b19de854b1d45a8cb5567d77787", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308817, "uuid": "91f0af62-34a9-4b18-b532-f7807fc7be98", "value": "6144:l6GXXyJP2yz6cWUcoKBPnjoc8vO+Tn849:gqCJP2ylWn9jmLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308817, "uuid": "571f0282-d1a6-4abf-9f19-246167e95e4f", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308817, "uuid": "a899994a-854f-4829-b117-9d47906e01f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308817, "uuid": "ea202e7e-f69f-4a8c-b941-c0ebbadc8fdf", "value": "0e64802a39def8b062a90ac724456d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0033ed6-bdb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678281604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281604, "uuid": "5a06096d-5d10-494c-9d00-9a8504d55626", "comment": "Malware payload (GuLoader)", "value": "5549ce7c297212b9df5532951ae75032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281604, "uuid": "6faf151e-10b9-4d4e-9fa4-2ac599a4f8b9", "comment": "Malware payload (GuLoader)", "value": "3aeb06d11075a2eb8ee47f878f73f01368e81d6719de52ede646f78476f13f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281604, "uuid": "5a61bd4a-f7e7-4b47-9655-99d707c8cd9b", "comment": "Malware payload (GuLoader)", "value": "1f29e00223c3aa8c6fa433418ed883e0fe79c41e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281604, "uuid": "d6da1647-92f0-41f3-bc85-994fa0cea4d5", "comment": "Malware payload (GuLoader)", "value": "1a72c943bc94052b6ed9c1a15bd7f90b087e4ae6a3351c538cfd8bd60a8d2372e5214b22969c55489ed22a8b57de03b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281604, "uuid": "40b22910-cd9a-4750-9c0e-42145ff388b5", "value": "T105840201A3E1D76EC0B112F03536C3651BB6CC026A668F8787B5B9BC9875786DE0FD26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281604, "uuid": "ad3df626-266a-4771-aa05-356b02db7d32", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281604, "uuid": "65bc8a17-8157-4d86-aba6-744b050f1743", "value": "6144:BbE/HUw1icBZLV1tf09obunVod/v23SwLkFTqm8Ul24tK7NR00Igv6tK9ByKUTow:BbMpZKobyiVTFmCI4tkDNv6tsBLArAuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281604, "uuid": "ddc0c3f0-4cf4-4729-82de-814dd26a6748", "value": 407588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281604, "uuid": "f8836546-1c0d-4e8a-8551-369604fb8c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281604, "uuid": "2f42ea37-33df-45de-a47a-07a60d84f503", "value": "3aeb06d11075a2eb8ee47f878f73f01368e81d6719de52ede646f78476f13f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300a9801-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274839, "uuid": "ed40337c-43e8-450f-9002-4eb3c2cf52cd", "comment": "Malware payload (Heodo)", "value": "18c9003a0a5edd71ffca13a815d612cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274839, "uuid": "643b3cd5-847d-48ba-8278-11724996036c", "comment": "Malware payload (Heodo)", "value": "3b4fad0f7faeaa5d64daa9188a67b0de49f8909321e969c086204414652795ff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274839, "uuid": "0368b021-e2f8-4f4b-b902-a34d37c0b6fe", "comment": "Malware payload (Heodo)", "value": "b8324a37e6299c5b20c4f0e93a05f64eef957483", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274839, "uuid": "661441a6-9ffb-4664-921d-168b1d06dc4b", "comment": "Malware payload (Heodo)", "value": "c1676523d112c3a028bd5d06c7d5b2ed2e6bcabc72319b436dcb38a3bdd887c7414d16aaf5eeed46b473d12ba626d23b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274839, "uuid": "5ae2a58c-f322-4897-9740-2b3175282a05", "value": "T199D412B1F4AF3319ED21F57811EADC470391B47F03C005D55EA8897EB2BE12A755A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274839, "uuid": "e06bb32e-20e9-4223-8c4f-eaec2cc4ecbd", "value": "3072:51lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3Cj:512c/z4a5GLNIp1WMkd3tCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274839, "uuid": "ffdfe134-112e-4d11-a648-8c79eb186da3", "value": 648160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274839, "uuid": "b50a2b0c-4a06-473d-aa74-782df3fda175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274839, "uuid": "9c994350-db80-4b1a-988e-e8d634d1cf8f", "value": "INVOICE0000006407.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d873a4b-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279506, "uuid": "2e2357bf-dcb6-456f-b60c-adfc5bf7e9e5", "comment": "Malware payload (Heodo)", "value": "3c19976fe0a914f396bf0287231fb1e6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279506, "uuid": "2142a987-b570-4535-a1d9-873d6116521e", "comment": "Malware payload (Heodo)", "value": "3b672bb6c5aada662ec5a59562d850f01c4f732e7cca0bd8bb29e740c03a422f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279506, "uuid": "e437ca04-4ace-4090-96a8-5b1bb2d14709", "comment": "Malware payload (Heodo)", "value": "8ce51976caf6c7043c47f36c6490504a674ef8c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279506, "uuid": "e0cd8e6d-6783-4528-bca6-d8032b87230b", "comment": "Malware payload (Heodo)", "value": "f95038dcc888b198c575cb56a9a929ef8a053d604aa7cb7998b73dcac96bc56ad70a988d0318ab0ef93d6dd83332c02d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279506, "uuid": "a1ba23e5-85ed-4047-b4d1-99575b1f64b9", "value": "T16905233C5F67790FF5997C362AF3947AFCF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279506, "uuid": "0b324f61-2339-4cc1-b202-4c6aae9f9c66", "value": "12288:34DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sj:IevtlkdJe4m19Fgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279506, "uuid": "480b4f57-c4fd-44d2-8273-15a07a2b918b", "value": 873693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279506, "uuid": "9b8a057e-bfc9-4301-863e-f645c5abff45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279506, "uuid": "097255fe-cd71-4b29-8f40-024305b166c1", "value": "SRuIXwCz0Bj5AzxzNMA4O0dO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efbc85a-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274784, "uuid": "325f7a37-b822-4785-8d56-9fe8bae49279", "comment": "Malware payload (Heodo)", "value": "f74fec485a9bf5b22cd3ec7bd150afba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274784, "uuid": "306d2265-9d10-4ef4-b7be-9e1af4b484d8", "comment": "Malware payload (Heodo)", "value": "3c24b78fdf4873dda1836a1119083dbbdf198f0285aaa2abfc87f35356f6cc8d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274784, "uuid": "75f9d574-3d1a-4ba4-88e7-06f6f05aece7", "comment": "Malware payload (Heodo)", "value": "54619f8af93dacf7a3be0d16a65def96171accf8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274784, "uuid": "737c845d-adf7-4ed9-ab62-081239506b89", "comment": "Malware payload (Heodo)", "value": "39180516fc2871ef3e2b66da0f8acfa057d07bb727cf967aabb7aead17aa88dc9581748c9277318091561c7abf326a57", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274784, "uuid": "525cc3f5-5ea0-4acf-a152-b10d60114a98", "value": "T1E115233C5F67790FF6997C362AF3847AFDF90858DC96E90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274784, "uuid": "2c0fcede-4d6f-4162-9785-78682ee64617", "value": "12288:A4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sT:nevtlkdJe4m19Fgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274784, "uuid": "591913fc-5bdb-4955-a42c-0a06f2c23c2b", "value": 890941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274784, "uuid": "9b0ed328-b98c-4be7-a19f-fb0012a84411", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274784, "uuid": "3321c2a4-afca-4b88-96d5-18fc5db14a90", "value": "DuiX3faIcujtVCBQwXsnzqUq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2549cf-bdc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678290942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290942, "uuid": "610142a9-5de7-4067-aef6-9326e51be217", "comment": "Malware payload (RedLineStealer)", "value": "c8424f1891d93ad106b6ca3986dd2520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290942, "uuid": "37f51b16-dd75-4f46-a4f0-94d873a47801", "comment": "Malware payload (RedLineStealer)", "value": "3c2f3ade8f0afd33c1607b95da3eb1de35863e65e1d4430048a79ec3530c862f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290942, "uuid": "4497d171-628b-42f6-a42e-768d887e4f39", "comment": "Malware payload (RedLineStealer)", "value": "ca398f3b4bf80211c38adbdf12e5992a2038074d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290942, "uuid": "e16b57ab-2869-45c0-bd3a-8d20090bdea0", "comment": "Malware payload (RedLineStealer)", "value": "b2818ac6ebca14770b4806f70db48edb75ff61661833ef7ddacdd004889e48ecc6f1f0190735a5744c95ff5daa0d0469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290942, "uuid": "e54dc2ba-53c1-4851-b167-e2c2dc3dd11d", "value": "T1F9F4163CF8A49BD6E23AF7738557E210F3F550F3B311C8166EE2888502A5A71A2DE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290942, "uuid": "238d40cc-8715-4ad0-aae6-2fcb2709553e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290942, "uuid": "b0191e6a-36f3-44f8-a474-2aa99de59693", "value": "12288:YetpEuAYc6N3kQinYDnK3FQpP3mq/5Io3BxXcCE+tM5m:5pEbYc6ScK3S+q/5IWBmGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290942, "uuid": "25fb66c5-ba58-4aec-af0d-dc9cea3ce512", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290942, "uuid": "33f54a0e-1086-4413-a5f4-8e17efc868af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290942, "uuid": "e7fe0e25-21a5-44cd-bd57-d838586e6c21", "value": "3c2f3ade8f0afd33c1607b95da3eb1de35863e65e1d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ad6e0-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266824, "uuid": "04742695-5d1d-4814-8629-645442d8f640", "comment": "Malware payload (Mirai)", "value": "7cfebe14068e321338c61dbd5275a093", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266824, "uuid": "32990dea-d876-4745-b666-59179cb6dfe9", "comment": "Malware payload (Mirai)", "value": "3ca657ed2cb37b8b3896120be392b72010d1782a41a5068db27a3211ea0c2ed3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266824, "uuid": "d3c69c40-ace0-41b2-bfb3-84219346be6c", "comment": "Malware payload (Mirai)", "value": "197a47740bd92fb68a1508f15e7bf247668d05c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266824, "uuid": "1e3bfc2e-0a14-41fb-84eb-ced0933802fe", "comment": "Malware payload (Mirai)", "value": "34e5d01f8c6c090b0b6df04a592856dbd03ff737b8d3c703fb2cbf89292bedf8374eeab8071e772ded2dd523782e3181", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266824, "uuid": "f5206e3c-2c67-4fc2-a63e-072a7920f376", "value": "T1BD93B60D7E218FBDFBA9823547B78E25965833C627A1D641E16CD6012EB034E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266824, "uuid": "dd6d3318-583c-4da8-990b-bc70f31b54aa", "value": "768:AEHaREVjHrAj3fkYEuP0Y3ZhS1MN/ZFlFbhEf0uARBGGK/PeA6wQTbg/0+Db7lY2:haRsUfk0MiZjhk6wiEDCh1eeeItGhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266824, "uuid": "632a8c2a-689e-4ef0-bb73-bd15642e7c91", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266824, "uuid": "67abdd66-3bd7-463d-a290-15fda807c950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266824, "uuid": "94c92a5b-0f4b-4b82-88ff-95994e3f205d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85f7888-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309106, "uuid": "ea66fcea-cce3-4d92-b376-0ad69aa55b8f", "comment": "Malware payload", "value": "d141a3f91eeb323993381bfc0d13bf55", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309106, "uuid": "54e6ae73-94d9-4d93-a75a-3f9c172f1f5a", "comment": "Malware payload", "value": "3d751898a915e9e5f6a89d140364e596b68e0255a3c6aebd85cfe51f57e36ec2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309106, "uuid": "e53e18be-048b-4a0c-8ee0-f101b36bc859", "comment": "Malware payload", "value": "46fe21afc5908b8581b8d66898d8df9c173ff11e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309106, "uuid": "c207a9b2-a6a3-4141-9e31-a736934bd3d7", "comment": "Malware payload", "value": "33b3527661bae7926ed9afd50ee9f715f097e8043d2e38e4fcda760dcb4f2b8303640cf6d541419f411b4599d1f3f5f5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309106, "uuid": "f6a65ac1-7a6d-45e6-adce-5e043312c2cf", "value": "T19D55F1039238AE4BD102C3BDBA2F3559111EBC3671C1A58A764DB74F4732FA649BF618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309106, "uuid": "1b984b0b-6bf2-4d6f-8a9f-fa52ce3b3702", "value": "24576:TLKtB1tHlxHWQmmav30xV2B9ntHlx2WQmmav30x96YNIE/5NF+aZKhQU+5n:TLKt572QmmQ30+rh7rQmmQ30H6FE/5f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309106, "uuid": "09e14c1a-260a-4bbb-9a0b-8051e28ea7ca", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309106, "uuid": "d5f2781d-f881-4781-84de-07591397070d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309106, "uuid": "dfc3d23e-9df7-4b01-967a-6b4f7a9f8e3b", "value": "PO SHEET.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae34270-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309432, "uuid": "36cc490e-cfc4-4957-915c-3fb1cbf21212", "comment": "Malware payload (GuLoader)", "value": "1fb29471b968fcb05b4fecc10c4ed86a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309432, "uuid": "b6517a6f-1d2f-4fa1-a205-bf31152fb532", "comment": "Malware payload (GuLoader)", "value": "3e0c2c4729e6d6d920303298fe0f8c22982d2d747c67aab39c43128deecda913", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309432, "uuid": "292b4ccc-f3d4-4db0-a3d6-8901f98fb14d", "comment": "Malware payload (GuLoader)", "value": "e0f30c56523e2a9729aff81c909c719587427d64", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309432, "uuid": "2d696065-1b2d-4723-812c-661761643c8b", "comment": "Malware payload (GuLoader)", "value": "fae2ac709f7f9328dbc9db46e3110fff7e5644279cad2b86141343db211d614059eaecb2ff08267c6a9f2ccd8d42baa7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309432, "uuid": "446d9276-1d49-4561-b7e6-ef0f2b71dcd0", "value": "T1AE457D62DA172A294D1F279EED820C9545BDC12D42370139FEAE238E660365CD3FEB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309432, "uuid": "4189e031-c967-456a-8ca0-e5cf18377d12", "value": "24576:yJvX7e4GCm14K8DZVmdUAHkc/umEUe4NLnDRo3LL:+De4VKAMUMqR4Zto3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309432, "uuid": "ee3e86fd-ae3b-4c26-8ce0-0ca3efd1c8db", "value": 1247921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309432, "uuid": "ff118dec-f3c0-45b8-a0a2-c48593d46c99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309432, "uuid": "3b64a41d-b793-4230-8138-fe04f17338dc", "value": "RFQ - Automotive Industry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b553fe-bdcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1678292322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292322, "uuid": "d317ccd5-c5c2-40aa-96f2-1b8a11d99f35", "comment": "Malware payload (Guildma)", "value": "4b7fdf0fc9b08009e26475544e96fdbb", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292322, "uuid": "211f315d-265d-4676-9149-1107ca6005c4", "comment": "Malware payload (Guildma)", "value": "3e5c835ea46a0cea935d1408fc8db29a0e49a0189997759e7d23e0b751b8a963", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292322, "uuid": "340c7a1d-d8e3-4d77-af4e-ce8c06db5996", "comment": "Malware payload (Guildma)", "value": "cd4a4deacb1c22015ba9fbecd578d5553a89e053", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292322, "uuid": "d87abc1e-c5c2-47d9-8e9a-7dcd6c842e0a", "comment": "Malware payload (Guildma)", "value": "37a26dd2c4ac8ad5627b239f5570913c60dde879e0e8294ce5ec3feb6141cca50eebd2385c76ad132ef955f17fbc28b6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292322, "uuid": "f49915d8-f417-4818-96b7-ac8b7770e91d", "value": "T174F02B0FA1412E52D568533788569B604DCCBB562B09609A568E0FD55A2098C9F1E9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292322, "uuid": "5582ceb2-2e26-4918-94a7-8fe9dc2301a7", "value": "12:8rflM8OBE6ZGZgkAYjd8bLBOmWm7HPVVdBpXcX:8loGZFAYsLBOlm7HP3db0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678292322, "uuid": "d321b5db-c4f2-4e20-8856-179f0b155f32", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678292322, "uuid": "73fa314d-a4d6-48a6-93bb-2f4540f82287", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292322, "uuid": "c5f5b04d-a7da-4685-b5d4-5832be75fdcc", "value": "56749025_248.49741070.744024.76535.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fcecb6-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309429, "uuid": "f678b529-1378-431e-9ef9-470f74e9942f", "comment": "Malware payload", "value": "04e8ee1564bb3b31f8b8165f7954c9d5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309429, "uuid": "6875931c-a1d6-4471-ac19-91fc110395dd", "comment": "Malware payload", "value": "3ffdd312d44bbbb8bc6f3c3b56f9a7f511f6cf89d4ffe146f7fe63463aea0303", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309429, "uuid": "2d31db9a-3202-497f-b3fb-d59bbf6e20a2", "comment": "Malware payload", "value": "bb2ec5c41c03b63dbdeba53ee30a0cb94034aba3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309429, "uuid": "9076c19e-c6ce-4854-9e48-f648ee29d349", "comment": "Malware payload", "value": "3f1bbeade213cf5c3088cf4cd20b24ce8d992d6c6e5dd7d639e4a7fd636e287844795f00b32e29c74cccca8e1639bd44", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309429, "uuid": "2e8217f1-f1c0-47ff-bcb7-a5e9845cfb11", "value": "T1BBD26B62DE160A2495572BFBDC470C7085A8887BA1334874BEADB36D790334C9B3EB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309429, "uuid": "c66c9098-fc23-4259-b4a7-d7bbcf1f1605", "value": "384:+v3bg7tfNXv4QcIiDgySVlsv8U/4trpHza9CsXAEXEwyTSSLGwKSQsRh8qol+8:oqVXKzDgyS/g88Q6L0ZTLhn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309429, "uuid": "46c6d388-b1db-4594-8216-bd0c87097c0f", "value": 28544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309429, "uuid": "dd71f43b-0e52-40a8-8965-cee5711bdf9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309429, "uuid": "ff0c7436-58c5-459a-a9a8-782e02887ff9", "value": "SOA0823.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a03feb6-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678259421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259421, "uuid": "12699fb8-7ba9-4f6a-a02e-d2a5e2319c59", "comment": "Malware payload (RedLineStealer)", "value": "2ee41b836f7c707d746c6a833b7e1a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259421, "uuid": "8acad134-080d-4ce1-b9d3-df129201c301", "comment": "Malware payload (RedLineStealer)", "value": "40f45b29f62c96640b2a63dd7ac82af790691772ee6de48e46a243e78ee428bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259421, "uuid": "3c91af9c-94d4-4096-b6c2-e88b09eb59ba", "comment": "Malware payload (RedLineStealer)", "value": "589f9ff89bbb0a938ffbea1cc221fe34065f84f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259421, "uuid": "9dd40bc2-c0c5-447b-a944-7692b885c981", "comment": "Malware payload (RedLineStealer)", "value": "7a9f58a8c0d170915c3b3c387498fee69dda56c8ed2fea416d4c14f17b5390505256c34ac96805983e7075bbea28fcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259421, "uuid": "516a044d-57cf-41ce-ac25-573b9f8a7900", "value": "T194F40293A6F07C64DA3B5B726D2E96D82A5EF5914F1AA73B133C8A6F01700B1C573312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259421, "uuid": "a9f72b4e-b819-4ea3-b4f9-aec4838981de", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259421, "uuid": "3212da29-0f71-4626-ae8b-0fd33e53684e", "value": "12288:XEsDDeWzZ9ZiS3M7iS3Yv95AAzTHOBoGzsgW+L6LVt5VBI6rro1RqouxRQRuz:KW9T33M7iSiTVWa+L6ht5VxrukoSRQAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259421, "uuid": "326702e0-0f91-4924-9a3c-c4f1f8e3f785", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259421, "uuid": "75f46b22-6220-4da5-961e-5c3ea7d094c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259421, "uuid": "15e89e5d-5ce7-4ec5-b0d1-fd4699b6eaeb", "value": "2ee41b836f7c707d746c6a833b7e1a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29959e8e-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678308329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308329, "uuid": "0f0b8535-8919-43e4-a0ca-6696af37a422", "comment": "Malware payload (njrat)", "value": "8aa34cdebf2b6198a378669b16aacf5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308329, "uuid": "78c5dc74-946d-4bcb-b32b-2656264d4afe", "comment": "Malware payload (njrat)", "value": "4331d07d025fbb29f4acd1d9c616a7f71a72bdf02a5f00ce5e40fc6004545723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308329, "uuid": "a2f1db9f-abc7-4492-95bc-034f01072e30", "comment": "Malware payload (njrat)", "value": "20645df8d8215a1f2841dac0ca9fba7a66d05006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308329, "uuid": "f2f7a4bc-9f7e-496c-8957-d6f01616a0df", "comment": "Malware payload (njrat)", "value": "05d874dc88de5261f4a8dc4c08097ebddb5935b5cd0be4bf67ec506507a65408a50aeaee690b92c9c1e7242790580730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308329, "uuid": "d3960892-a2b1-4196-9417-e304e1dd0875", "value": "T18813E98CB744E174D5FF8BF0B8D2B2990B729017A902970B99F114D98FB3AD09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308329, "uuid": "fcf76827-f599-428e-a690-2725f0294b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308329, "uuid": "a3e10b0a-1f09-4fac-8381-920217d88666", "value": "384:zZe0ziOdsbhKIyKFlD9siEEILr2jCCnKR13cUNNNCP33hYCtVKwJR7AMi/greT0k:9NNiwFKLD9n0yCCK0UVupVZi/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308329, "uuid": "2fae9958-2096-4d97-a1ee-6cfe20cfae90", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308329, "uuid": "2ad61e7b-4cca-4295-8dcf-5a98c5f678a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308329, "uuid": "43fb8652-f44a-4a85-8658-c887f156f498", "value": "8aa34cdebf2b6198a378669b16aacf5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8821b33-bd4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678236413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236413, "uuid": "63509011-6d70-4ff5-8c84-a246a4ea3c88", "comment": "Malware payload (SnakeKeylogger)", "value": "f10caa63bef70662a123611402191200", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236413, "uuid": "034e2eb6-ba5b-456c-aec8-3aaf07b26b03", "comment": "Malware payload (SnakeKeylogger)", "value": "452a0f1b924d0aa8d7bb37f6c56cab6a2f20a4231d5d54ca71ffae1ce635300b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236413, "uuid": "0131c80a-f51d-4301-b0a2-4110445878d6", "comment": "Malware payload (SnakeKeylogger)", "value": "a79a651fb978d527c3021f37897d751483b8958f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236413, "uuid": "607e3939-b4dc-4c22-b76c-1dffe355056c", "comment": "Malware payload (SnakeKeylogger)", "value": "b422627cfb80a3ae2488dd06495eaad39482a2d434fba2201be5d0697dcbcf8fc6daed0433511593c4500309d2fe5c4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236413, "uuid": "90f8aeb5-f5ba-460c-b58d-1173731145f9", "value": "T1C525AD956F196653E7E2A0B3180497B2EF9CBD0D6426C4843AF33D8FB0B9DAC0151E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236413, "uuid": "7dd27759-ba8b-48fd-81ff-823cb08a271c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236413, "uuid": "20ac063e-1723-49c9-851d-0c7813db867e", "value": "12288:bGX37BVmNUN++0ypJTHDU3rRrW0+9GIm+xh0B+iQhmEb0D55DUq2ElFYjvqBe4:kFYNUY+5/8rjtS0vQ0B7oqlovqBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236413, "uuid": "4abfa7c6-03fe-4429-af6d-4cbe074f63b1", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236413, "uuid": "72a6ae0e-ae7a-4ff3-858f-518b536aaf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236413, "uuid": "5709f5e6-ae0b-4e68-888b-e1a26845d67e", "value": "f10caa63bef70662a123611402191200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50206b3-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309046, "uuid": "651068c7-5374-4b59-8a41-5690684a3c55", "comment": "Malware payload", "value": "7e2ccc7e958934fbd230ebe3a2d5f980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309046, "uuid": "d3c00ca8-c679-4f4f-bd6a-7b42f92d1f98", "comment": "Malware payload", "value": "4584873b2e26339466f7847946da9b69c03783d1fca64d497de6d6fb1d4d7b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309046, "uuid": "754f0e46-784a-4044-9a6e-26c6e160fad0", "comment": "Malware payload", "value": "7135251398f7debf9cf63350c7d9e78e018733cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309046, "uuid": "5e226765-2a6e-463b-b178-aff7db104f38", "comment": "Malware payload", "value": "d1efaa020e8c0a6ecb028bcf0800b102aa4c304fdcbde5acf8107cc9bc37dc072cdc82fd020db50b646e6f69e373417a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309046, "uuid": "e9623d00-4e06-49a5-b656-25350dbed5fa", "value": "T1BD263394A55DB339C0B4F1380562F3AD6E63748A7F4A5A9202A7FC3DC32978A3FD0951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309046, "uuid": "3b5e7bdb-0abe-482c-9a18-1a1cc005a800", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309046, "uuid": "36ea417a-d133-4fb2-b3fe-cc72ea89ea48", "value": "98304:cXQDZS6pfT+p27DwYZ+oznPAFhsfh7zMk:cXt6FTRDNdn4IftzMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309046, "uuid": "e39674f9-2c98-4639-8a71-ba8b5f0ec0dc", "value": 4510720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309046, "uuid": "25bc4278-d5a2-4cb0-b301-c83160923b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309046, "uuid": "ce900d55-d727-444f-a3ec-190458147aa9", "value": "7e2ccc7e958934fbd230ebe3a2d5f980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8165803f-bda0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678273258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273258, "uuid": "ed6e048c-5d4d-4c38-85a3-913fcdfbce2f", "comment": "Malware payload (AgentTesla)", "value": "1ac711a26a456f1ce813a04789ed155d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273258, "uuid": "81a5df73-c2b3-401e-ac30-93586d98d236", "comment": "Malware payload (AgentTesla)", "value": "458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273258, "uuid": "db291e39-0a2a-4b9f-8d84-3d3137ac9dfe", "comment": "Malware payload (AgentTesla)", "value": "ac016ebec655c9bffe783b07486920057b7b4d51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273258, "uuid": "6f84dcb6-ed6b-4d40-ac01-951024e7a405", "comment": "Malware payload (AgentTesla)", "value": "109ad55442eed6d49024f79f4c7ed3d23b15296ebae603f0b4c62b66b359e875db152254dfd55b154551980b3021e696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273258, "uuid": "9fc77187-e2a3-44fd-99e9-6522c5eed277", "value": "T111F3296892858E12CF2D40B8CCA0704936B293764617F75D1FE198FA3F467C3766A86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273258, "uuid": "e7637afc-e811-4ea7-8d32-245be7e958b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273258, "uuid": "ba57e247-1a4d-473d-aa8b-fe19ce0043b0", "value": "3072:+JFBxpM0n04NWObOalUSQZJOE3PgBLGHVymnmYM3iQ3qPxJd:+JFJMYpF1IgBGHV9miQ3qpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273258, "uuid": "8d6a90b7-c42c-467a-be52-d9a24896063b", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273258, "uuid": "c8406dc3-fd02-4650-b43c-ce518f05e550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273258, "uuid": "ed5cefcc-4973-4122-be77-c03077ad0255", "value": "458693582869e51d5da66a6e82b2303e39dbd8b82a3bdaa9d5be3936aa55ee0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03d4cce-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678277739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277739, "uuid": "0991d420-3b4c-4e63-aa31-991eed814afa", "comment": "Malware payload (RedLineStealer)", "value": "4373eba7af5ff3a82acd4d500f3735bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277739, "uuid": "6a90bebf-44a6-4e80-9114-eafff083e2d2", "comment": "Malware payload (RedLineStealer)", "value": "4657e169ad2386f59a20b2623eeca5f6dcfc0c363622154708a33ace9678debc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277739, "uuid": "23037131-b76b-4351-b564-c2a0e54d995e", "comment": "Malware payload (RedLineStealer)", "value": "5a1fc377a7c03ee5a1a1dd7c8ebc73339e6e77d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277739, "uuid": "2d05019c-58aa-4b98-9c02-f764eab76090", "comment": "Malware payload (RedLineStealer)", "value": "befd3f73b29911963631b39972684d63c30ed419d3a8b91c0572367736c948c2488a35aa7b645837785c3c038da814ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277739, "uuid": "666d22f3-4f12-40ee-92dd-76a654dfca1c", "value": "T11C840112B6A1C077C15749B41D25DB946A3EBC70D6A58E8F33C86BFF6D30391A66330A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277739, "uuid": "09843644-35e1-4cef-857e-51a8df154bb0", "value": "60fb081f0cd291e970c071b192d852f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277739, "uuid": "e7545fc1-2dff-487e-906f-f725219fbb48", "value": "6144:YnYgLtx9Yk1O/M7yl5jFV2gNdTVqZSk75K33br3RKWOQU4qCD0oEOcR69dczOn:Vgf9YAGl5pVfdT4ZSq5GL9KWQ5MrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277739, "uuid": "b954e3b0-1d19-4c3a-a21c-4881a11b9ab3", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277739, "uuid": "402b4678-d755-4d1a-a615-db8fd83ced54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277739, "uuid": "22f8640e-ec71-46c1-942c-02b5085e1923", "value": "4373eba7af5ff3a82acd4d500f3735bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95977bb-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309080, "uuid": "78d2617c-3083-4370-8315-fb6615bc046a", "comment": "Malware payload", "value": "b877b1ff6a16f737e2075ec91e67b45a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309080, "uuid": "67cc7474-9b48-4e2b-8322-ce8077bd7a1e", "comment": "Malware payload", "value": "47116af96aa033477617b2b06bbe5b409b7702169f14a7abfdf7ae8517ee4e24", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309080, "uuid": "7bdc8b2d-bc23-4802-85bf-20a7802f66a4", "comment": "Malware payload", "value": "2147bfaec1487d080ec14103a20d89da1c7589fe", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309080, "uuid": "bd4d566b-cedc-4cd4-8390-2e8a38c8ff50", "comment": "Malware payload", "value": "0c550df56e8ca8698d7290f85ab995d48d7d5c11a1fcff0ed81721b360f98849aed3b99f60aa0361969102b2e083ad26", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309080, "uuid": "bbb3f512-3c88-4308-816a-9a8bc310ca29", "value": "T13955F1039238AD4BD102C7BDBA6F7559010E7C3672D1A98A764CB70B4733FA65ABF109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309080, "uuid": "57ef5f6a-fc5b-492a-81b5-93deff8f1866", "value": "24576:OLKeBXtHlxpWQmmav30xTBj/tHlxNWQmmav30x/h6FwEzuAaBk0R:OLKeT74QmmQ30l5Z7sQmmQ30lh6KSuAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309080, "uuid": "14508f53-ec35-4aa0-a995-c87b6ae367e4", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309080, "uuid": "f9ab1b02-ebc4-49e7-8a23-5194896a8077", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309080, "uuid": "f097d73f-6960-45a9-af44-6d7ea4b59625", "value": "Swift Takip_92be67ab-e027-4955-b6fc-64bd720b2ba0.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b69bbdf-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678270617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270617, "uuid": "b2ce81ec-492b-4cbd-8894-850d0ee986f6", "comment": "Malware payload (Mirai)", "value": "9bef7fcb0c61edc87857df515afdab1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270617, "uuid": "cb0eba87-6baf-4b50-a43e-54bd28c2fd66", "comment": "Malware payload (Mirai)", "value": "477f4865758a2c096f767fa2fd7e65a8cc2e7c3204553271610a3101ef073894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270617, "uuid": "096c48df-fb11-4419-8f1a-d7526da904be", "comment": "Malware payload (Mirai)", "value": "b4169103372494a5a2fff911523e39ced9e339a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270617, "uuid": "2022688b-d46f-4d3e-b58b-6c5545ec85c1", "comment": "Malware payload (Mirai)", "value": "1d8060aa7ecd9ba884e9797a0c14e524450a2f6dd09cbf6245e935e418d1068bd9dc53ea1b6f15281e7b296494ee9e0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270617, "uuid": "1a2d2768-86a9-4bf3-a42f-21a3196b1bd3", "value": "T19B734B02B71C0E43D1A31AB0263F57E193AEE9D022F4F688255ECB9A95B1E375546FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270617, "uuid": "36e564c7-a9af-40df-a52a-82915daa8f1e", "value": "768:TTqrphodQ/z/P6oUXInCseKfTLvsh2ryR9RgVwRx37pgQdQM2uQnUhHgETyW9e9p:jsgfGwGQMUhHhE5yY/PxHNCy+waG4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270617, "uuid": "24b8c9d3-c2c6-4c07-a6c2-303ebfd8f2e2", "value": 73544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270617, "uuid": "6e33ca04-089e-4d5e-8f3c-bfb153a8d9f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270617, "uuid": "a0fc10d9-16b2-49e2-9779-4f872fb7d729", "value": "9bef7fcb0c61edc87857df515afdab1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01eca82c-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308263, "uuid": "7192b9f6-16f1-4ef4-bef7-6e965066ef01", "comment": "Malware payload", "value": "9b45b9e434705818fe9db55e8866908b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308263, "uuid": "e1a89f7f-c598-4b19-95b2-74b38a5b8697", "comment": "Malware payload", "value": "47c4fa00d7ee7bc2a3887c374befec0cdad3ecbb22dd1a25ae227d9e05528ffc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308263, "uuid": "d198dee6-6b9d-4efa-b892-d0f3b3c20c4d", "comment": "Malware payload", "value": "52aefa7fb8a93fda149d05166001538092678b0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308263, "uuid": "015031b0-9789-493f-8a6a-8043d5507e01", "comment": "Malware payload", "value": "0d3f4a10667b96849c3653919f2cba212d705a7d4b073d653a1b50f14657950027ab10f3cf9f78243aa4bbb4a975fa15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308263, "uuid": "ecea7b8f-11d9-47a2-ad86-cb0d64576a5b", "value": "T1D6363941F9DB80B5EA03193118A7A2BF27307D098B24DB87EB547F6BF8766D10D32619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308263, "uuid": "54f09651-3527-47e0-a679-92d269bd92d6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308263, "uuid": "e2f4e491-17f0-4a53-906c-2229594d1d61", "value": "49152:c9Z53c1RAkV4Pad5bMuuml5KLxX8+SsxPlVwWbz17kfXMsZfIOA7vTGpFeitm/N8:MZRc1nVHTbPumlbWbz2f9INFBsZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308263, "uuid": "4fa1c37a-cae7-40ce-ad78-69125cf83d46", "value": 5336064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308263, "uuid": "bc386ada-ca1b-442d-bf42-c9f2afb7c7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308263, "uuid": "c557a26a-ad49-432a-ba06-fb335b97a10b", "value": "ransomware.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1462cc2c-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1678282524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "a7aa0fa9-a1f3-478e-ab66-a23708460ee8", "comment": "Malware payload (AuroraStealer)", "value": "15d1bdb5f6e3267b936b401485897479", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "92b68580-420e-4f0d-bd19-833eb7ca9466", "comment": "Malware payload (AuroraStealer)", "value": "48392e0c0969580a9eaa9fa882b543b319ea08e6492d3a6819bc0c5b64d78396", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "1da72cfd-6cf8-4632-9e50-ec19a1aa0c06", "comment": "Malware payload (AuroraStealer)", "value": "f9f1c88d6d1e929a42c15dc3c0c0afefbe42544d", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "806e90b4-f02f-4e4b-b438-8e561b072f01", "comment": "Malware payload (AuroraStealer)", "value": "9f03875880690dd4003ccf4ae97d112509c608528b65616f8740c9713213565d1474e4e3b289f8863b4b008b8e4c6928", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "6e8fec82-e351-4131-91d4-a2f4f94b7a5c", "value": "T164264A91FEDB44F0E50319314897A27F27342D099F35DAC7E9507F6AE833AE60A32529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "3d98f62d-a33a-42a4-9ad1-4a58ee7dc7ba", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "524f10da-dacb-42bc-af6b-9f758721ee44", "value": "49152:C2sQ8R/u6S/gPV4PW/vlLr8EdiITRf+EGg7dH1CaSo5qTk6k1lFAw8A7/eFwjDr9:CfQM/fSoPFNLQg1UTOWw8a0cDAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282524, "uuid": "0cbc12d4-fc96-469b-8efe-3733ed7e3f2e", "value": 4625240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282524, "uuid": "c74491d4-a319-4f6e-a9b0-ea042690172b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "e5d4ae59-5b99-4f39-ade5-b1a7c3791849", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c562aee-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274806, "uuid": "53d2b238-6d7e-42d5-9877-28b6432764e2", "comment": "Malware payload (Heodo)", "value": "3a9eb4e81856fbac7acd9bf813cf52b6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274806, "uuid": "20a92789-61b7-4717-be74-c5a2ac9df66f", "comment": "Malware payload (Heodo)", "value": "48658bc28fd342aaf8f283235b4cfa9bbb46225af188cea8ed88b110a313da66", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274806, "uuid": "f07fcdc2-0f81-47fb-b545-201e5feda1da", "comment": "Malware payload (Heodo)", "value": "8e5df9e77631d983c47e39ab0b912eaa384ad15d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274806, "uuid": "7e0089af-92c2-473b-a8fd-b04cebc680d0", "comment": "Malware payload (Heodo)", "value": "acbf69b41916fa840cb1c84a849bc1e2154a8d20a98e4a6aecd6b8a7673a162e38d695adc4505f85c2356796f4e59ed9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274806, "uuid": "b72b1986-d410-46b9-8f4d-a9f082de2b31", "value": "T13105233C5F67790FF5997C362AF3807AFCF9085CDC96A90A17532A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274806, "uuid": "9f4f0204-4c6b-4f72-a385-cb7061b5f1e3", "value": "12288:o4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sP:fevtlkdJe4m19Fgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274806, "uuid": "df963865-7e7e-48d5-b160-6803b527832e", "value": 858383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274806, "uuid": "97185352-42d9-46cc-b6ff-0efe78c8851e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274806, "uuid": "47e2e0e6-5891-435e-b292-5cb0e9b4feaf", "value": "uvD5nhgJDow49kFEhC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2641fef-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309418, "uuid": "582c06fe-e8a4-425e-bc32-40d0ad4dac3b", "comment": "Malware payload", "value": "022769b3cdeee7b9bc6514b89335ad46", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309418, "uuid": "a4872817-1f2b-4735-854f-cebac4d7bb3e", "comment": "Malware payload", "value": "487d7097a4ee03eecdf12fdac9b0775e8fe38f620acfb710a79ff5a3805fe57e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309418, "uuid": "df12ad89-3b70-430b-8f15-6ce10c5592f5", "comment": "Malware payload", "value": "f933c6297e5be02e6184d146bf6cdb59c5eaa36b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309418, "uuid": "519e4e6d-a3e4-497f-90b6-3b08fa013c3e", "comment": "Malware payload", "value": "36f47e2eb8a169a5da7b3fa07c04989440f2ab21d7574f3ad19aa9bac96fa2f05f26b762b670d3f8ba8c62e11981b24f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309418, "uuid": "d6295045-e58d-4ff0-9244-21a9e150b682", "value": "T12BE4E3509A3119E8CB1A3376889FC9AC1DE1321712D138EBCD6CD74A06F317A977D68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309418, "uuid": "7dc892bb-bb58-4450-a0c4-ef02b737eebe", "value": "12288:9v88Ht62yBsFeyMWHFo2BjaGgXIj2pmgK9VaBDLwQ5PN/fhAdR9O:9UCyikWHFTPaa2l+dR9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309418, "uuid": "a166a625-7fe8-44a1-8936-cf2c87b5ccab", "value": 674562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309418, "uuid": "79760ff3-9ec4-467b-93ce-7280e87cb290", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309418, "uuid": "3734a96f-af87-4ef7-aba2-826ca772a367", "value": "(70)DECOSERVEIS fact. num.2023.70 FyA.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f7b546-bdf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678308105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308105, "uuid": "7f0d8732-8e18-415c-8356-d7cb515fd95f", "comment": "Malware payload (AgentTesla)", "value": "e553a44842053dc2a96333f5451244e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308105, "uuid": "fa7fc339-ba91-4be5-92c9-cb66f359a957", "comment": "Malware payload (AgentTesla)", "value": "48ba15159b820bdaab3c320377fcc4e5210db06be1bb0e025b81e01adbe5e962", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308105, "uuid": "5aac9564-db9d-4815-92a1-bd2d5ec80c96", "comment": "Malware payload (AgentTesla)", "value": "a0152d89cca84c28eae4b6343b0550d3da76d5c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308105, "uuid": "0b3f28c6-64e8-4d01-a6b2-1221d0e22d8a", "comment": "Malware payload (AgentTesla)", "value": "ead4ecac67860833c71d49bb6bcd9bd188e23b7b34f648e9be0374909dbf31b110312ea36eedebd03059a4a5abdae6d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308105, "uuid": "98ce4814-46d5-48ad-9484-74991aef3de2", "value": "T18815BD57F245A82EE8BEE730DD86BD54E831B0727212751B71DBC08887ADAF29B041D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308105, "uuid": "2276c220-52cc-40a9-ae54-a440db8b08ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308105, "uuid": "b1e1ee00-1067-4ef1-abee-bb48a3d65bfe", "value": "12288:3e3yglF1adHqAqWnBc6//zScEgLeaUISS8AzMzxYxDxmR5Y0j4dXY/RIppoeynF:3e3vuHql6/2cXLCSrMSACe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308105, "uuid": "f2ebe9dd-c1c6-4366-9999-5624ada0f16b", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308105, "uuid": "b1c9be8b-daff-4bf8-97b8-79de43163798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308105, "uuid": "b81c606e-c901-4ade-b785-983954aa4b97", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4850f106-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284758, "uuid": "da375c82-7280-46d4-958d-4b24529ad635", "comment": "Malware payload (Heodo)", "value": "ec471c85184b3a4fb984433cac79a81d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284758, "uuid": "dfb7055b-e213-4f3e-8603-094d3f3983ba", "comment": "Malware payload (Heodo)", "value": "49194505996599bf0657f6826fdfda771df74db5629b1169909c893cf8f20fa1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284758, "uuid": "ae45a2c3-e5c5-447b-b557-85404616be6a", "comment": "Malware payload (Heodo)", "value": "3741fa466435231f84571f01474df89414c6ef7a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284758, "uuid": "7aa99806-5f15-4557-8306-72798c22262b", "comment": "Malware payload (Heodo)", "value": "7a64f5041684d71bc0c771c82fbf8d4cbdb8ce0eaa815f93e4fce872e06bca15157b06486618e872a7c55d0f88e3a3c0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284758, "uuid": "af32b20b-3109-43d1-9056-c14f35aebd14", "value": "T1EB15233C5F67790FF6997C362AF3807AFCF9085CDC96E90A17431A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284758, "uuid": "68536c65-6272-4571-9c92-a7a67beceb03", "value": "12288:F4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sm:6evtlkdJe4m19FgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284758, "uuid": "1aa59cda-f15c-4ef7-a23d-966458fdfb46", "value": 893002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284758, "uuid": "50fe1819-5212-4154-9a6a-e11e7dbe019c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284758, "uuid": "41f60ea9-2169-4d9a-8640-fb2b01ba7ebd", "value": "U033dG9v0usgsOcLYza.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeed01c7-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1678309519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309519, "uuid": "204f5488-632e-4657-9c1c-613ce9de2078", "comment": "Malware payload (STRRAT)", "value": "1241d246c3e8ae70f392dd9e51d4eefd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309519, "uuid": "b41fdcdd-7a61-41ba-bec8-80c6d53933b6", "comment": "Malware payload (STRRAT)", "value": "49fb9881e5a79c38f665b232121d25fa9a909828a846c3410d71aac587307ab4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309519, "uuid": "acc3e21d-6790-4330-ad86-9cf04609a0c4", "comment": "Malware payload (STRRAT)", "value": "1175f314ae6d792ed2f083e54f04d26bd6e90586", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309519, "uuid": "2badad85-040b-4673-845c-0ceff75ca8e6", "comment": "Malware payload (STRRAT)", "value": "2c0d9b9333f22b5d66f54e4d4c6c9d26cf437ef076cdbb58e0390802e9661fddf95ac77308d237a06631911eeacc211f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309519, "uuid": "7b46881f-1542-44d3-9a09-287bfc84c237", "value": "T17224F10EFEAAD0FAE10B1439100DCE77962CD6A8D741C63B65F850961C39C761A36ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309519, "uuid": "3c84b43a-686c-484b-9ccd-e49ad01a504e", "value": "6144:YEtUP+IAjYOowshDq/bHEthVrSpmdj8YzCt3pdbq+:jC2IeYOoPAkDVJdj3kpdb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309519, "uuid": "a8355909-95fe-4c73-960d-218d4f4d95e2", "value": 224810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309519, "uuid": "903a4690-66ae-4c74-9893-199e2a5b342c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309519, "uuid": "e367a7a2-7465-4263-8299-8b3aa6c4d6c2", "value": "EFT_Deposit#9378478Direct-statement.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50e1ee9-bdba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284619, "uuid": "d7800ae6-de8a-47c4-8064-7c350a312671", "comment": "Malware payload (Heodo)", "value": "7294ea5c4709c55f452f7cc4472bb505", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284619, "uuid": "2c0afb7e-77f1-4338-91ed-ab3d54eba0f6", "comment": "Malware payload (Heodo)", "value": "4ae6cfccdf204d3e7909ad0fb71f4149fe1577aa6953b27e47059fdf12cdb04f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284619, "uuid": "900b0d14-2b3f-4287-bef6-4780f0723efe", "comment": "Malware payload (Heodo)", "value": "4a0bb323094884e34c392ea5084328bf859f5591", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284619, "uuid": "a076c7bb-7f49-4bbf-8c6d-c5f0928cdcb7", "comment": "Malware payload (Heodo)", "value": "c4b60aa0215098a43cb8c885c9bcb72cf12cae32cc531e84ce8a85be0aae6b5d209288ace212677c80cd74b6ee092955", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284619, "uuid": "70ff7dca-04e1-449c-82cc-730269f57633", "value": "T15305233C5F67790FF6997C362AF3847AFCF9085CDC96E90A17471A9209AB2042794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284619, "uuid": "808a8a5a-68e8-4466-9b3b-cbef33fd20ab", "value": "12288:y4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sQ:FevtlkdJe4m19Fg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284619, "uuid": "b4d8606e-62e4-4998-9a15-46f48c1f276f", "value": 870644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284619, "uuid": "0e668c32-24b3-43ac-86dd-27e0a2cb8efc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284619, "uuid": "fde8bac2-d0d3-44e9-8464-1ab4bb26ca89", "value": "kbN899WTpREvpuwJlLUU4xjo37RB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6ead73-bde8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678304364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304364, "uuid": "5f5fb6fa-96a7-4a48-9089-055bc102975e", "comment": "Malware payload (GCleaner)", "value": "d554d767e490e4a920b0efde009c1ee2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304364, "uuid": "1179fcfc-aea6-47ab-a3a0-1cd772f21efc", "comment": "Malware payload (GCleaner)", "value": "4b0e4fd6806fe1cd9dd277211a3aa9ab0510a3795355190acf8a84f6a2e5a508", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304364, "uuid": "6984ec45-31d7-4e22-8c03-83e9c63f81c7", "comment": "Malware payload (GCleaner)", "value": "685f5852949a32832eb38314a699b7697550ad2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678304364, "uuid": "cec86a13-3d4b-458a-a1bb-be663060e098", "comment": "Malware payload (GCleaner)", "value": "855cbb779433db4fe37083c8e322aa775afdff3b8a1bfa7ca04664c0e90718c90dcead1738b1698951f3b8d2e96a3b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304364, "uuid": "432690a6-c8c5-45cf-83e2-95c9d0a55c82", "value": "T18654C01193E1AC30F5779B708E3AF3E56A2EF4615E3BE7D922281A1F09B11D1D963342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304364, "uuid": "b3e70976-f32d-4806-9953-489c6e3a0489", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304364, "uuid": "8893b0dd-f6d5-41fb-816f-34d4ed6be2fd", "value": "6144:IzaompYs/FnG2Hq9h8GE2u73uySVApc+:uEYs/hG2K9hjeSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678304364, "uuid": "b5ee174b-63fb-493d-b96e-8351dbf69671", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678304364, "uuid": "3fa4b584-8236-458d-b675-eabbec8da64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678304364, "uuid": "69ef9b73-8605-422f-a92c-c127e8df4dec", "value": "d554d767e490e4a920b0efde009c1ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853d54ef-bd86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678262097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262097, "uuid": "0b62001f-eb66-4c62-b745-03f36c0e7c12", "comment": "Malware payload (AsyncRAT)", "value": "732a3a05a73370a359cbbb012831c14d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262097, "uuid": "0bf83a3a-ea09-4639-9d50-aac74ed9f14b", "comment": "Malware payload (AsyncRAT)", "value": "4b1f486d39c378ffdef7e655d0a3039537081b10a1520de0ae89bfe24cdc953e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262097, "uuid": "0b10c35c-68a6-4b81-a4a2-0ccc88e9937c", "comment": "Malware payload (AsyncRAT)", "value": "6e70c0ac39453356ff5c12a308275d7e31995523", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262097, "uuid": "6c572a74-12f0-446b-841d-ccccf2cfd8ba", "comment": "Malware payload (AsyncRAT)", "value": "24470f000df3dbaceefe5d1522aaec38312c2a0a7c061aeaaa850f3c892fa70de6e31ee2b137bf42da287078685fd540", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262097, "uuid": "3b4dcb53-ccde-4f43-8175-ef26c9862bc0", "value": "T14425CF827282817AFF63057861D5BE12701B7C1A0E3D956BF3A7854FC6276C58FAF242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262097, "uuid": "f8c953bd-0626-487d-84fe-f9eb64750695", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262097, "uuid": "a1e1f644-0dc9-4240-ae28-74fb5e604f5d", "value": "24576:kNA3R5drXZqFLto7/xoTTNaTreSa1R9iH0me:F5ZqFLtozuTITiMve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262097, "uuid": "327aa0b1-d8d9-4c3e-b2a8-6a27b7a9610e", "value": 972666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262097, "uuid": "34465ae3-a750-4dc9-8709-aec46c9ce2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262097, "uuid": "8ae8f482-035d-413b-98fa-c4f05b404508", "value": "Pago372023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2531b3-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274834, "uuid": "545de898-6cd6-4c0a-af65-f0cf65186259", "comment": "Malware payload (Heodo)", "value": "21309e4bb548a89214bdbdeae8504abf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274834, "uuid": "41ccd87f-82c9-46db-ae19-6f956a8027b1", "comment": "Malware payload (Heodo)", "value": "4bc2d14585c197ad3aa5836b3f7d9d784d7afe79856e0ddf850fc3c676b6ecb1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274834, "uuid": "7e8c3f39-d791-4249-b58c-3f6e861b8782", "comment": "Malware payload (Heodo)", "value": "b8a526c89826955e22c56b8909e761026efd5ded", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274834, "uuid": "0e9f4608-f112-4535-be92-a219fc5a0589", "comment": "Malware payload (Heodo)", "value": "438f6194376c7099cf58733640c2825bb50f0f9aa3ff32325d7bf961723c3828d8af992a6ddef9e1b5cd4b501f2dffcb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274834, "uuid": "c7e9f526-b44c-4727-a7b4-10813e7f33ea", "value": "T14BE412B1F4AF3319ED21F57811EADC430382B47F03C005D55EA8897EB2BE12AB55A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274834, "uuid": "6bc8e8a1-7163-4639-a5ff-b6a84b2d9f91", "value": "3072:n1lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3Cy:n12c/z4a5GLNIp1WMkd3tCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274834, "uuid": "25e7debe-6ec0-4d85-875d-e989e0c0f85b", "value": 670543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274834, "uuid": "e40fff3d-4974-4689-a170-292f6b4c2b71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274834, "uuid": "e3a936fd-c13f-47b9-8572-00eee2f23233", "value": "Form Dt 03.07.2023 [info removed].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eac7fd-bdb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678282367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282367, "uuid": "a4cbbaa8-604a-4f95-9a8c-ef7640772f78", "comment": "Malware payload (RedLineStealer)", "value": "c780b3167a20b5a301cf38a47632e8ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282367, "uuid": "82c947b5-ef73-4d53-a2ff-e971e4067ee9", "comment": "Malware payload (RedLineStealer)", "value": "4bfeeb31bc6bf577688eab439cd5e32d21bf6e78550f621acc9d1f6820d8c067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282367, "uuid": "7ed6e42b-02f8-4da3-a29f-6ac39aaee7f3", "comment": "Malware payload (RedLineStealer)", "value": "d40f9a142823ff045ef1744f295eea28ad5ea45d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282367, "uuid": "d5231c04-db4d-4b1e-88cf-1ac3b4ded480", "comment": "Malware payload (RedLineStealer)", "value": "a727383c3c93a4afbbf082eeedbc5582b0eee3bf17aaa4321293b8bff630414bfa394ecdef172869f121e07649904fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282367, "uuid": "c066e66e-0db4-4aa9-ac49-583c5a9a6685", "value": "T1B964D00277EDB961E6725A714E3DC3B53B2FBD634E68666F23186A1F09702D1C932312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282367, "uuid": "11e047d0-8ab2-44ec-8334-74c465455341", "value": "8a699b19de854b1d45a8cb5567d77787", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282367, "uuid": "3d3a474f-38fc-4f62-8186-bc3dedee6e97", "value": "3072:aQ3XmDX/mIMhZYn4jMEi+Ts1HBIexK+K0sc7I/xTTvyUYGyraHH2DmcnnIHiJlqP:teXuIMhqB6mmdzxdYaH2Dm2nIUGjyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282367, "uuid": "902407e5-39c5-4854-b941-5ef831ccdf0f", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282367, "uuid": "2e54aa02-28db-4090-a057-cb8a70a71c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282367, "uuid": "83d34d70-808e-40c6-ad33-c0fde7d7ef29", "value": "SecuriteInfo.com.Variant.Mikey.145425.22281.4686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedcedfe-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309439, "uuid": "24fb163a-119d-44ea-905a-490e854e308f", "comment": "Malware payload (AgentTesla)", "value": "ac04e071e75058d6204343de75accb15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309439, "uuid": "99b19c2f-3489-45f2-96ae-2e50f8dea629", "comment": "Malware payload (AgentTesla)", "value": "4c819b978445e6bef0b0e28b60f89bf65791bc4ba06c280815393ac8a355784e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309439, "uuid": "2aae7738-f19d-4f0b-ad13-c688f9a75d9f", "comment": "Malware payload (AgentTesla)", "value": "6d46f9b05100d34e28b19190ce9adc0f149a6dfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309439, "uuid": "72eff2b8-fcad-4fdf-ac22-bc445b8c8cef", "comment": "Malware payload (AgentTesla)", "value": "453e9ffd9f09d63c2253ee3989e2ab0579ddcd5ad2eeb7ea3f82b683fec875075211cd6a50bf495938c7585ba0616d51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309439, "uuid": "a3b79de7-615b-4277-9f60-9a82d73c58d4", "value": "T18674C78038EA044623FEB9A34F77F99D2776F1D6BC389E6D95DC0E4926DE5018421BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309439, "uuid": "776c6a3f-c741-46ec-bf31-34dbfd8355ac", "value": "768:EMWnJWPJxl27je0eQynfkamPewZNAtBVe2zpMvtMQAbJIj2i5s:1W4PJxl2ve0eQafkTewQQKgtMQO4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309439, "uuid": "bf14aefa-ad33-4738-94fd-0f4ec70f41c6", "value": 342476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309439, "uuid": "5c25519e-291b-4264-902a-76b8152a7a98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309439, "uuid": "d0c0b94a-37ed-49f6-8357-7f7e8671d7fa", "value": "NES790-456900.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4527fd51-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678282606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282606, "uuid": "6a34dd4f-22b0-4d92-99b2-db21d1c09798", "comment": "Malware payload (RedLineStealer)", "value": "0025bb6d0a9d41a97e19d014fd237e09", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282606, "uuid": "2d9a4b5d-aa89-4b70-aaa6-8dd95dd2eb3e", "comment": "Malware payload (RedLineStealer)", "value": "4c94ced8bc0b5686daaa87c648fbbf99f5d14cf24befd3a203138505901db038", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282606, "uuid": "8bb57784-acf4-4309-84a3-d68589718a4c", "comment": "Malware payload (RedLineStealer)", "value": "2cf196d7bd6ab6a27b2a0605cba0b89fa70d66fb", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282606, "uuid": "979eeb53-b23d-42da-a96f-cc89576ba682", "comment": "Malware payload (RedLineStealer)", "value": "217201fd752ab958e6dcbb0f24bdc3ef7c761e9dd0de5304316101f7aa157d82ba74c6fc8b959ecd9c91f31964448cc9", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282606, "uuid": "0d897ac7-f0bb-49bd-ad0b-2e00ec53cb03", "value": "T156A5DF3CF8A99AD6E13AF7738557E210F3F550F3B311C8166EE2898402B4A75A2DE50D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282606, "uuid": "2da8528a-517b-4a8c-ba44-6db9690ab03d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282606, "uuid": "8802e74d-7191-421f-a022-d2e64d223bb6", "value": "49152:1jzUCIk+1a7hKVy7fH6PlTooUy9KhJNN38g:5UCIk+E7h/fBFGKhF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282606, "uuid": "b18d93b0-d3fc-4b36-b612-a89a443f31c4", "value": 2205184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282606, "uuid": "e89053ae-bac5-4b3a-862d-7f3ca2f64b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282606, "uuid": "1c4ccf0c-bdff-4581-a7a1-df94830532dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fc8329-bdd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678297230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297230, "uuid": "448dad7c-23a3-42b7-9c22-9e710e97bce8", "comment": "Malware payload (AgentTesla)", "value": "ee36baace52aa157d3555a5e7ef230b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297230, "uuid": "fb2b7302-8160-4689-bb48-eb189c90ced8", "comment": "Malware payload (AgentTesla)", "value": "4cda725b64cd72f7742f8e029f31a24b54531ee7cf672b6b33f6c624f67df303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297230, "uuid": "c33a4a05-fd94-4a9c-bec5-ab35ad3e7bf9", "comment": "Malware payload (AgentTesla)", "value": "3a6c19199579c394a9c9434c70a28a7e059b1117", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297230, "uuid": "16357eab-6cd0-4e2b-8266-37a28a9778b6", "comment": "Malware payload (AgentTesla)", "value": "8a93f7a79e87811754e4f7df99d1f2afa0a28455c66d3d5021d1947793fef3333b4035350741963d2fb232b562d4c338", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297230, "uuid": "2be6d196-5c85-4371-aa30-2a632b40eb6b", "value": "T1DEA412982775CB05EEB95BB591D28E6487F01A16270AE10D0CF270DF185BBA1CE43DB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297230, "uuid": "a2fcb7cb-0916-47fb-ad99-0309a1bd3353", "value": "12288:w1Hi/8JJRwhfg8cEeNyVqisqz0ly9TetXY+b7UOoyWUJ7n:eJJXcg8feNlisqoMKom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678297230, "uuid": "ebf1697d-1305-4855-91f7-58566325b834", "value": 486280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678297230, "uuid": "26cb290f-1c4a-4955-9d26-328958b28404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297230, "uuid": "619d3a89-7f91-456a-80b2-e4a33eb203cb", "value": "PI_08.03.2023 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c01f59-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274827, "uuid": "a55aa9af-6e31-4abc-a998-79c1bfd5a67e", "comment": "Malware payload (Heodo)", "value": "ecba2af1298e61a631c37598a695e741", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274827, "uuid": "8b4b4922-8601-41c1-98a3-ddb676b1d9a9", "comment": "Malware payload (Heodo)", "value": "4d9a6dfca804989d40eeca9bb2d90ef33f3980eb07ca89bbba06d0ef4b37634b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274827, "uuid": "df22c0e6-81eb-4b0a-9582-650cc46865cf", "comment": "Malware payload (Heodo)", "value": "aec93d18178a8850587d3a302c01baf79da7fc20", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274827, "uuid": "d9c66cd5-0db1-4ff0-beb6-a4458fde7b81", "comment": "Malware payload (Heodo)", "value": "8afd5bbb0d96f04b476688e46f88c210ebf956208c705bb8eeb0256673feb50deb6a590c8437f7fb28d3b649be4b11a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274827, "uuid": "d919161a-b20e-4d27-9051-6e48fcb127f4", "value": "T1BFE412B1F4AF3219ED21F57811EADC430392B47F02C005D55EA8897EB2BE52A755A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274827, "uuid": "e67fa367-4d99-4bb4-a37a-a3f76d1fedee", "value": "3072:H1lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3CA:H12c/z4a5GLNIp1WMkd3tCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274827, "uuid": "c36e6485-a5b8-484d-9d0e-ead0faf12910", "value": 661401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274827, "uuid": "6248d2c9-7958-4f1d-84ab-d5c2ce0ad31e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274827, "uuid": "27e9caea-e998-4996-83fb-b5aac1583610", "value": "Electronic form 03.07.2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b19d3c5-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266831, "uuid": "ad5628a6-c00a-463d-bb55-659cc24ec59b", "comment": "Malware payload (Mirai)", "value": "5cbec2de1d7e1f5035091f6a907309d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266831, "uuid": "91cac946-99a0-4032-8bb7-c6b2be14957b", "comment": "Malware payload (Mirai)", "value": "4d9e1847f48ffcbc899e0e77760554ffd4314d9307d032282f5239a96785db6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266831, "uuid": "da42328b-da0c-4d85-9fb9-cbc2a6a9cb49", "comment": "Malware payload (Mirai)", "value": "235f58f576fceae364615c9df544b0e9d49ff8f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266831, "uuid": "abbf1a4f-bcb9-4cba-96b6-62a90b4f8da6", "comment": "Malware payload (Mirai)", "value": "dda1577deba03fcb5baea14af75517d4b4b86988d34da316055c5bcc21ef05ac7982f1640dc23197e9d2b41e3dfb27b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266831, "uuid": "373188bb-c57a-479d-bcdf-9fdfdf8097ac", "value": "T162830856FC814B21C5C9127AFA2E158E331317F8E3DEB2239E246F2077C696B0E36955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266831, "uuid": "d0ecdabc-e457-482e-b5b9-ce773e425b4f", "value": "1536:xGnA5PiBueIYbP94kQmjH3Pbmq8WZa3dYK8RaZd0SIDiTzK2vqNMTF5JYWGG:RPiXrbV4v6q3CRaxzK2vqWTFXHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266831, "uuid": "82aa9734-80ee-43c4-94f5-b83ae0466673", "value": 88396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266831, "uuid": "8aef93a8-b364-452b-ae7c-85558235f2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266831, "uuid": "21aaa64c-fff4-4ec3-8531-56cc65fefa57", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3857b18c-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274853, "uuid": "49f5edef-f64d-470b-88fd-de16e8b87fb2", "comment": "Malware payload (Heodo)", "value": "701c6abc5d4f1fafe912f494b4e72cfa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274853, "uuid": "08fe1047-5853-4fe2-adbd-e15313080de4", "comment": "Malware payload (Heodo)", "value": "4dd92c67830fbfe62fdfd431b426092ca041387c9e1598ea7e7fd18c7ef821cf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274853, "uuid": "208d5f90-1836-4265-abb8-14fd18c64fbb", "comment": "Malware payload (Heodo)", "value": "5409c18078f08a18e2e48b5e3c3d73cf83eeef25", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274853, "uuid": "1cdb067b-2205-430d-befa-12055a01a70d", "comment": "Malware payload (Heodo)", "value": "3a33d96b339d33d65d9ad0e22a9f80fd0c3ad53e303d0033fc6e963875122d1cb0632380d61510f5be89a1fc3e51ae56", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274853, "uuid": "2d2faa0b-9f66-4003-982c-e6c3f92a0b9f", "value": "T1DE1523F8FEB5E4A7F489E03148468B47C28CF9C6C6D9D9C612B8467D9143FEB0B09906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274853, "uuid": "a9d60d66-8683-49ea-88cc-937148094f89", "value": "6144:As929TDSYLJY3lhXf0cJzkHFliEo6BMTJgw+b2S4oMUCIkaAWr92GoKO33E+:AVHSYLJY3l5zzkH3L6gjt4R5+tr9vYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274853, "uuid": "153275df-9f60-419d-aeae-40895a5abad7", "value": 891292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274853, "uuid": "c00e8241-8870-49b6-a913-91c846dd6c05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274853, "uuid": "d9d9e08f-b3b0-4de7-b8cd-1790b9d0d47e", "value": "160244.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e45db5e-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308364, "uuid": "33540ce2-51c4-400e-ac6f-4706fb0009e9", "comment": "Malware payload (SnakeKeylogger)", "value": "5a967d0f0803508af897d85bb535b364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308364, "uuid": "b8aef8fe-333c-4821-b8a1-adcfed0062cd", "comment": "Malware payload (SnakeKeylogger)", "value": "4e1fa0d804e4182c15bd7acd1e87bda80d55bad2c2a1609f5ee799488d547930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308364, "uuid": "42be65de-3bf9-4b41-8e7e-c38e838a4fca", "comment": "Malware payload (SnakeKeylogger)", "value": "e38acc7ac38aaead5fd7ae7dbfd6aba538312075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308364, "uuid": "cd1e5d93-9171-40fa-b608-aee5d8838a17", "comment": "Malware payload (SnakeKeylogger)", "value": "18a6f1a73ccfe17ecb7892a56f967282800346300440993e3564707250800c77d405304b8064b1261411a3e4d7572385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308364, "uuid": "99c9e930-8ff8-4aff-bfd4-0b5601c15928", "value": "T109755C302AEA501AF173AF795AE875A6D96FFEB33707641E105133460A33A82DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308364, "uuid": "f0e1a146-8f62-427d-af4c-8b938f760538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308364, "uuid": "7f7ac072-23cd-4e89-942a-14252cb33a92", "value": "12288:8P0wjgL3tjrBhRcG5u/8/gBM8riiWbjZcillbUsbUZI+gD8g2E33sNHRPS5Ljgfu:ZZxbcZcLsbxbcZcLspQrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308364, "uuid": "6a0e9d19-ef61-46c0-be75-03b39f1828ec", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308364, "uuid": "7e2688a7-4434-42ba-9a88-7a4083bf69f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308364, "uuid": "3ccb4e24-120d-4ff3-be44-6aa6f8603804", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec52821-bdf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1678308123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308123, "uuid": "5df55175-93cd-4949-ba27-8c77ba9f1b34", "comment": "Malware payload (ManusCrypt)", "value": "79f18dec2128a71f3b58c5f58d31021c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308123, "uuid": "013c1aad-199c-46c7-9118-7f91c5b8ac6a", "comment": "Malware payload (ManusCrypt)", "value": "4eeeb2fb37c066baa19b53a02d93d82c40fbedbda7610720b8733c6c1aab555b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308123, "uuid": "6778ab84-8e22-43d7-a4dc-1d810dac31f8", "comment": "Malware payload (ManusCrypt)", "value": "71cc1347a514884f0ac969bb2de5005f6a8951e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308123, "uuid": "1dc7da85-2700-4103-8002-322df7269fbc", "comment": "Malware payload (ManusCrypt)", "value": "9243cef30caa66be183773bb38f5acb6b7f616543739221a72dc9c0bde8bd295011462f8fbcbdf099288cc0965b08eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308123, "uuid": "334934c0-9722-46f7-88ac-b4f472e98ab5", "value": "T1C675E0210E7477FBE76885B1933FAAEE28D65E7B0B14853B12943610E5D00E17FD9A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308123, "uuid": "05a60efc-eae9-449f-bb4a-863a57207363", "value": "caf9bf1d191236de3d7b150ac6f71de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308123, "uuid": "a9dc5cfb-f911-492a-a96e-5afd2d128f1b", "value": "24576:scylFSGGoS5TIsAMBTe9YADefuGug3jpeYLmCFk4lIWceTOtBMUhw6gTjI:ynXcI/IiDr1gTM6Fk4+WcVnJmjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308123, "uuid": "901e7ea7-ead5-4c2a-a523-8b63bf1730ba", "value": 1654688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308123, "uuid": "f926149a-a636-4ac3-96e7-9c077f4573a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308123, "uuid": "f3e77398-d136-44be-b746-e77530f11a65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d46a0a-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248297, "uuid": "d0ea718a-fb9d-455e-987e-7901a5c776e6", "comment": "Malware payload (Mirai)", "value": "b4194933e3399caecd981199791edbb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248297, "uuid": "15709ec1-44d0-4c01-825c-624dbb758111", "comment": "Malware payload (Mirai)", "value": "4f57d625f1af876b0eac0ece8de4140ff94862fd5f4ef65a8fbd9c36945f4651", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248297, "uuid": "f2ca5cd0-4f94-4fdf-b5c4-9f3cc3585db5", "comment": "Malware payload (Mirai)", "value": "2ea1252e1bb3911049ec65baba1ec5e5079bbda9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248297, "uuid": "0cbe57d7-1c17-4fb5-9537-3521f6c72f2d", "comment": "Malware payload (Mirai)", "value": "eae3ed8f401a159fcacb88eb2a70e51ecd477a1881a1960b9d53c858123c1741b2eae1daddba78fa7927de40ab8dd4e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248297, "uuid": "80ed8909-24e1-4dd3-964c-8aa211d6dec0", "value": "T1DA83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248297, "uuid": "3e97245c-cfdf-45d4-8599-274e07712d89", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deGYDgH6RHEYs4EH6kTfy7pDYL/Z73xPH78y89:Rakdn2Eo3ef1p2TfyhYLNNge437WEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248297, "uuid": "29dad60e-3888-42d9-9031-c12819b50e44", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248297, "uuid": "de074c42-29c3-478c-aa00-ca359c50ba5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248297, "uuid": "d7e9d08a-c496-4239-9bc3-06b8c0f16206", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e68de2-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678279538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279538, "uuid": "c225117f-a308-4f3b-84d9-2561a8ea8465", "comment": "Malware payload (DCRat)", "value": "53d91281eaa6ee9b4e973872736f415e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279538, "uuid": "e9dc93b9-f900-44db-a38d-d35ffba304ef", "comment": "Malware payload (DCRat)", "value": "4fb9458ba400d1c797a8d1bf01032edfc3e77f7b4ab015856316afd790e16d77", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279538, "uuid": "4e4bb30b-e8d4-41bf-a4c5-6a4d4142b912", "comment": "Malware payload (DCRat)", "value": "feedf4f3c9e26c35491b12e5c638bc1e52c395a3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279538, "uuid": "ec51c024-8958-47fe-a6c5-0b7a65c7da7f", "comment": "Malware payload (DCRat)", "value": "cfea0ce35ebb5a3b6b6c2b7d8cb7b6a75c33383dfac0158fc3c742ae718aef12767eeaf89086d831139f2ef46c0f2795", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279538, "uuid": "eecae1f8-3785-4d14-be13-6b17961d4e4b", "value": "T1F3D633FFE8315555CA3C0FB022367FE04D10E939AAC8A65F111E679241649ECAA8CDF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279538, "uuid": "051e4d00-f57a-48a3-9436-f68988f840ef", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279538, "uuid": "004cbd4e-66db-4ab2-9549-a513827f41fa", "value": "393216:IKjvT9DTlP9+aXtkohedG4g+Q1HtvM4N8:9DT9DRP9P9QPgZNvH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279538, "uuid": "18e35a71-10dc-4490-b7e7-44178cd7731f", "value": 12731392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279538, "uuid": "338f43bc-ed98-4ef1-9d29-90f3d648e419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279538, "uuid": "88f69007-42b7-41a9-8bd2-95c3b3439788", "value": "53d91281eaa6ee9b4e973872736f415e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33a0d2a-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678267758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267758, "uuid": "f63aef0b-2d18-4fe3-86b7-a9c09cd5f1b6", "comment": "Malware payload (AgentTesla)", "value": "b7e3af5ff8208af0f16dae79ac80f85c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267758, "uuid": "94f81a22-aba9-4fba-bb78-e5b7902c6c45", "comment": "Malware payload (AgentTesla)", "value": "501378d1680addc19d0790b502aa7414dc04783c28f682a7d46e9428db36af89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267758, "uuid": "f7144007-8e8a-4ff4-b68c-c9bd28e9d459", "comment": "Malware payload (AgentTesla)", "value": "f04bcac14d2a2ba486a1ed401c281057fd7ae3a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267758, "uuid": "f60ca9bb-5fcc-4db8-9cf5-870ba8dee44c", "comment": "Malware payload (AgentTesla)", "value": "bca1a7a95a181f6d8a60d4ea85b2ded412db38ccb7915e855c5a193133ab0f054a99f751d7273079d572a790b2708f61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267758, "uuid": "b82a7d25-a7ab-4952-b367-66057ac9cc00", "value": "T1D344127126F0C177E8624336147B9717BEE9D226A9A84F0B23A1565CBE30742AE0F374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267758, "uuid": "951a9541-75cd-4bb5-a3cb-97e65011c6b1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267758, "uuid": "24600308-1de4-489e-9dba-8dac7b79785b", "value": "6144:/Ya6KfjxvoPugapFcCd7dvviVFnpElX/ofljcG8QXA:/YEftAPZfC9dvv8FpKaSAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267758, "uuid": "a24cfbb4-7e26-4cf8-aac8-358a9a5486be", "value": 273610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267758, "uuid": "b3aede9f-d60c-45ef-bc4e-f1e243fe0b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267758, "uuid": "88215366-b564-4ee2-80f9-e91bc05aeb74", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d711c3-bda1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678273565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273565, "uuid": "d02726c1-4e72-4b1e-853d-870410ede9b8", "comment": "Malware payload (AgentTesla)", "value": "02fac43e9bc5cff154f6671befd1e430", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273565, "uuid": "6a6c8343-3af4-4dd6-be23-d797bcee71d1", "comment": "Malware payload (AgentTesla)", "value": "50e54a9fde90cc5b555710e820516e6a54715ba6633efea4310ba017c113d464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273565, "uuid": "5fecdc07-928c-4542-827c-777f09735335", "comment": "Malware payload (AgentTesla)", "value": "424b9c90a3ce6adfb88eb3245fb4c4b6236a2139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273565, "uuid": "ea8f04ea-8f21-44ac-bfb2-bcf76b447a4c", "comment": "Malware payload (AgentTesla)", "value": "5306a6d805c792c714510d880ec0f8d11b95eab878afc0647a268d1a560648e6f9b808c70bdf597f4bfa66fe7364ecb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273565, "uuid": "417af093-da46-4f77-a91a-5184041278b6", "value": "T122F309689ECD8F56C32D41B4D4A051381EB2A247C61BE65D1EA0DCFA3E767C3322F865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273565, "uuid": "671122ae-2097-4910-8da2-485ded4be94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273565, "uuid": "dfb787e2-1103-43b2-aa81-984e6d01257c", "value": "3072:UUSMcFRLylTZpi711m1W1mnRdT5J6TreNFqkBW6otIFUcFO1fRT:Vc/OlNpSngYAPdFAUUd1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273565, "uuid": "58184b20-8371-456f-8e01-e73feae15c49", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273565, "uuid": "cd256d16-e37e-4f00-9d26-d8147bd6b10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273565, "uuid": "43e17f72-7052-41bd-bcdb-ffe02e726f6b", "value": "50e54a9fde90cc5b555710e820516e6a54715ba6633efea4310ba017c113d464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db100ab1-bdac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678278562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278562, "uuid": "9bbbf88a-532a-41a0-af47-ef844a90dd0d", "comment": "Malware payload (Formbook)", "value": "ba645c8235d19c8407c81d62470eedf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278562, "uuid": "b84a233b-711a-47ad-9d21-1c3d8563f749", "comment": "Malware payload (Formbook)", "value": "50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278562, "uuid": "be0da367-8468-4b4f-8642-f7a0b7e6c673", "comment": "Malware payload (Formbook)", "value": "9b78b515d6869753e2bb3e46d1307deccef79e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278562, "uuid": "5a633d7d-2eab-4364-b102-c2848fd3edf0", "comment": "Malware payload (Formbook)", "value": "d57476fbf3b78de592a139cc2fa980e4935f948eecda21a663797cd7e12eaf798ad9e7a7159d8279a022d956c86f4ff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278562, "uuid": "d5116c30-2272-4088-b504-8f9d07db046a", "value": "T1BF74017386C0640EE96277FE1C7951B25BA71E155B2E864B07B07B0E3A38243FE4875E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278562, "uuid": "b84f8f1a-ed1f-4145-a180-02fed9d7daff", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278562, "uuid": "1c8118d4-20d5-4a40-99fa-6b10747b84a3", "value": "6144:jYa6a3R6bVzifniXpVKRNQfgwq+DMhfii10dqeH+QE:jY03RYV+Op8Ugwq+HiSg0PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278562, "uuid": "0e7fb225-65d8-466b-b7f2-d0ae674068a4", "value": 358071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278562, "uuid": "5428bae2-74d9-4a85-a154-5d5950f8ac21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278562, "uuid": "6a190e98-b5b8-4e10-a277-d87f6ba8c543", "value": "50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a0ed82-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1678307572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307572, "uuid": "23e61a72-48ad-4f3a-8875-b46a197111e3", "comment": "Malware payload (Sodinokibi)", "value": "6c68d36f1992d3fdf656df111c93790a", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307572, "uuid": "1c766483-9097-4d29-95b8-eaf0a7068583", "comment": "Malware payload (Sodinokibi)", "value": "5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307572, "uuid": "2c414eed-6cef-4a88-bcfd-a5cfcb5f6fb7", "comment": "Malware payload (Sodinokibi)", "value": "c2a0733beaf1e38cf38a0a832f917587be271e1b", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307572, "uuid": "86f67be2-498e-4a27-ba70-46067a2a1944", "comment": "Malware payload (Sodinokibi)", "value": "9f57cd61aebf24c5a06943ce74e7d270880cbb1e5d05a958dcdbe266d97e714fea0cb709716791542c2e021b7dba0953", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307572, "uuid": "5babfbc5-22b4-4464-8ab1-5e9cec10a22d", "value": "T1C8845C6FB7450372C28203F2260F99D7FB2E9579236A89E0546C801D2367E6C93BB7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307572, "uuid": "794f973b-bad2-4dd7-8f98-08b64f32df0f", "value": "c88f20b29592f2107a629e815db6afae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307572, "uuid": "68c5d87e-8582-4e89-abef-2e8f9417d816", "value": "12288:9Y0NvuU8qt3H12h1VSju2U1jEpnL6dmouQ7pKnPzOHh2hF0:9fNvGqt3VA1VSju2U1jEVL6dmouQ7pKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307572, "uuid": "335eae60-572c-440b-b887-6c23c2e2813e", "value": 400700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307572, "uuid": "e66a284e-666c-4b08-aea8-0712da3c0b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307572, "uuid": "0c0d53b4-c0e5-43d7-9391-9221f61036e0", "value": "5168a54f2a95db57fee8d606918b80792d84e0990936a86b4f0030ec47624e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2432397a-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678261075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261075, "uuid": "b634e77c-ea3e-4907-8c8f-592c667b2d46", "comment": "Malware payload", "value": "64c0d419aeb5bcafe0894040d05c8ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261075, "uuid": "7b669c68-fa9a-4522-9a3c-5053d9610e7a", "comment": "Malware payload", "value": "52f61a9b187c26bb58f92acd6efb272a760a5adf12eda1c829d693210f951c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261075, "uuid": "571ad96c-65b9-4ff7-825d-ca1d48529fab", "comment": "Malware payload", "value": "a5af832cebcd4d967e74ab99ebb99a83f0e5158d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261075, "uuid": "a5f2981d-b6b4-4605-a8b3-5d0a15d8256a", "comment": "Malware payload", "value": "b234b9451747009ca3175e76e2f133e86044b1b6a6d7ea9c2578f94ae3c4cf3cbe4387f836fa8d5bbbb87d4219c5da19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261075, "uuid": "92ff6766-3636-495c-9b56-3c818d9202bf", "value": "T19AE1C4075B3448A2D29ECAF91FB66E9CAE349092071486F606B3DDC981F838574263DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261075, "uuid": "547565e8-816f-4520-9250-6d6de28d892f", "value": "f1e2cc735472b98ab8038d5251e2d0ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261075, "uuid": "9628df93-8ffe-4227-a44e-f4c791feed0b", "value": "96:EF+8cImJTPymL/Zz0o/ZHPtboyn34R16cP/F+Y:EFbbgem/Zz5/ZHP1oyng3P/F+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261075, "uuid": "13c62e80-07d1-4734-a1c5-b1eb908393d7", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261075, "uuid": "a7de3080-e5e3-46ab-a1d7-373ff9aaf875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261075, "uuid": "b5865f18-b0f1-4c1c-893b-7bac910be2dd", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23361.1918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3df0df0-bd97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678269584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269584, "uuid": "bf88b6cd-cd04-4d99-bfd0-580a77af215f", "comment": "Malware payload (Heodo)", "value": "e6fadab940e0f1a7af51e7b74c63b07f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269584, "uuid": "3a593bf0-ae2a-4b58-ae5a-6fbb42f4dd5f", "comment": "Malware payload (Heodo)", "value": "53477cf7d42a766819d25df062b62aa39d89beba993262b2bd9251d55fdc59dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269584, "uuid": "e727ee74-63a6-4d58-8253-18a65d817d41", "comment": "Malware payload (Heodo)", "value": "24e8449eea623cabc0ea44759a7c895cbbc585b8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269584, "uuid": "57e83d23-0da0-4bb4-a77f-391cd90f7d45", "comment": "Malware payload (Heodo)", "value": "d4f5ad9404439f70253f249c755ea731712b43c4baf87de1009dcc5f43d8eada6e29c50ee71ae5206e53ef813ec9b510", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269584, "uuid": "ed57f1a5-c206-48df-821f-52ebe79a76aa", "value": "T132E40211E66D3C39F0A56A708198A0F6D74852EFA01670B6D07AB003B6BBD673F1B5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269584, "uuid": "ffc90486-9aeb-4dc3-bc9d-bd3b708c94ed", "value": "6144:QJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqE:0bPHom8TYyCT8x5I5wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269584, "uuid": "ffe3ee3e-a5f7-4b92-bff6-9d4bdfcc8509", "value": 686923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269584, "uuid": "f6d229db-1e1e-45cb-83e1-37e298dc0920", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269584, "uuid": "5f32398f-3b30-4d75-919d-94311943fd49", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0d5628-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678286184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286184, "uuid": "94ee7ace-765b-49f3-aba6-52e77fd7a385", "comment": "Malware payload (AgentTesla)", "value": "238b77dbb200f371aaf31de86f0238a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286184, "uuid": "b6fa573a-383b-49c1-b130-fb5d21796ef4", "comment": "Malware payload (AgentTesla)", "value": "535645e17dc7fe356527c3c858b1f6aac55b0b977bf341d0c64c528fbed6b4df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286184, "uuid": "53364609-1f81-4b4d-8394-52fb3f812a02", "comment": "Malware payload (AgentTesla)", "value": "3b93345df732ed1a8f3136a48a696978cde075d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286184, "uuid": "74a52e9f-b3be-4a32-8053-0157c254e297", "comment": "Malware payload (AgentTesla)", "value": "98280a89e79420c8eeb18f688e401671d6824f0aaf97f1815f666d76479ae7556e854622cc9a12d66b609fdff06eb1e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286184, "uuid": "ff484ff6-84be-4150-a8f1-4f0e2756c6e7", "value": "T199B4133073985B9AF9FB93B5C817D0121BB7AC562732DB5A4CC342CB1DA378049C2A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286184, "uuid": "28965afe-5cec-4fc1-817f-a43e183ce5bf", "value": "12288:cvgii6iEoux2kgXFjVnfm+V2sGMa+821zQYsO:mi6ir4gXfnfBG/G+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286184, "uuid": "1cc66f49-a0e8-4f54-b6d3-7ba92cd6c21d", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286184, "uuid": "3b32ed6a-57b8-4d96-b52c-37d851069630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286184, "uuid": "3749a9a4-ffb2-43bf-82c1-4322677c5aac", "value": "New Quote Q1771084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3d0d86-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309619, "uuid": "51fc055b-ac65-49d9-882f-6d83d1aa38d1", "comment": "Malware payload (AgentTesla)", "value": "6e83affc835491f0e575fd6381bc650d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309619, "uuid": "4a42d3e3-80ef-45ba-b34e-1257a69dba32", "comment": "Malware payload (AgentTesla)", "value": "546296386f790b239e38e70b371954f4ca87d4715bc3147497f82c466d721ce2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309619, "uuid": "f6de84c4-8e9c-47eb-a4ce-5847ee8f394d", "comment": "Malware payload (AgentTesla)", "value": "911f330b40f52b6309fbfa1c00dba94bb2e411dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309619, "uuid": "6b7d61fa-8d16-4968-9a9d-82b09c7ce8c0", "comment": "Malware payload (AgentTesla)", "value": "f2e92480455dec0d7a15505acbe8d9265c706d82bba0e40ecadfbb8eb08c296e66516bcec8ade451222cb87d409409e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309619, "uuid": "05ec94b1-7af6-433e-b6f7-4844f462a7d4", "value": "T18005129B77BD5B17E9AD86F5382C50C00BB12595A033D7EE0EC170EA1AF2F615604AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309619, "uuid": "4d4bdfff-6654-4b90-972e-e02ccf567498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309619, "uuid": "1995ff97-30d4-4a19-9bf5-513fcb1ebd3e", "value": "12288:njLZLPlFwWH3KHVDVflGZ0L+QCRKFFAitXASIokD2Cv:jddFwWH61D9lKWASkD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309619, "uuid": "e908e833-f4d4-4228-8469-094c23b55878", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309619, "uuid": "16b0c6a0-64d0-4ad8-aa13-f4a1937de26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309619, "uuid": "19829cc5-c668-489d-841c-6906791a1d05", "value": "DHL EXPRESS document 183764647646578484_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fe3ae0-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309607, "uuid": "6a6a5ba5-c45b-4aa3-b102-8bb86ce5027b", "comment": "Malware payload (AgentTesla)", "value": "f827ea54e3210f62cf8a7ff0e34d196c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309607, "uuid": "418197ba-fb75-4eb2-a3f8-7bf91c8dd2e9", "comment": "Malware payload (AgentTesla)", "value": "54d629d1bbdc3dc634692b74936cabedbce47b088e07878229458b7d5acf79cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309607, "uuid": "0377dddf-6ca7-4dd9-88b1-fb60a6ad2086", "comment": "Malware payload (AgentTesla)", "value": "2e298211e6c812ea33e744ff2a09f856b92f4d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309607, "uuid": "14c476ab-7cea-4115-b254-6f941a6e064c", "comment": "Malware payload (AgentTesla)", "value": "21dbd9167c891fbacdf0016c9b7ebafcc3f94d8627e1921eb5f2bdaa3e743707fd3d6c41c2551868b1c1722971eea56b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309607, "uuid": "cd951085-8686-4d93-a8c9-43c8177690c4", "value": "T1B525CF99B2715177EC8F81B90917C5CF2C40FA8B7611E237573B7A82E2591BF7688223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309607, "uuid": "ea985a9c-c380-4c15-909b-28b46edbf240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309607, "uuid": "ffeda08a-99b4-48f8-bd3e-1f1055bf0339", "value": "24576:rEP78/1nYUJ05TY5/n/EGxq1NBO5FNw6EfaZ:/xY1MZ/Ezdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309607, "uuid": "0f122fc3-3331-4f74-86c0-1d160847b190", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309607, "uuid": "a4c4085f-3c12-4903-a1f8-45cfb917703a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309607, "uuid": "af700234-f65a-4a0a-9e61-b7e4dae46786", "value": "DHL On Demand Delivery.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237237cc-bdb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678283408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283408, "uuid": "0f94051d-32b4-4d7b-b2b8-3bd00847317c", "comment": "Malware payload (Mirai)", "value": "6588da6085d08c75c41e2be30331e87b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283408, "uuid": "0bf24c49-02f7-4ec2-962c-9fb94ded5c01", "comment": "Malware payload (Mirai)", "value": "55441605aab1ebf61c7bea0523db176d8c2c3f5dc8430d986cadf518f64cb59d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283408, "uuid": "b7600bc8-998f-4df5-a9bc-61b587ea0b4b", "comment": "Malware payload (Mirai)", "value": "fd66a155ca8ab807ec250fcb298c99b595985f02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283408, "uuid": "6d1a221c-c72a-4896-80b1-27d0d5599e27", "comment": "Malware payload (Mirai)", "value": "11d27430e3fca8eb2e1b6f3dbb1f19cc142940217e67ff2aa270d8aa72abe60a9288292413fb00eb8bc2b3338d233afe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283408, "uuid": "70c86641-4193-4408-b26f-fca4efaf8885", "value": "T1D6A2E03176260A96F37D6C78C993C2A2FB374BACA0F8327626402871D7457177D3879A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283408, "uuid": "e6fdbff8-a080-4e09-863d-66550c147644", "value": "384:xvtIoZxrSniaXs+qx+bwqPXvGSeRFw1FFGUMMJ+TohymdGUop5hf:xvQn4j+gB6TYRos3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678283408, "uuid": "5bbcc809-eeba-4bf1-9108-05e97fc69003", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678283408, "uuid": "f10916c4-9af6-4a3b-8db9-c254c13784ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283408, "uuid": "6c51aef3-b0ca-43f5-aa60-8621364d948b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0917989c-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274774, "uuid": "e5b6e8cc-45cd-4c9e-a2a8-e94e421471cb", "comment": "Malware payload (Heodo)", "value": "f310cac72ca36af8c6d037e9a17fcb55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274774, "uuid": "e75bde38-b190-46b1-b5f0-22f9216b3bdf", "comment": "Malware payload (Heodo)", "value": "5551d2216d5e092fe2209fd62de1e4cb540184d0126e5b5521e1b297bc421676", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274774, "uuid": "16f6d738-b5f7-43da-8cbb-ecfe30633c44", "comment": "Malware payload (Heodo)", "value": "897dc9b5b042e419ebb76d5725fbe5f1624fcd89", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274774, "uuid": "1397593e-a12b-4673-8dd1-b383e124b39b", "comment": "Malware payload (Heodo)", "value": "a666c3a498b4c8e1016c280c109e62eb09167c5aa6efd5158dfbed92e1c91b67c889f51e4192158475802383e0061a89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274774, "uuid": "920bd5db-3f7a-4cc2-83ef-5456c91f295c", "value": "T1FB05233C5F67790FF5997C362AF3847AFDF9085CDC96E90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274774, "uuid": "18cd3b9a-c330-4786-8e7d-1f35cd565d4b", "value": "12288:04DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sF:DevtlkdJe4m19FgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274774, "uuid": "a435872d-d690-4d5d-8e1d-d06e06393366", "value": 866510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274774, "uuid": "f9d9fb48-75ac-4c16-af60-9dac6361ed47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274774, "uuid": "0a8234ec-96ef-4f4f-89c2-57b05a55edec", "value": "5wwlVX1KiG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6bc106-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678277784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277784, "uuid": "38a98b94-5d2f-4cee-a1ca-79d70e166d50", "comment": "Malware payload", "value": "035a2327e8309d6e80ba38d7ca6f7fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277784, "uuid": "2f9d0d72-13f8-4907-a50a-6101521a525c", "comment": "Malware payload", "value": "5589515afff4c9c008fda2a2cc418297dc56a54832952ac1a58f3c98128d264b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277784, "uuid": "9fd72d5b-4efc-4ad5-b39f-4ca0a73f13c4", "comment": "Malware payload", "value": "4b928a378df54429c74e180093de566f3148bc8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277784, "uuid": "4b1ae426-5618-4a1c-82b1-beecda357dff", "comment": "Malware payload", "value": "abfe383a052d17134b78c6888292ef0d152bdc6836dc5eedcadc4f505937f4613e76f7a0a11cf70fc6efb63f841f2abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277784, "uuid": "9146b2b8-c45c-4ecb-8d03-16105c792456", "value": "T141650213E5606C99F02412736ABA436C7DF8A3526DB1463BFFC84DB12DB1AA15F8391C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277784, "uuid": "a4cfeb89-b543-476c-b8c2-197aac475362", "value": "9165ea3e914e03bda3346f13edbd6ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277784, "uuid": "583f2381-e869-4a3a-bf87-087375c26993", "value": "24576:sheCQHcv7keyXJtgzBvTJX5b7NvCPQ2QdRzLSlvcv9EmqPNeK/Rly:sheyogz1TN5NviQ2Q/PSVpPNTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277784, "uuid": "31adb63d-4485-45ec-975e-9550989435a0", "value": 1445505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277784, "uuid": "31e6561f-0aca-4421-a9bc-de0fabf6d363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277784, "uuid": "4dcbd87c-8d71-47d6-b250-2f5bc4594137", "value": "5589515afff4c9c008fda2a2cc418297dc56a54832952ac1a58f3c98128d264b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2dfcae-bdca-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678291212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291212, "uuid": "27f10765-f593-42c1-bdeb-7b4af4b0f38e", "comment": "Malware payload (RedLineStealer)", "value": "dd82a1b8acd1b32d538acb1fe3b3acf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291212, "uuid": "9a9e742c-b9ad-4db8-805c-21f34662207a", "comment": "Malware payload (RedLineStealer)", "value": "564a9dd018dc5d85c1e8406409196f91184ae2ef342115733c7a666eabf44567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291212, "uuid": "0f8fd151-76e7-4465-a990-fc4065b65598", "comment": "Malware payload (RedLineStealer)", "value": "a8085a0b26493f638005f3fa6ab74554dac5a2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291212, "uuid": "a3aa6295-7b8e-4be0-b321-721d179eabcf", "comment": "Malware payload (RedLineStealer)", "value": "f347d5916cec4b4498cf1b2d1eed46e8a41d3a5ff7df8f17342db6c16b2890ff040ce9afcdc774d2087a99846df018af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291212, "uuid": "5cd27ff1-d5c7-43da-af5b-62fee9d67322", "value": "T1EBE4021192E06C29F17A8B714A39F2A9772FFC619D3FE6D933242B1B19712E0D562703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291212, "uuid": "1f5283e2-ee96-4e6b-8475-e84d6e8d978d", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291212, "uuid": "8846cc23-1dc0-4e7f-bbce-7a81360edc8d", "value": "12288:znFw2UOKKPaibN7dcuCyHHLuim/ocZZoE2AmbFTHA2f5K/YUrE1w8sXClWO0Z:zn4KJ7Fn1UZiEjmhTHA2f5KQ6E12FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678291212, "uuid": "3a49fe2c-e67e-49d9-a35c-42d86474de63", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678291212, "uuid": "1e5f3e7d-0c60-4ce8-b502-3898fa1f4052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291212, "uuid": "9abf2963-9cae-4ea1-a479-77067faea069", "value": "dd82a1b8acd1b32d538acb1fe3b3acf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7c7bfb-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308337, "uuid": "ba11bf49-213a-4a3a-9155-bc8e2e575678", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8955ce1a1fe4e8c68b7f6ce97c712d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308337, "uuid": "55ecfbbc-f632-4ea8-ae18-508f3240dd58", "comment": "Malware payload (SnakeKeylogger)", "value": "568b0931eebe6b767a01812f4d1912953db0a0a5f6c0e5923f3651753b7f93b3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308337, "uuid": "52b1fba2-39ca-48dc-95be-7c6c23729cd8", "comment": "Malware payload (SnakeKeylogger)", "value": "202eee781581a074d2bcfa3a730e66571224000e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308337, "uuid": "339a4620-608f-4e31-988e-b25c29c359d4", "comment": "Malware payload (SnakeKeylogger)", "value": "1f43539abeb0797a1039b1f4e7acd54ce9efb41af976df0012f845d9bb826498efc26e920499b35e7caecbbadb7adb34", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308337, "uuid": "ee3c5610-2163-4b9b-9245-ae48020d67b6", "value": "T1DB956CF18EA2FD9597AB0D84D1CC29C08C4C1B9B829A8948FCCC1512E7E5668FFDD5B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308337, "uuid": "9ce706ee-5e77-4a9c-9306-e472561d22a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308337, "uuid": "ac3aa690-7642-408d-bf0c-06bf1f3e9379", "value": "24576:X1bh4y2EPx20kiSNxSEM1KmDBbUnMVQrSSgivcBwA6/FM7:X1NMy2PkgM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308337, "uuid": "79924fc7-a877-4e83-8f6b-fbfb4c6001b4", "value": 1938432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308337, "uuid": "fc62442b-58eb-442d-b969-564e5a678227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308337, "uuid": "76294054-3cbe-4b10-86e5-3af3f62a9267", "value": "DHL Airwaybill # 6913321716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d71e8d7-bdf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1678308067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308067, "uuid": "9a3d98f3-0fa3-4ed2-b83b-98e4655fd3e0", "comment": "Malware payload (Mekotio)", "value": "c2575507672badc5766a6050b7427856", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308067, "uuid": "4064770c-57f5-4409-a4bb-6f2a49ad49bd", "comment": "Malware payload (Mekotio)", "value": "56df045119b09a552c345815834943b1c2e6e6fadb8cc2d134ec3881400470b4", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308067, "uuid": "e0c3f7da-e333-4ff9-8c04-f6aa515e078f", "comment": "Malware payload (Mekotio)", "value": "728e7a92f0e5cd156d347b74f50a3d6b61aac340", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308067, "uuid": "07ee020d-e73e-475f-b362-9a11aea5131c", "comment": "Malware payload (Mekotio)", "value": "45dce978d12408c621ccee66773340a5348cee858eb37a21e187e5d0719493d2c4cf488d37cdd6bade9a26f4a13b0cdc", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308067, "uuid": "51d4e74f-f450-4da5-96ff-6f200958c8d6", "value": "T1238633BCC426EC71A9BA83F2D7448EAC5853F647060BF4763F89A660C6C56D1F5018AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308067, "uuid": "ac485587-085d-4e6a-bf2f-6868fd54d89c", "value": "196608:ir4zICrrY1g4KeAoLGdnw9/WgqFg1y8mG7P/:g2rOYemnK/Vq6y8BP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308067, "uuid": "81c9aff6-c6f4-41ea-9230-29b0261ef40d", "value": 8044102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308067, "uuid": "48bb89d6-9cbf-4539-8d02-b1cc95e51c27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308067, "uuid": "0a05db60-e881-450a-9994-d191d329055a", "value": "ID-FACTU.6408ee86b6285.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72dc854-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678309104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309104, "uuid": "36f6eacb-51bc-47d5-94e7-0df32efddde9", "comment": "Malware payload (Loki)", "value": "772675603b805ff8efa258ece576e2a8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309104, "uuid": "0b8ff7da-5c97-4985-88df-5f88a79c9d40", "comment": "Malware payload (Loki)", "value": "56e6f85f95d3c49773e876caadca7ce953690688dfbbbb6b2f6472f9dba73474", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309104, "uuid": "6742a941-024c-4ed9-b91e-711190566862", "comment": "Malware payload (Loki)", "value": "f52943490f8cd041102494d5af5420a6853d1e4c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309104, "uuid": "61033cef-ba3f-4323-9565-993ea84c1f41", "comment": "Malware payload (Loki)", "value": "f71f65d5ac91627b42ece9b5fdea8573ef88b2be7ef2e88d42a7b86a63df9907200f1ca96b27c3e9a76d94ca88d35a54", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309104, "uuid": "3f916928-9818-4d4b-a4b1-f976578a4763", "value": "T19A55F1039138AD4BE102C7BCBA2F3859015E7C3671D1A5C63A8DB74B5732FAA59BF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309104, "uuid": "80918a86-08ef-4c67-83eb-f301e04b4344", "value": "24576:nLKtBjFtHlxKWQmmav30xSBRUtHlx6WQmmav30xR6FobQt9oAwjf3:nLKtlX7vQmmQ30Ibq7fQmmQ30P6QQ63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309104, "uuid": "19eb2bb4-d35d-4964-9a6b-d793f070a03b", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309104, "uuid": "daa37d66-305b-49c0-bd18-efbe45f6feba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309104, "uuid": "726924ad-8d3e-4f51-928f-3cd675c0f9c1", "value": "Shipment Advise.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e62ed5-bdba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678284251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284251, "uuid": "a40b18d2-038d-4e65-af53-0a8a03f7a363", "comment": "Malware payload (AgentTesla)", "value": "739dfc21c2b5b1e5ac028c5da21474e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284251, "uuid": "1663bd25-0086-4de8-895f-4fbe252b9e25", "comment": "Malware payload (AgentTesla)", "value": "576b759e4527b328fd46efb5ace14e95a88babb627534fdbc3e24a9399f14c28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284251, "uuid": "7c8e01f3-4a6b-4464-b5c8-e7bda292018e", "comment": "Malware payload (AgentTesla)", "value": "34481a5d38282670195ca06612125e8fdbfe23bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284251, "uuid": "83446290-6ddd-41ed-b06c-6372b2950a8d", "comment": "Malware payload (AgentTesla)", "value": "98d22cc19df958a3908f038a7f7caae7051e39cb03fe8efbbd91e3a03d86e14162c77835bdbf3062a5b7466d264a59a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284251, "uuid": "6e2a7224-86c1-4881-8965-e6cc5c0b7989", "value": "T145059EE42F5D7263FB86E1B3280526A7DBACB95D651BC0081EE2108FC1CDD7C5152EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284251, "uuid": "2216ee92-68cd-4797-8b46-61402905f9f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284251, "uuid": "f65bb434-1342-42fb-814a-c82cae61e95c", "value": "12288:QwozXlLPcNBQGf5h2ZqA7cDx1I2PhQEzxsvIGYRJjM626CSuQ3:JobhPCtHnA7cDtpsvPM662V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284251, "uuid": "d866a53d-0a88-4aa2-9322-bd757c74459a", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284251, "uuid": "bfba5b6e-739c-4fb6-adaa-e6c611b89e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284251, "uuid": "f691837b-1304-4424-81d4-0282e658dac6", "value": "RFQ-030323007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e68547-bd86-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1678262019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262019, "uuid": "cc830bea-8942-4902-b73a-17bce4f14812", "comment": "Malware payload (VectorStealer)", "value": "7900efd5f98edd9dbf42b2c9a17594c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262019, "uuid": "22b400f5-1cd7-42fd-8165-cef2c176e736", "comment": "Malware payload (VectorStealer)", "value": "57cff3a25d0e209ae16b6c411c95be97880fdf3075d2b33b32a20dda8d611d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262019, "uuid": "f8cd332f-5a95-4022-b4d7-633bfb9535f8", "comment": "Malware payload (VectorStealer)", "value": "b269ef2b72ca0953d69a463e8c9cb44669b8acac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262019, "uuid": "2b47fd71-5fcb-463e-bb98-199e1ef87ed8", "comment": "Malware payload (VectorStealer)", "value": "9746694e7a735e3a74fc2ca83f8ecc23c1d4951c1a2f0dd12871252dbf5833a5d8679c5e9b8f7482783c79fe90471705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262019, "uuid": "c87e24e0-bd69-4240-8ea2-af67261f838a", "value": "T17C85E0A56E19A257EBC1A0B32804E7B7EBAC7D5D1427C0883ED13D8FB1B9D2C0115E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262019, "uuid": "eaa78dda-ef2e-4727-8dd9-ce128fbae77f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262019, "uuid": "bf6d7d10-5f84-43e7-b5cb-e7566ce79aab", "value": "49152:am9bhKXZshdT4sa00eCGhx1VhhtbRIKzNH:aVpszTq0jCix1VhTWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262019, "uuid": "e4039c09-ba67-4544-8a61-587d3cef317a", "value": 1717248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262019, "uuid": "5acbef4e-bddb-44aa-a1a5-b5a27c5e919b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262019, "uuid": "7c405986-ce68-4719-ba5d-c5f66349f8bc", "value": "PURCHASE ORDERS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b7b95f-bda2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274067, "uuid": "b95167a8-ba21-42a8-88d2-c755c3fc55f4", "comment": "Malware payload (AgentTesla)", "value": "c89482b360023c802773f550e0671489", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274067, "uuid": "c64e0be8-a4c5-4359-b367-0f060e694c08", "comment": "Malware payload (AgentTesla)", "value": "58173548c2124b6a23d02762e8699b9bb1d8f7fdc2b4365a7c1f97ab8639c1d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274067, "uuid": "bae4241c-aff2-4e1a-94cd-2cec23a50e22", "comment": "Malware payload (AgentTesla)", "value": "b8e5d08eea312845e27c1d3265f5288ee1482135", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274067, "uuid": "3e11defb-b092-40c6-bf88-fb3f09511d43", "comment": "Malware payload (AgentTesla)", "value": "98d465eeb08eb890a481c1c4045516393e80528297dd30bd88bbe275da40c1746758c565fb1a8ecca254c7397ea7aef5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274067, "uuid": "c6d3670d-72f2-43d7-94fc-4ff29ca34941", "value": "T1E0F32A689E899F52D72D4174D4AC11080EB3A1837A1BD65E0EA0DCFA3F767C3323E965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274067, "uuid": "0ea33486-1e06-4df1-8667-f60dad89e9bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274067, "uuid": "e5147e85-97cd-44dd-8071-84b8f97484a0", "value": "3072:Kp2L5ogpd5Da12y34BNNjwux3IuN0FnMXrkKscKH59T:hogp7DALo5ZMFUuPZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274067, "uuid": "c8385931-a6ca-4efc-83b1-1d387c53163b", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274067, "uuid": "259ddf26-202d-46d1-9130-f4f1e730a4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274067, "uuid": "263edcdf-bd12-479c-a3c8-6f448ae0469c", "value": "58173548c2124b6a23d02762e8699b9bb1d8f7fdc2b4365a7c1f97ab8639c1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3973a646-bd49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678235771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235771, "uuid": "f86d0192-1d92-4712-9d97-4e9edb6a7b4d", "comment": "Malware payload", "value": "9e388a5f48618fc12ee933b06d769661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235771, "uuid": "4b7d0f85-9722-4e7f-91e0-ee327ea42509", "comment": "Malware payload", "value": "58917febd1aae433e3522df0749d82d14906a6bf249b90521b5cdacff2208cde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235771, "uuid": "2831d716-e65e-4ae9-ae7f-8b15859adb36", "comment": "Malware payload", "value": "9c8e34ca14ec87d99c0b85f408468a03518dd80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235771, "uuid": "14a08b3a-f354-4cb7-95a6-52972b520742", "comment": "Malware payload", "value": "bdb39ff34c38a69e7c75576213ee22af47b6c7bcaf8238ab8d34916b3e3e17c430288d77c3b2f86f536b85ca1e053ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235771, "uuid": "ff641c06-95c4-41fe-b93d-ce512b9498b1", "value": "T141649E5273A51CFAE863817ACD51C642E7B2BC460320DB5F13A472669F73391AD2FB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235771, "uuid": "14ab91e7-b826-426f-9249-3bcc57f8e70f", "value": "6e3770acfdb8e6c6f276627466287e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235771, "uuid": "0d00db36-b3df-48e7-ae76-68cc76f8bcf6", "value": "6144:LLAx61rdHUZObEIuNVmQ1xgWMCDgXVh+caqXfmd0o92fk2:4xurpUZObEI0LkWj2eC6L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678235771, "uuid": "d852387d-91bc-4fa3-abc6-d6974bf48ce0", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678235771, "uuid": "241802a8-2e19-4a7c-a43f-09e84f9e8012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235771, "uuid": "889360fd-b41f-4fd9-95ba-401336e84e41", "value": "58917febd1aae433e3522df0749d82d14906a6bf249b90521b5cdacff2208cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b9d865-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678285043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "96a1143e-46f5-4675-9d7a-e4ad7522e1a5", "comment": "Malware payload (Mirai)", "value": "9dd1cd2a7e5490e256e04d04a95e6233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "5e61d974-e107-4a90-a77b-3316c87c4774", "comment": "Malware payload (Mirai)", "value": "589b5b8b8b28fe3ce096c27ef6ecb29787b344dcacef1a3201665f51d5513b7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "522b1311-cdec-4b4e-990a-cb85fa9ab7eb", "comment": "Malware payload (Mirai)", "value": "3a8dca2f7b65dc533c97ab08d7311f953bba9410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "26fd5a31-1106-4f7f-aa7d-6954ab6a895a", "comment": "Malware payload (Mirai)", "value": "4e6df80923e3ae34d5fd02f9393fd8467962cf52584776702e0b0ef9124c432cca0bc8b04846bb819edf0e110bb268df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "7dc4fbd9-67f7-4ddb-930c-9e21e9f26f92", "value": "T1EC82BF7061D335F1D7F00431EA6FCA865B1A0FB4E2FD31922648BB69DD4A40545FA2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "f067d86b-e486-44e1-846b-330624ade543", "value": "384:MjUzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUT/qVR1ekihymdGUop5h5lm:6wV0P6+kom0tVAoNvm+t4MR1qs3Uozng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285043, "uuid": "8c4b425b-1e05-4103-89cf-1fc530cbbaf8", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285043, "uuid": "4e987394-17a4-4cac-b608-61a28a692e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "4f07c03f-e6eb-4682-821f-00d6baedeed2", "value": "9dd1cd2a7e5490e256e04d04a95e6233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794924d0-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274962, "uuid": "616c164f-d0d5-47ea-be54-d79c6df66a52", "comment": "Malware payload (AgentTesla)", "value": "8f098776f1107d029366534f5ebac7f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274962, "uuid": "95f222e2-468a-44e0-8e32-916dfcc598e9", "comment": "Malware payload (AgentTesla)", "value": "58f1eaeb500a8d6d5e44e712fc2db77e9f70cb2775a682786ebfc1d36e4a639b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274962, "uuid": "971b128b-72e0-41c9-9f23-d030ddff2065", "comment": "Malware payload (AgentTesla)", "value": "30f819b7734717e5e2c83ea78c1ac5b45747eb04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274962, "uuid": "8cda3516-df6a-436b-9e80-f58d363019e5", "comment": "Malware payload (AgentTesla)", "value": "b3971b7454f1eb803c40125b4cd8c09e3707f59528b1414db33452143cb5ee0a66204d3e1cc8d9ae6a9e5efef6eb977e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274962, "uuid": "106d8e2b-3cd1-4109-8c05-06423e801cf0", "value": "T132F32868A2C9CE11D72D40F4C4B011481BB2A1475617E7BD4FA1ACFA3F46BC3762B9B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274962, "uuid": "7a153c96-667a-4cb6-85e5-3cf969964641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274962, "uuid": "caf8f815-3d15-4970-8575-d04586d16847", "value": "3072:A75pUpssdDvXx8B1LDULIt5UEUqOQvm7b8eETBl28S8a:A75pIu1sLIYQOQvm7b8lTuL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274962, "uuid": "2a66fa03-7b8d-447a-8475-6a430bbea8c3", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274962, "uuid": "d0df4a24-f307-4bd6-afc9-425c2d304a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274962, "uuid": "f07af25f-189d-4f74-9c1e-ce9b5a87bb08", "value": "58f1eaeb500a8d6d5e44e712fc2db77e9f70cb2775a682786ebfc1d36e4a639b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ac38cc-be0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678318974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678318974, "uuid": "f2700f5a-c41e-4b34-9b20-4bf721e21f28", "comment": "Malware payload", "value": "9cb2c1a445f74bdee85086381dc80d7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678318974, "uuid": "d45d4e5e-c9f6-47cf-aea3-baa6bd53fbcf", "comment": "Malware payload", "value": "592ec7037deaaa186814232861ce7451dba4238f258b66f7e7c5ebfa58412d1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678318974, "uuid": "c8ef661a-7f15-4192-bc9a-df122747b2b7", "comment": "Malware payload", "value": "c3158553728c5fef3ab5c5fdefbe0e0da06746ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678318974, "uuid": "c26ecd19-8fb8-40e8-bcfd-68caf28d1566", "comment": "Malware payload", "value": "429da2f28c91b94edcf17d8c7c4b34c7a18f759cbc14557e090e795210609a9e68df6f57e69c0afdcea0711fb34bbca9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678318974, "uuid": "d57e8744-179f-447b-a2b6-bf0f714f271e", "value": "T1A2E4020A53E1BC25E72286315E6EF1E96A2EF5315E7BE6DE33185B1F1A701E18533302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678318974, "uuid": "ca41b622-355f-40cf-a498-9080057bb8e5", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678318974, "uuid": "01e905d7-34d2-450a-85a8-8e0a4964bb44", "value": "12288:R/yPkuc3Eeze8+BYfkOWQKygM0rCtN2ho4KQO5+p5q:RblT+Bkb4M0sY2bQO5+pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678318974, "uuid": "d9823f20-c78b-4ef6-9362-f989e5908383", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678318974, "uuid": "69f8fdb3-611a-4beb-8fb8-6aa277316633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678318974, "uuid": "74ecab0e-a644-4454-bb4e-9c0de6d73507", "value": "9cb2c1a445f74bdee85086381dc80d7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6242b6-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309540, "uuid": "85d353b2-f68a-417e-ac0b-58f722dfca9b", "comment": "Malware payload", "value": "02b8d666de18af32367c678a10771b54", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309540, "uuid": "fd465cad-7a1e-4a3d-96c4-d763d2c897a4", "comment": "Malware payload", "value": "5951b9e4fbd228d30acf0c2fbce43636d2e737eebab40b8e3f986d6ac9593813", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309540, "uuid": "aa95cefc-2654-40fa-b5a4-754fcc4f08ee", "comment": "Malware payload", "value": "6fa38b230501de2485ecaa2e308d5765d5cde795", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309540, "uuid": "0ca8a81e-37c5-415c-b9c6-d45853b9f71a", "comment": "Malware payload", "value": "4edb507e69f859ca7f699b5e4ef6adc1ae5f36722ce5c4eddf367eb8f57c49b270e2b38eafaaecdea0f10925d01b66d6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309540, "uuid": "1d7757a7-67a2-44f3-a117-c265de30b098", "value": "T1E231E12E27E54721E2F386325ABBF301D722F911E5368A6A41C061CE9D71610FD69B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309540, "uuid": "96a9bdbf-532e-47f0-ac53-0d7c23590e2a", "value": "24:81WJ/kc4Cs4yMpCfyFH3vu9+/U4I02Gd+dsT+m9l:88kszbG9EIUd+dC+Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309540, "uuid": "e80c8641-a90b-4a29-93f0-a8f85cdadd8e", "value": 1830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309540, "uuid": "60ec4721-ca48-423f-934f-8eca2e746274", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309540, "uuid": "0a78d5ff-bebf-4e2d-af9b-48307f0b92b8", "value": "sec_u_SN09658831.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a002399-bdbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1678286560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286560, "uuid": "f0a7030e-3e97-4eca-bb75-79e1d9a9952e", "comment": "Malware payload (DarkTortilla)", "value": "56befdf6fceab4156b43f56db58d0629", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286560, "uuid": "8b804e42-fa01-4a00-ae3e-aff553dcb332", "comment": "Malware payload (DarkTortilla)", "value": "5b7af39e2a3cce692c542e97991d97cce7444275dd082e242323f575675ebd4d", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286560, "uuid": "ddb86f6c-3c3a-436c-adde-452d9746b3d3", "comment": "Malware payload (DarkTortilla)", "value": "5537275639fb7b2a28e691c59089536a47eda834", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286560, "uuid": "e85de9e3-724c-48c4-b4ba-d01a713e0f0b", "comment": "Malware payload (DarkTortilla)", "value": "16ce931db094d162398d5c12622d9da56fd04a132faa93ee11f5ffb443f73bf1112e545ef4539b920dde6d1f41890d58", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286560, "uuid": "540d7398-5df6-4eef-a155-3001190dbf79", "value": "T1E465100027BB0A48F172BABF56CCA5615BFBFAF21636A567290E03460703D50DE5637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286560, "uuid": "f1740b77-6e6d-45d8-98ce-eee6ce128c00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286560, "uuid": "020ed079-53ad-416d-a629-ffb18ec04f0a", "value": "24576:CdeO4KXRzc3DGVVjMtil08e+gN8ImkXe9dfZhV:Cdx4KXRzc3DGVVjMtilLe+gkt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286560, "uuid": "427488d4-cead-4a21-8747-204d9293d57a", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286560, "uuid": "839556b3-b357-4c15-9bf9-0287ef6c4985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286560, "uuid": "3e9c7246-a159-472b-914c-f87edba06b5f", "value": "Swift103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66e832b-bd8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678265159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265159, "uuid": "80c8f23a-efda-408a-bdb9-b18939e47a30", "comment": "Malware payload (Gozi)", "value": "e12d09d7f5bc156c651ad31508626593", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265159, "uuid": "1b5503cf-1af6-4991-a9e5-aa27ab001755", "comment": "Malware payload (Gozi)", "value": "5bd64a7b018db5b4538d8077ad7a50871dc6c5682a1f151cc5e8a42673e4384f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265159, "uuid": "8e72f58a-f013-4c0d-894a-3075b3185c31", "comment": "Malware payload (Gozi)", "value": "afdbc23b99f31640b473772dc1db24ffc9ed61a9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265159, "uuid": "909aaa5c-c142-4140-a28d-1f2360f0f3b5", "comment": "Malware payload (Gozi)", "value": "150aa019ec74c88a30892d29e769a3b22af1c9600ed0bb04d8aca6e0e54bb7213bbabebd53e6b9b754d7bd58b3a56b2c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265159, "uuid": "c4227025-74d3-4539-ab3c-9709ad01a024", "value": "T1FD138E01F6F94CF6C7A31EB06624FBA9A7F9D531223C5055AF23A9C91E60953E13D20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265159, "uuid": "8446bb14-5525-45f7-9393-616ab3c6292d", "value": "ef075d26b728b78a932306e24062e80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265159, "uuid": "9b31e3b3-e448-4d81-9001-f0a9bb4c0839", "value": "768:5c0gsqVXye2rS/Q4VYXQIVpCHlNBmQWGk2j+A6ewBvu7gpzhK3D1Gc:+9sq8S/QEYXQIVWlvmYp6ewNu7hD1Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678265159, "uuid": "2cdb729c-b15c-41a4-a0a4-27d55d0c24e5", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678265159, "uuid": "3a35df67-fa0e-4ddb-9cbe-5c77225e462e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265159, "uuid": "45fab717-076f-401d-a30e-b42527e6725f", "value": "20230308_unpacked_gozi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fea14ba-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678277604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277604, "uuid": "d99a1da9-6094-4396-8a48-6ed31dbb2bb0", "comment": "Malware payload (AgentTesla)", "value": "11ecf3ab5737650035ef7e9a3c57f80a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277604, "uuid": "56844e1a-00ef-4a67-bc70-442812354b82", "comment": "Malware payload (AgentTesla)", "value": "5c3a2912958bff3bd0d25b141a32717f0f7c4c7b1091a263185694c2f779f3cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277604, "uuid": "adfbc53b-90d4-4d93-8ebb-f81277d7daf7", "comment": "Malware payload (AgentTesla)", "value": "31b6aef080ee864059e8a82d8d9d2b3745578f2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277604, "uuid": "599eef31-e0d7-422f-a533-4235e9046ec1", "comment": "Malware payload (AgentTesla)", "value": "ff26e9bf0a9ad94f2b3aff08f807ab430290864de6a94198b6d3c6a2d514551340c34b6db5bfad3a8fd6e04c7c00c564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277604, "uuid": "3541b3b5-e2b4-4297-b5eb-49de912150e5", "value": "T13BF40255B3A1C126C92824B5C4D39C6013F11E93B633DA0E795063A36F932FE9E57B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277604, "uuid": "ad1062d8-0b4f-40b5-afb1-53e9c588c4ad", "value": "12288:2dj50i653yhXyiQmHE1ODGK90f8EcgeL5KDmCxkFTmcj+f8p5:e50iE3yhXyiHE1ONe5eFKDmrFTzj+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277604, "uuid": "fbdc4a21-a53e-4357-a44c-cf4fd49fd1c6", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277604, "uuid": "7981af56-7056-41da-be45-40454ffd383f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277604, "uuid": "03df88c3-2944-43aa-a9c1-54621d1c5fb2", "value": "5c3a2912958bff3bd0d25b141a32717f0f7c4c7b1091a263185694c2f779f3cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4997a17-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678309099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309099, "uuid": "00926acb-62f1-4066-88a3-5e3326260e09", "comment": "Malware payload (Loki)", "value": "9173d66d114199de7f5e64cff5df93a2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309099, "uuid": "014f9556-6127-4c69-86d4-3e607dfc1fc1", "comment": "Malware payload (Loki)", "value": "5cdb1e3941669f8c1030c285b4fabc8ada3674ca9af659699c543c3975be89f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309099, "uuid": "f31f893c-5ae0-4e23-a3a5-ca4a7e0cc53e", "comment": "Malware payload (Loki)", "value": "dea89a0e4265fc37f10483dbf0584047162843c8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309099, "uuid": "49cedd33-a9e2-470b-a610-99b18c1a7ae2", "comment": "Malware payload (Loki)", "value": "c5d185dbf01ccfe12036b7e7765d62f481cf20b1c1c3c0fe794071843980ef7acf4e3846f7f7e33df0674d0742826684", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309099, "uuid": "bfd1aacf-05aa-473b-a633-edea7a23ca06", "value": "T18F55E1039238AD4BD102CBBCBA2F7459011E7C3671D5E5CA3A8DB34B4732FA659BE119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309099, "uuid": "d5b676a8-6f61-44ad-a397-a3459b12f68e", "value": "24576:mLKebBUtHlxOWQmmav30x3BujtHlxwWQmmav30xE6Fj/JhSRvUsJz2AGERr:mLKebY7DQmmQ30dcV7FQmmQ30O6NSRvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309099, "uuid": "a4a93337-706a-4feb-8557-33834d45a6ca", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309099, "uuid": "aa2f40c7-e5a2-4227-a353-f1620e74366c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309099, "uuid": "60f7e61e-57e8-499d-8558-246a319e8fcc", "value": "2305 PILC Purpose .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc9f367-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267480, "uuid": "256c6a9a-cbe8-4886-bf59-6094c05d2979", "comment": "Malware payload (Gafgyt)", "value": "4ccc9bdc78e60f4137e234b478c98392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267480, "uuid": "368f29d9-5d1c-41a9-bdb2-af0887163eb9", "comment": "Malware payload (Gafgyt)", "value": "5d9838ee8ebc9be6a37428f3b4fb4075a0e5869a773656ff8f72916909b67d09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267480, "uuid": "ebe0064c-bc13-415c-b556-625096404196", "comment": "Malware payload (Gafgyt)", "value": "9210b8f7d8da1febd4cda5781429a2da3319fa80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267480, "uuid": "a46ec0ff-9818-476c-a142-6b59e0fb41f9", "comment": "Malware payload (Gafgyt)", "value": "b4810e2435b2253f4455e5fdc39222cee2b7ed200f4883e35010d2b0d6ae81a0037d113ef0157e6fbb056f45f3a0e75b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267480, "uuid": "ed8f5bc0-9d98-43e4-912e-51ae37f59f86", "value": "T1E1E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267480, "uuid": "fdf4a2d5-9e9c-444a-b7a0-aaf8920e5843", "value": "3072:tdntU2haO5H1XacBoGmh9H5q5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hw5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267480, "uuid": "30279ccd-a0be-4013-9741-310be9639c54", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267480, "uuid": "8fce711e-10ea-475f-9d48-d004ce8746e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267480, "uuid": "224a91fa-246f-4c1b-ba0b-a6d580a13c84", "value": "4ccc9bdc78e60f4137e234b478c98392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0614caa6-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274769, "uuid": "f31d7055-2d87-4671-97b4-e2e3b04d975d", "comment": "Malware payload (Heodo)", "value": "11c5d0c955902be5e993f21fa4a85a4f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274769, "uuid": "11ebb200-7c7a-4295-833b-f2cd62f72fc0", "comment": "Malware payload (Heodo)", "value": "5ecdc169d3da2345feeda676fa5f312ed1fa188acb7577033cfdebe7d393c5ab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274769, "uuid": "59ab7b1b-c501-41e6-9da8-9e4100aa323c", "comment": "Malware payload (Heodo)", "value": "35775728ce727b15be3b51ef243a1bb682ee2476", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274769, "uuid": "135c82d0-7c9a-4a1e-9257-6263649b5625", "comment": "Malware payload (Heodo)", "value": "18b90430af570544a2516819f0920b0dae16ab422e76e6ccb59ca2b3f5c39d38331dcfb2d7f336b7be6ade4e1bd60845", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274769, "uuid": "4f3f6073-0dad-4225-9685-f39d04cab39f", "value": "T14415233C5F67790FF5997C362AF3847AFCF9085CDC96A90A17432A9209AB2056794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274769, "uuid": "de517464-2d03-47ca-b742-fb387084afed", "value": "12288:h4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sN:eevtlkdJe4m19FgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274769, "uuid": "4ebd6e61-98d5-4723-bbce-d08c234d6b6c", "value": 882816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274769, "uuid": "50c39228-15a0-4811-8391-af04b4f85476", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274769, "uuid": "1f73d952-0512-4922-aa4d-da8a696eec9d", "value": "3Jve4tb1qZ1NVtiq3wLGZpy9zrk1e9hDbh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1471ce52-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279517, "uuid": "e01b3fab-8b94-4fbf-94d8-33e07a82e7f0", "comment": "Malware payload (Heodo)", "value": "5f43a67c406b0333ee92afac84485dcb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279517, "uuid": "fd9e95c9-c76c-4212-a825-2eb01e541975", "comment": "Malware payload (Heodo)", "value": "6079376dc35df62ac674713d6e18a412c8f6bae06112cea60ac113fb2388ab17", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279517, "uuid": "558c7db6-de29-4cc4-837b-224951d66a91", "comment": "Malware payload (Heodo)", "value": "590bab6e3cafc6d9e1c8f9c1e6088a9c52152957", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279517, "uuid": "1b763f18-42a5-4ae3-83f7-7eb8fa1d078c", "comment": "Malware payload (Heodo)", "value": "bb0f053a9086a5962e3e6f4ee7eb58976c197f0e96375eb7a291e0f89b5a46ff884d2d358380aa500c4b6b01c9d5aad9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279517, "uuid": "59e93a22-5303-467a-8e35-0fbae07c238a", "value": "T14D15233C5F67790FF6997C362AF3847AFDF90858DC96A90A17431A9209AF2052794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279517, "uuid": "dc7b1ab3-35bf-4f28-90cf-02900ce242cd", "value": "12288:V4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sl:KevtlkdJe4m19Fg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279517, "uuid": "4584671c-e4e1-466a-bc0f-6c3681f64762", "value": 903186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279517, "uuid": "dabbb282-e697-4f80-930c-eaa243212e4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279517, "uuid": "5cf5f581-dfb4-4375-9ca2-badfedf20e1a", "value": "5jBhuGVAIEecXmWY73R.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66ab437-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1678307814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307814, "uuid": "0c9da59f-4971-44af-886e-4a50243aed72", "comment": "Malware payload (Adware.Generic)", "value": "8f912c02dac6ad512a216a666e7194a2", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307814, "uuid": "5ec5e80a-4fa3-4eb6-be14-64228b51be1c", "comment": "Malware payload (Adware.Generic)", "value": "60cb40b1dfb81a2ab754af08000b19aa5d0218b248667917b18d8b2cad8b1fb1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307814, "uuid": "c2fa6e96-fc15-49a0-80ea-fe6ddcc879ac", "comment": "Malware payload (Adware.Generic)", "value": "321bdb5e881053d55ffb84a786169b90ae1f1ff5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307814, "uuid": "b1f2dca3-1f2a-46c1-803a-69f9794842d4", "comment": "Malware payload (Adware.Generic)", "value": "5ab06489d8536f8730ffa90cb272759472149b6a2896af42426c40118332bc7f52f9881ebdb6159d7a36a62a3e6b9589", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307814, "uuid": "322f421a-1107-4500-ae30-009c48dfa588", "value": "T171D533A376A18C7CC083D07B7605FB10AB1ED8386A31CA577975F98A9BF51425323B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307814, "uuid": "987407fe-dd35-4c55-b302-ac119a9c5505", "value": "a0c012e2da92ad42555210cc958fa405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307814, "uuid": "ca6276ca-3b10-4a52-bc64-85fb209ab371", "value": "49152:9mDnJjOXJJZZT2dh3ODVHcxFVa+jUalhMQWd508AxGLOGQORIUrIy8Lj7Ic:gD1OXBAmHcxF1UaLT8CxG6yRIUs/fsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307814, "uuid": "113236fb-f707-447a-80f7-d4e4f4c7cedb", "value": 2865016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307814, "uuid": "98497185-93c1-48f8-94df-336df57ec03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307814, "uuid": "7467d45d-e0e8-42be-b608-282f49e55420", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e882b51b-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678309508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309508, "uuid": "7733aaa7-67e3-404b-ab75-e922a259d1db", "comment": "Malware payload (Amadey)", "value": "c4e426738efd206ac083c08f1273053a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309508, "uuid": "d74d80d0-3b20-4978-ab67-f57c7427320a", "comment": "Malware payload (Amadey)", "value": "6147208f4b1a7f58babe5be217c35692f28ac5f5c1cc3ee24ecfc2a3018e6051", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309508, "uuid": "99b2d389-f533-4c1c-b81e-6faf7a1475c4", "comment": "Malware payload (Amadey)", "value": "1595aba27a57fd0155e190e03ba98b2081bf416a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309508, "uuid": "c3085bd6-c60d-41af-a384-ff6ad0ac8dc9", "comment": "Malware payload (Amadey)", "value": "2f1c040ea934a1cef86f559701411b10ae8d7e6659d7b6f128fd11ffdce951926d8d4bdd859873b3fa9b05df0991934c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309508, "uuid": "9f3b0838-563c-435e-8369-35ef585d9009", "value": "T180148D1253E1AC21F2728B715E3DF2E52A7FF5615EEBEA9922181A1F0DB01E1C563312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309508, "uuid": "d04dd529-32d4-4639-aff2-02c9da1c02e0", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309508, "uuid": "2d5414ed-d700-4aba-aa1e-462197186b17", "value": "3072:7rI/oi6OtfHHUAHG3i7CIy1nqnHD3lOnKJF:Uo3OtMA0iOIoMD3lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309508, "uuid": "4fbb25d2-5aee-46a9-a455-4de7e1654858", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309508, "uuid": "311cd04a-77c8-4014-8594-a24294498762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309508, "uuid": "8aad4e65-294c-40ce-9624-547161588d82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9702057b-bdce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678293051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293051, "uuid": "0c213063-cc01-4aee-8c27-2f70eaa7c623", "comment": "Malware payload (RedLineStealer)", "value": "17550ba5d2dc0f77f7921227c93bc2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293051, "uuid": "9a43c369-b569-4d63-a27d-676d96398d97", "comment": "Malware payload (RedLineStealer)", "value": "61dcedfb38453427170d426c396e9bc5080ee63088b8892a7cd5621b141d6b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293051, "uuid": "70b9ea45-d1fb-4aa9-9735-b8b656ddd5fd", "comment": "Malware payload (RedLineStealer)", "value": "bac37e5ef1c8acfdb6211527bfcbbaec5719342b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293051, "uuid": "377900f3-148c-4e6a-83db-b20c227d48d7", "comment": "Malware payload (RedLineStealer)", "value": "c94fec2d62526e3979250760a20a49ff1ae1e64b323ca343363d04de2a036fb1117aa7202eab8e10265ae36c5a9b3f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293051, "uuid": "fdde7955-e732-4ec6-9f8f-fbf537f3be5f", "value": "T13F64C10153E0AC25E566EB314E29F3A4263FFCA19E7BE6C932146F2F09B11D1D663712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293051, "uuid": "1d09965e-24bf-4947-b6f5-afa4ac2c3d7d", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293051, "uuid": "294cc272-851f-4b34-a1f5-ea7e9b106225", "value": "6144:bZ991uuySDDa8f6B9VP0mYc/4ey1fq/zj61LBLMZRRmosRP:bdwuySDWM6Bn224hD1tMRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293051, "uuid": "9d344342-3eff-4dab-983d-849c7ca36a71", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293051, "uuid": "cb8a98ea-bf58-4656-b849-1f70c086a377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293051, "uuid": "1bded14b-c793-4979-9139-7e69d08e9f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218e14a3-bdb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678283405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283405, "uuid": "a5ca5d32-a6c1-495e-b5aa-a5d8e212fbd5", "comment": "Malware payload (Mirai)", "value": "bdcf8479b18cccd59d16e08474ba50ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283405, "uuid": "6a8a9718-1dd7-48d3-aeea-32e6a1f6aa33", "comment": "Malware payload (Mirai)", "value": "62c2899ead76b367be447945e208c295a063fbc9ebc9d4b207cfdcbdbea2a039", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283405, "uuid": "bf196c80-7121-479e-849b-eb0b4024a626", "comment": "Malware payload (Mirai)", "value": "922ce67776bfa16d780d9f23bfbd33e7ba79e6c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678283405, "uuid": "fcc78614-4344-4e92-980c-405d38f65266", "comment": "Malware payload (Mirai)", "value": "04b549099d2a43fda79d980a898587eb08651ef3ba2e2f8501ef4b95e3ec0613f94e3679482726be5d9779adddb9758f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283405, "uuid": "262d6247-2d60-43b4-8f48-1bc37bef529e", "value": "T1B4230272410B9FD4C9706C3AFD94938321606A7EEAF726231B105A3C79A4D235F9CA07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283405, "uuid": "012b73fc-5c8f-40f8-be61-d9ae98110b3d", "value": "768:g/TYCoIxdEoHywwLfdDElgBEe/sCYar9fVb9q3UELbUXfi6nVMQHI4vcGpvS:gECFDHAFDElgS/6JMLRQZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678283405, "uuid": "be3169cc-0527-4712-b611-ce666deff452", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678283405, "uuid": "4bb39094-16c6-435c-8b64-154169a6ffda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678283405, "uuid": "c2111e9b-a1d0-423e-9d44-ed18f7d15f58", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520a9e26-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284775, "uuid": "edc77247-6066-42a7-9fbd-5fdfdad63f75", "comment": "Malware payload (Heodo)", "value": "1ecfa1c91816f30f671b696a89aa54d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284775, "uuid": "641a9776-2dbd-490d-8cf2-8889f1c8158f", "comment": "Malware payload (Heodo)", "value": "62e29133af2ec5bcdce11426cf0b737482663609f5521490139d4d33c1c9b04e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284775, "uuid": "9a2ee3bf-bc89-4d9e-8dc9-2754690da23b", "comment": "Malware payload (Heodo)", "value": "0b8741ca6f5da6ba13369c837aaab3d6295198c2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284775, "uuid": "4cdc2d8f-7a75-48e1-bc44-9f3dbde633f5", "comment": "Malware payload (Heodo)", "value": "f54ffc52665bff6bd4eb9542c947abd2d00b535dc2a2c71db0e08aacc2a43b4e8df18018f2b0ceb38de1f8e4ecb6fb27", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284775, "uuid": "01d1f718-fabc-468a-979f-a8f14f6b56e7", "value": "T19215233C5F67790FF59A7C362AF3847AFDF90858DC96E90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284775, "uuid": "de6cf609-6156-4dd9-92fe-ea69f7db776f", "value": "12288:K4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sc:tevtlkdJe4m19Fgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284775, "uuid": "9e00768f-5a21-4304-a63d-ff3c2c5fb2c1", "value": 898086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284775, "uuid": "0d8471cd-5f51-40ab-a883-661cd8659fbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284775, "uuid": "6234531c-b5f2-4760-b275-ea8d52b75bd4", "value": "VscGpJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed377c4c-bd92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678267426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267426, "uuid": "053fe41a-6dd9-4122-badd-0e27754c6176", "comment": "Malware payload (Mirai)", "value": "c3f557824c07abeaa400c10c38556b39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267426, "uuid": "41c99a49-a845-440c-a8ae-73388335e483", "comment": "Malware payload (Mirai)", "value": "631cba65786cb33300ae6f12f4ffd926f14232bc903e2c904e8ff65cdbae6df8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267426, "uuid": "aea67ee1-fc49-4fe8-a901-b8fa9a926e9c", "comment": "Malware payload (Mirai)", "value": "4be9f81f75704aeeec6957fbc01a74ad4e1cc750", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267426, "uuid": "3b234dc2-978b-4c2c-959e-f8f00e6f9d73", "comment": "Malware payload (Mirai)", "value": "fa5c704f92b6fa2fbba987560d14f7d799fc41301c5860108e4c7cfae43dd8a50bf63f054d43858729ce2abdb6f21f38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267426, "uuid": "0728bb72-4f3e-41b0-8db5-1e6183f04f32", "value": "T147A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267426, "uuid": "9c1a8d3b-2320-4aff-b678-672696a3a43f", "value": "3072:7e9h9oZk5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZk5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267426, "uuid": "521f212d-1a9d-43f8-8db1-5f8d9c45ca60", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267426, "uuid": "91ffabe7-0493-49ec-a853-c0c3a97e825b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267426, "uuid": "ce41a4ed-3f60-4c58-8256-8ecffa485bbf", "value": "c3f557824c07abeaa400c10c38556b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284dbbd9-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678309615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309615, "uuid": "9eb6870b-aca9-4097-8ed9-175b8a703a1b", "comment": "Malware payload (Formbook)", "value": "7ca4ca81db6b407009e3498387764932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309615, "uuid": "df462a61-d751-40bb-9e95-63884a853133", "comment": "Malware payload (Formbook)", "value": "658a6a08df776ba6ec5c1219fa0bc0226f9f810f247ae681de1fdd5b55954d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309615, "uuid": "c4be63a0-c3f2-4257-b859-0f02c4bcd709", "comment": "Malware payload (Formbook)", "value": "bb80be7b6a0a3d0c1efd3357107280e52cc8bed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309615, "uuid": "67330864-7ac2-4a09-8307-6dfcd5cc313f", "comment": "Malware payload (Formbook)", "value": "51079445ba16cb771328da38d7497492bb7b0794cefd2761eb55a24ec37d936c8952c55624ee9f4a4adffc91504396b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309615, "uuid": "d63fdd89-adc8-46da-9995-e297289b32cf", "value": "T1B444122552B0E0E3ED724F302D350A9A2BF4E6258810578E9B4967DDBC67AC1DF4FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309615, "uuid": "551b8235-0014-4ab2-a912-5f8028041a66", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309615, "uuid": "405e5eb2-ff69-4b7f-97ca-2539c6b97268", "value": "6144:PYa6/as2WtKPohVqDhvgMhVOM1+R2chVXjssQaL/fjuE:PY9arWtKPWqdgMhVczjssQKfyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309615, "uuid": "96408961-711f-420e-98bc-c70216d24670", "value": 256274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309615, "uuid": "4b67eb24-d8a3-4451-842b-5b3bea76cd47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309615, "uuid": "e36555c8-8a20-45c6-b314-1cb06ef8e02c", "value": "FedEx Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fc4f00-bdcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678291821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291821, "uuid": "56fbbb47-73bf-4482-8f41-fab3f92217d8", "comment": "Malware payload (AsyncRAT)", "value": "ab712a4192195f146528b9b81c954a31", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291821, "uuid": "b622f3db-47f7-46a1-bdac-11ad91328e5a", "comment": "Malware payload (AsyncRAT)", "value": "665cdb347fa978e2b776883fec9c4a4953dbfab76c092a16de44b52e3c0859a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291821, "uuid": "958e6ad5-22f7-4fbd-bafd-deac01ce9972", "comment": "Malware payload (AsyncRAT)", "value": "f71becddee77146526939a8eec72ef83a1703eac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291821, "uuid": "c5afaf90-3c18-4c31-b67d-db978e944b21", "comment": "Malware payload (AsyncRAT)", "value": "bc28ad977e562658b95341cf1350a0f7a8ade030c5ec891738fd2f169d619a0e547db3460574acdf86af1b3a5d8675e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291821, "uuid": "559b23b0-e2df-4d2e-9dd5-05324f185188", "value": "T1D8F423FD390A85069B028F3F3AED2D69D6E5C58F918D76C168F087B8C815926C636703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291821, "uuid": "92382b32-63f9-431c-922a-77d313d0d2ee", "value": "12288:dgoXqOJmHF2imi9aK8lAITsvjC9bN8/IjjIqWbHjBgiRNnYHwR7PMPVH25IzmNkh:ysq+qF1bFEATvjQRnQlvRNYQRcLSeIMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678291821, "uuid": "1425a98f-00ff-43e6-887c-868e07c67e53", "value": 740930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678291821, "uuid": "e668002a-1230-4197-9bff-0ab14e29e867", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291821, "uuid": "0616d613-20f1-4657-a48a-09223bed57fa", "value": "URGENT PO# 4510225181 & 4510256792 V# 10089847 CAPE TOWN GENERAL TRADING.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94833033-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678275867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275867, "uuid": "b460ad09-09bf-4982-a9ba-6dd7e6952265", "comment": "Malware payload (AgentTesla)", "value": "ddde4003307f5c319e1c62e655a417bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275867, "uuid": "14fb3633-f8a4-458e-aa52-082d2f82b95f", "comment": "Malware payload (AgentTesla)", "value": "66f670897647771d09ce1aa90e62b72aaa02ef22461d1fae042a52520abad20d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275867, "uuid": "d69889f8-fb4b-450f-903f-f411c07b89d0", "comment": "Malware payload (AgentTesla)", "value": "bdf88128269bc187f7f1ab661c9b570eb8878c2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275867, "uuid": "c294a8a8-e075-49dc-84bb-7d30af7b78a9", "comment": "Malware payload (AgentTesla)", "value": "e3d04c730a03050d641f91ff68997fe9b93ebc6705adca41282005049d7ab5f13abd01065c724685ed8c0996913b4e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275867, "uuid": "4c7e5346-9ff7-449d-a78f-f21032bbd7fd", "value": "T12775BE5ED5B36F8FD2295A38940E0E023026C7C598BDDB496A9BED3C319458FD3B9231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275867, "uuid": "33432f3d-31f1-4ff4-8916-c1fac38f8a72", "value": "24576:FIZpc+0FOP88yqHHC2WsEXBWTAcCrnAS7HaCV6ZPh/wFWyXG6Cw5lKudy+:FxA88BnCaZKnJ6CV6ZRwA015Tdy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275867, "uuid": "1dc19644-0181-4242-aeb8-fbb0ea2f0689", "value": 1567232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275867, "uuid": "9e4e0432-c323-42b0-802d-88e4e15962fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275867, "uuid": "e268c762-0303-4bb2-a4b6-865651bb6d79", "value": "66f670897647771d09ce1aa90e62b72aaa02ef22461d1fae042a52520abad20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffce357-bd44-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678233661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233661, "uuid": "31e3e481-3abd-44b2-bc42-c3159b3be773", "comment": "Malware payload (RecordBreaker)", "value": "5f341e1eb8d7978a78a905b53aebc729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233661, "uuid": "d0889286-c7ce-49a6-8fc8-9f24761e96fc", "comment": "Malware payload (RecordBreaker)", "value": "67dd0268cb9b122574629662f97f6d56ffca8e7d478f38be141ac02131708730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233661, "uuid": "39173dcf-9313-455a-810e-6a7c7d0c2a09", "comment": "Malware payload (RecordBreaker)", "value": "5572505f05faf60bdab0fc302eaddc23868021ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678233661, "uuid": "11fe3308-1089-4174-81a8-19a3cb38269f", "comment": "Malware payload (RecordBreaker)", "value": "9256eba8bac785b5b406bfba1046165bbd6e090e2ac82c1a93c86303c889e66c3a552d672fcfbbb6185747e8ca2310a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233661, "uuid": "ce9337c7-6537-433f-b979-d0ebc15bd351", "value": "T1A5E6332E36700146D8D18935BC276F9837F617E61D13FB3FEAC23EC3A9256606941D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233661, "uuid": "996e2fb5-8071-4f0d-9df4-db9a5184984c", "value": "16cf5db3878b2dcf0f97ac9d337625cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233661, "uuid": "b339ac5a-ec9c-4563-a095-eade00662aaf", "value": "393216:xKWt3zJ/tZ8kMgQLlwsvNbsJOlCwDMXYc16uv5ub238NXifm:xjtJ1u6EycsOlCm0/16u+00S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678233661, "uuid": "d596e5c6-3a9f-4b83-89cb-7457bab1fc91", "value": 14011392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678233661, "uuid": "8ceb150d-55d4-4595-8402-5c6824ae4496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678233661, "uuid": "3677ac3f-e5d5-40a7-ae2e-0e117cc0a818", "value": "5f341e1eb8d7978a78a905b53aebc729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081898d1-bd81-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678259740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259740, "uuid": "7b7c7566-33d8-48d9-9aa3-e44a1c20afc4", "comment": "Malware payload (CryptBot)", "value": "faffeb4e7e9bcd07cc70352ef3c1adaf", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259740, "uuid": "7e68d926-eeb5-4ad6-86c2-d1cfbb903813", "comment": "Malware payload (CryptBot)", "value": "687178d4c58fa92b95685893ed8bf3277d1d9b328506cf468696aaa8e2135627", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259740, "uuid": "6110f188-f88c-4699-b81f-75ebe2cf6ec9", "comment": "Malware payload (CryptBot)", "value": "8976a84c0f781eff060ada2c3b3280e665c70e02", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259740, "uuid": "c7095ca2-3d1a-4d70-aac6-f4f7bb682040", "comment": "Malware payload (CryptBot)", "value": "5d9f22cfc331bc79aafa5460fcf324eb22d8873741a136cf3c438900a278f9566bf748f2ed3bd5b8edde71c431fa2702", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259740, "uuid": "ee1f9de6-02a7-4a9c-a0d0-a2c74c168c50", "value": "T1AF0502E3BC51C07AE5A25A714229462193747C226D53985BB7C43FBEFF2C4E3670638A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259740, "uuid": "0cee4b48-f1eb-4823-8a0c-a791f50d53a2", "value": "12288:R3f9H5D1Qwu2BoImCIPIQQsNFaEqEDYOJ9gVZSHha8V6kGsauLT+U+kH:5J5D1bu6zOPIzCFHYq9EYBfV2IV+kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259740, "uuid": "2e4529a8-27f1-4f15-9075-f4f87bbeaa86", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259740, "uuid": "7efb9569-600e-480a-ba0f-b9eca08bea92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259740, "uuid": "c1e2ddbf-ed17-4319-b3a6-92b76787db9c", "value": "faffeb4e7e9bcd07cc70352ef3c1adaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac6609f-bdb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678282132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282132, "uuid": "44811aad-f43b-4421-82a5-42f526004de8", "comment": "Malware payload (GuLoader)", "value": "7503b83b3a277d676a72de2091c2b580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282132, "uuid": "486b2e86-9000-4fc5-80eb-873d47775447", "comment": "Malware payload (GuLoader)", "value": "687e054d6d62821c1b43523e8279b5d86c14971f8a0c8bcd5699bbfc4d17ffda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282132, "uuid": "a15b8480-fb32-420e-af55-bc11b5406fc0", "comment": "Malware payload (GuLoader)", "value": "64c1fdcd7343f6cf13d57864d0229ac9425ca1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282132, "uuid": "ddceb952-b976-4f72-bef7-8a154d42e30f", "comment": "Malware payload (GuLoader)", "value": "79d4ebc87fecd993b36e35eb1413c638f68c8a2bd12b9a1f4c7ef39b0f545cd4fa2d264114d8ed87ac733d576283460d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282132, "uuid": "91e8ac84-626a-4e28-9bd8-dcfe8c80a53d", "value": "T18D44124005E9C863E772AF322CB37D57A969E412359147DB03603BC97C76780DE6B39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282132, "uuid": "c590f716-179f-4c55-a67f-c38c8e548367", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282132, "uuid": "f5f73891-4af1-45bd-a251-c1f48ca153f1", "value": "6144:6//I2y3Uz7jK2YmAkVQfEf2vy6ATdaxDIZ5Md8bqLGtHD1BPQ:ovZz71YzE8EJ6ATd02mLIHD1BPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282132, "uuid": "57573e47-2535-43db-9aeb-834c91912e07", "value": 269729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282132, "uuid": "0c47cbbf-1e1c-4b2c-b1c2-7175e7d3d8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282132, "uuid": "1b130fcd-aedf-4453-899f-554b0e7a21c5", "value": "687e054d6d62821c1b43523e8279b5d86c14971f8a0c8bcd5699bbfc4d17ffda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16175718-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277802, "uuid": "6b7faa05-ef3f-4984-8a59-bf8bdbf627c5", "comment": "Malware payload (Heodo)", "value": "fdd5e005ff2c1cac5c8a1f30a4a86678", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277802, "uuid": "d846b9a3-17b6-4b9d-820a-cbee1bcd2c51", "comment": "Malware payload (Heodo)", "value": "68cbaa961bf655ca8360d72674e25ad09fa11a2399b8a266a2494ef217d011a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277802, "uuid": "42008adb-bf3d-4d03-9d48-65e462651b45", "comment": "Malware payload (Heodo)", "value": "968ae43cea10b82a2b794c6c035a78421b0f1c11", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277802, "uuid": "87692788-7e07-437c-ac93-c22cf65c6bde", "comment": "Malware payload (Heodo)", "value": "8bce52c83779063ca4d622fc328eb6e0ceb4c26a300484da1a9ecb487b3cefa87f4a1999b521f34ef18f0254b76c8a94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277802, "uuid": "a7870712-d459-496d-b30d-e73193fcef31", "value": "T19215233C5F67790FF5997C362AF3847AFDF9085CDC96E90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277802, "uuid": "5523c27a-a565-4f41-adab-0dd5d1d468ed", "value": "12288:q4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sn:NevtlkdJe4m19FgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277802, "uuid": "018824b0-85a6-482b-b385-71554cf9637f", "value": 896059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277802, "uuid": "dd06dd4f-6c0e-4e53-9bbf-a5647da2608b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277802, "uuid": "379020db-79ba-446c-a265-f30319db68ac", "value": "qr3qEwHvmOepaXuIgutPyD2zGdaa43N.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c2e61b-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284668, "uuid": "36e8f8b1-a42b-4939-aed8-04f14963f0df", "comment": "Malware payload (Heodo)", "value": "0ecee3afa94716a905798411230a5891", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284668, "uuid": "1592335e-a79c-49f6-a4ed-07cd931bbb29", "comment": "Malware payload (Heodo)", "value": "691decd7f42fec7f5850f5343c1b1e58951ce61cd91ab3ed537b13d740cf90e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284668, "uuid": "64582142-55ba-4cf3-931d-275c8dfa1d78", "comment": "Malware payload (Heodo)", "value": "b838190d5d0eb112e30c2cf1cd1dd7b633c5999e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284668, "uuid": "50fa5249-9d99-43f0-bae7-7381eabba56c", "comment": "Malware payload (Heodo)", "value": "9a78f59e431fd40fbe6d3870564a8832c43ae8792c049aa97584b83bbf733fa1864617602f97112127a650c097e242eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284668, "uuid": "c58e98c7-d798-4762-ae30-b600675e5738", "value": "T1F305233C5F67790FF59A7C362AF3847AFDF90858DC96E90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284668, "uuid": "f251487d-030c-4508-bffa-db4648b3d029", "value": "12288:c4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sI:7evtlkdJe4m19FgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284668, "uuid": "69a25bbc-763f-48d3-bb5a-119f5b1d0ace", "value": 863483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284668, "uuid": "552a0cf9-c1c2-4a0c-8e5e-67163940367f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284668, "uuid": "0b6b76e4-b1ad-436b-a950-25d8d9a1de85", "value": "9R5ylbVpM8hfRj(2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c18d31-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267522, "uuid": "4bf151ac-8005-4a9e-9c12-002332bc18dd", "comment": "Malware payload (Gafgyt)", "value": "f084404598a9be5854b7eec64bfdbf20", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267522, "uuid": "ae5748e9-235f-4346-bbe8-a72842708008", "comment": "Malware payload (Gafgyt)", "value": "6962e12d14559a5c5da7166c0eacccf280c42549bdb9a40b7fd59875e3fe35f3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267522, "uuid": "a93605e8-b0c3-42ca-b214-cd3ef59a6f38", "comment": "Malware payload (Gafgyt)", "value": "d4a8c91f602a65725271cda5863043cd28d838e8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267522, "uuid": "11071603-78e5-4efe-9be2-a11bd450da5f", "comment": "Malware payload (Gafgyt)", "value": "a89965f32451e3a8d74ab8956fdf2771e79762904a5e0eea1480e61eb6ebe39d918a04c6136abb2415e0218af7cb3bc9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267522, "uuid": "d4821f78-1ff0-4e10-a1fc-ca2efcbf27b0", "value": "T1AA934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267522, "uuid": "9cbd1fea-7603-430e-b192-18b1f865fd23", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3iphauH/vPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdiphaE/9Vog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267522, "uuid": "14249a23-9cd9-4a83-89b5-d0e1b41d33bc", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267522, "uuid": "1dd13191-8b05-4f12-98c2-8fe64561978d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267522, "uuid": "95321b54-ac65-43bf-ae04-bfd5455ab73b", "value": "f084404598a9be5854b7eec64bfdbf20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fff8c3b-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678286140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286140, "uuid": "f6c7fc9d-c41a-4587-8c3d-71697b561020", "comment": "Malware payload (AsyncRAT)", "value": "131c7f07d44536f058a67816c6edcb1f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286140, "uuid": "8caf52b2-0201-4bd8-8dd6-ae66eb5c837a", "comment": "Malware payload (AsyncRAT)", "value": "698705846fe1835b3614e24193f75d89165399d9b3d13d0cfbc83b07ab2601b5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286140, "uuid": "253c77e4-b8ca-417d-af02-86163217402d", "comment": "Malware payload (AsyncRAT)", "value": "10d89206f85ef55d69d0ad178586507317476e41", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286140, "uuid": "becc5284-0e84-4e66-ae21-9b4771640e74", "comment": "Malware payload (AsyncRAT)", "value": "68c606957c3cd5cc381695565273d8b6cf072924deae4c4de075bf6334d96bb3bf1eaec39c9ade27cc07656a6fedb870", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286140, "uuid": "1b18fa2a-f915-4b8b-b278-4d27c6fd1e72", "value": "T1267428032776C160D05AC9BEB972C636E2353C1DD621B636EEF04E123F28750E6B6796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286140, "uuid": "1efc77e9-25d8-4b97-a788-886204578c9b", "value": "9d63601b75db6820cb6e18c76c455c6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286140, "uuid": "52978998-3d4f-458b-aae4-1dcaa4c852e2", "value": "6144:pbtfMfzvhr3pEQ0lu74WJm7cOY5LJaq1hiMH9O1BNI18:pbMbhr3qdu745cOYPaqXiMo7IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286140, "uuid": "01f9dc30-236d-41cf-a0cd-8d85976962a7", "value": 339496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286140, "uuid": "7ce220c9-cfbc-42c9-882e-0cd44df4c6a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286140, "uuid": "4fa3add5-29f3-4d34-814f-20282f6ebd7f", "value": "131c7f07d44536f058a67816c6edcb1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecca855-bddb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678298513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298513, "uuid": "7e8367b5-daf9-4187-a861-3703e548ffb2", "comment": "Malware payload (Mirai)", "value": "7f7bbff626ee0efb7db9abc0945c536a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298513, "uuid": "6aaf5434-8acb-4f6e-9b85-d0a4282fee0b", "comment": "Malware payload (Mirai)", "value": "6a016b337332b1f3d3fab21bf54e6b6104c49fd8fbc171018b9aab92ab8a8c09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298513, "uuid": "32ab1d66-e614-47fa-8c8a-b16b2808d486", "comment": "Malware payload (Mirai)", "value": "e20934de604928683dfd9bc2bbc76ab0eae3c29f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298513, "uuid": "161df5cc-dd19-4dd2-8df8-6f96e12ae2d0", "comment": "Malware payload (Mirai)", "value": "99fee1809fb588b26c04bad585e327ffd053c932ffc5e1f6316f79860c4a42d193380a53aa42352e4fd3b46307a72bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298513, "uuid": "b6ebbc3c-86f3-46a4-8755-2d0a6514a645", "value": "T1E103F851BC829A67C2D1237ABAAE4A8D337063D9D2CFB217DD215B107AD651F0D23F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298513, "uuid": "d01e295c-c6ee-4b65-a156-23cc2ef0aae9", "value": "768:RgcfObMkG5XliO5nCJAVfJFhW7wjqv9NUv52P5FbUcmAhjdVrofDu/NWwW:R4bDG5XlpCJAZPPcEa5FVvsuxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678298513, "uuid": "15b56f26-fec5-4850-96dd-1da92eebc601", "value": 40672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678298513, "uuid": "3ed55434-1301-4a3c-a45f-69a3c3c2c80a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298513, "uuid": "67835a1b-0fcd-42c8-b209-ce8b9f3ee281", "value": "7f7bbff626ee0efb7db9abc0945c536a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783f6cf1-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261216, "uuid": "c50380fc-9ca1-4065-85ab-3a9123da3db3", "comment": "Malware payload (Gozi)", "value": "a25fd6398652e6f3e8b8b52ad56ccd45", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261216, "uuid": "b21da2c7-c570-44a1-94ad-dfcf7e906780", "comment": "Malware payload (Gozi)", "value": "6a11b49472e5ea497098f11ab66bde3fb6fa1a6762b73cf08f1dfa83efae22e6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261216, "uuid": "08b5aa8d-a772-4cce-929e-380ff9bde83f", "comment": "Malware payload (Gozi)", "value": "09853ef46474583df92630d5ed6d517e32b5cc85", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261216, "uuid": "aa8e16b3-9a80-4c13-94c0-a508e8d1fc9a", "comment": "Malware payload (Gozi)", "value": "7dde2c0473a27d8cbab19a5bfad24f42a27ee8fa4bc1586aefd18ae21c1ce70ba1a24f4efb228455ebcfd8ebe1521cd9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261216, "uuid": "06a553cd-a5e5-4e71-84ae-53352311404b", "value": "T1FBF0ABE04A19097DC12A87B9D0EAD261D0B2726601FB724F34646A686DC5F91030D394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261216, "uuid": "737e2d6a-fe6b-4f00-ab2b-f0544e4880a7", "value": "12:5jkh/cBa1DB/W3xqaFbBzb/1gMxfTjh/4Bn/mYFjB8dAJU:9kJeut/W3oaFb1BgKTjJa/bXiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261216, "uuid": "114e11f1-70b0-4eef-99d6-a99033c442b4", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261216, "uuid": "a30ae2ea-9cd2-444f-a59d-11c4feac9b1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261216, "uuid": "8e589af2-1d52-4bec-8a8a-6dfa8093e7a4", "value": "cliente.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599b8da5-bd87-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678262453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262453, "uuid": "39247805-e4d7-4776-97b2-bd46ff75e61f", "comment": "Malware payload (SnakeKeylogger)", "value": "8a68034d5e69b981a42326cceb0caf2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262453, "uuid": "14e18337-5901-40db-9005-a980969bec27", "comment": "Malware payload (SnakeKeylogger)", "value": "6b38029a4a148a0851ff3b6ae46eceb149154ac575836a7989661acf5a89d471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262453, "uuid": "06e6ec25-5389-4b9f-a9c1-90ff6980a923", "comment": "Malware payload (SnakeKeylogger)", "value": "fffb92aaea25bff214352cf8b4d6037ed27ddf53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262453, "uuid": "9c553396-dd6e-4dbb-b530-98329829bfbe", "comment": "Malware payload (SnakeKeylogger)", "value": "cd92210beaa1c8edef117effac53b633ef1447488ce0f65699c1b67e017177b07b4398fd68d85e7a51d5921364358413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262453, "uuid": "7546ed51-4035-4c1e-a008-89edb15786c4", "value": "T198C57E272FF5401AE1B3DF755AD450BEAB5ABF637A3D440900C21E0605E690AA8DD3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262453, "uuid": "4f484da6-d078-46e0-ba4b-a4cf26d63973", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262453, "uuid": "f23ff26b-efb9-4b51-87fe-1c3e37084e0a", "value": "12288:YPOK84a+jPtiYJ/7nN6ZwYCYliGstu6cFc2/SvZj+gY0+n3j2kdZ4qFvH7x7z5As:YGKwFiuDVKnFiuDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262453, "uuid": "06b67dc4-fbc3-4522-9d3c-fa18dcb6aae0", "value": 2727936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262453, "uuid": "fe1eac95-337e-4f36-bb35-c1adccb91c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262453, "uuid": "a35faf83-249f-4142-b24f-f849b4a98528", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb92bb9-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309034, "uuid": "f45a0283-68eb-46d4-8259-92ca6368e95a", "comment": "Malware payload", "value": "07ef4ad2461d0cdafd2113b8f7c7aa6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309034, "uuid": "70cc4105-70af-4e49-a82c-50b46d824ca3", "comment": "Malware payload", "value": "6b58715b6f88fa91e2fb481b8640ff8579023e5d586b2964fbeac6f5ec63d5f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309034, "uuid": "c7a8ec12-36fd-4bf8-b6f1-532edb579fed", "comment": "Malware payload", "value": "d2e712afec80ebc33dc523d4d70fec4c066a64ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309034, "uuid": "ddaca238-0d98-4bfe-a90f-93bc6dac82b9", "comment": "Malware payload", "value": "f48c071ed755250b7a6251b1ee56b768fe6eae96768d6a89ac1a97d12ff41bed1eaf0ff0d533bfee90eab3cc960ddffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309034, "uuid": "9ce1effb-1dc7-449a-8fc0-45c7c3eb7ea0", "value": "T175D5ADF08A52FF81D7AA1DB049DC19D06C9C1B9F85D8854CBCE86716E3E12A4AEDD1F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309034, "uuid": "d124826f-fe52-412e-8262-31520fb5df45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309034, "uuid": "0c28379c-2400-437e-a88b-d50c756d578f", "value": "24576:D6EmYLOxZirYlrwcL0ekwm5bwnKLAxDuuPepr062ZxSQK65e2MoymIBkAHJQZl9k:DgAYW1VjbKOS++mzOotqQgUJEJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309034, "uuid": "a93d9a63-f783-4bff-ab4e-739ceb9a921a", "value": 2859520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309034, "uuid": "3dbf84ff-24e6-4fdb-8c6c-c9fd764802c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309034, "uuid": "6993a486-ac13-4cb2-98d4-c107aaf69349", "value": "07ef4ad2461d0cdafd2113b8f7c7aa6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1420e582-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678282523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282523, "uuid": "bcaf6790-74a7-473a-a372-5517c403988c", "comment": "Malware payload (Smoke Loader)", "value": "c881ac87d4991219d60d44f220c8abb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282523, "uuid": "2492a045-dc86-4b5b-a1df-a69d1e4e8176", "comment": "Malware payload (Smoke Loader)", "value": "6bac8bc88052d93f098734d3f213bfa0e5c7912a4b699dcce2a51a23a0abbcd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282523, "uuid": "8b0c20fa-4dec-4735-9e2f-2cff086465be", "comment": "Malware payload (Smoke Loader)", "value": "7e0ea9a377ba227899faa3f2461407224fd5079f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282523, "uuid": "85de3254-95fa-42a6-a63d-bc8934b0a671", "comment": "Malware payload (Smoke Loader)", "value": "746cf32a8d6e44154dc8f65f31f82b759b7025aaa9ee2baf1debf0bf540051193b59a9a339e0010d3a58b91e38bbc618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282523, "uuid": "9706a7fd-e9b9-4185-b85c-8c7340be262d", "value": "T13C148E1253E0AC31E6368B718E3AF2E5262EFD615E6BE6DA32146B1F09B01D1C573713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282523, "uuid": "5c4c2cb5-7490-4b6b-b185-5ab72091bb39", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282523, "uuid": "17602cc1-ab47-49d9-a8a7-a2875e26daae", "value": "3072:cD8DnPm9Z17Edv1beJ47zIQPOdpAuPY2Srv9D+4W+F:nDnu9v7w1bvg8P2AvFfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282523, "uuid": "df9df500-a615-402e-933e-efbfb92e3e3c", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282523, "uuid": "227cf60c-04bb-496f-868b-9cbd7aa89d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282523, "uuid": "0ad9182b-05a4-48f2-a1e4-ee2095e17cec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3ce8d2-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308330, "uuid": "4950b4c6-351a-4bfd-82f2-8062585f2e91", "comment": "Malware payload (SnakeKeylogger)", "value": "6e5b44c83591a0f545c5e34f20615a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308330, "uuid": "adeae64f-e358-4f07-a35f-44fb1cc04005", "comment": "Malware payload (SnakeKeylogger)", "value": "6bb9fdf792419626fd6b48173ceffd5be560fc6d665246d304ada5b0f5f4a60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308330, "uuid": "a9dd822b-4540-44e7-83be-68153aaf6f65", "comment": "Malware payload (SnakeKeylogger)", "value": "71d8dbbd61e34f89a25aedd4f1944e007a2bf4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308330, "uuid": "802d6c1b-03e8-47c7-ab3d-1edbfb2f14e9", "comment": "Malware payload (SnakeKeylogger)", "value": "db696c77eefc3b1bacfad98e780c959be1eeee480d94157853572c300818f299fbb17e1add2c4e20d199e2f0d06dc132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308330, "uuid": "97e41664-ceaf-469a-827d-b5a8ed5d0c44", "value": "T179856CF08E92BE9097EB1D8480DC2EC05C5C1BAB86998548FCC81816E7F5594EFDE6F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308330, "uuid": "6c5c4f29-21ab-4a1b-9c77-c11415b7d854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308330, "uuid": "93f1083f-4f4f-484b-8660-c3afe26c330e", "value": "24576:WZs/V3lWGEROtOxO3cl0IRKLVLsWE/abKBA1yl/q69VNQBPfR4ib+5SVwXiTdr0z:mA1l+Ou5bPqUVNa3Ysm010z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308330, "uuid": "b2e9828a-5aa5-44ed-afd4-7607f9b70533", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308330, "uuid": "9c5682f8-4ae0-4812-84a1-b3c58b13a0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308330, "uuid": "632e07fe-79ec-42d5-87e9-10db9becd58a", "value": "E-Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007e33a0-bdfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678313414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313414, "uuid": "fd30ae54-45b2-4df0-993c-706cafcc7c9d", "comment": "Malware payload (Loki)", "value": "3ac92150577a7ef20ca70a00a739babc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313414, "uuid": "61d07df0-d552-43ef-ac78-b6d4050d030e", "comment": "Malware payload (Loki)", "value": "6bdb4084f28f803a608a4c7297cbf2ffc188744c16dfe0c6ffc718f00eb497ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313414, "uuid": "63ba019a-308f-4b20-82c4-9843995aba32", "comment": "Malware payload (Loki)", "value": "6c2daab0d32a410f0dd41bfbafced0662c78e787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313414, "uuid": "9ed12f1d-3bb8-40ca-bf5e-43155150d88e", "comment": "Malware payload (Loki)", "value": "5c64e73ba6ee3279888f65c47ad266dbfba9c7533f7ffafbc4c5041d276b43ec33ca903f6d22adee02a7c2857bb00005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313414, "uuid": "a22381ca-e45e-430d-8e80-6643c0a12fa8", "value": "T11F159DA56F19A257E7C1A1B31804DBB6FBACBD4D1426C0883EE13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313414, "uuid": "b8b82d3b-9000-4cf6-adbe-754a5537401a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313414, "uuid": "b930792f-730c-43ac-ae51-5a64d6416a32", "value": "24576:MtYNUfqBppHAlvRf3iA+0uAcUoXN38BSX1ufA:DNHlHAHyA+0uA3a8s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678313414, "uuid": "6f31cd0d-46b1-40a8-8318-947abf2fa24f", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678313414, "uuid": "aed6939e-72be-4fa2-8e33-1c8582b177ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313414, "uuid": "5f8967ca-0637-4a9c-9566-2f7ad67bf985", "value": "3ac92150577a7ef20ca70a00a739babc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade30650-bd4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678236396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236396, "uuid": "fe32c61c-cf75-450d-9ea8-9eb76be7c040", "comment": "Malware payload (AgentTesla)", "value": "21f7fd1bf4759b63e04892f4ecbdf0e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236396, "uuid": "7ce6ed9a-12d2-41a0-9604-e7284a957986", "comment": "Malware payload (AgentTesla)", "value": "6c53b530f6eb1312895a0818ca0bac5e28acffc04521284bf4d1168902fa3395", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236396, "uuid": "b495f286-ebbe-4cd2-82f0-112cec7b3eb0", "comment": "Malware payload (AgentTesla)", "value": "b49914222bd11ca626dd247f350b549d7d78692a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236396, "uuid": "b5d7d4a5-c72b-4431-9400-95abddbd9066", "comment": "Malware payload (AgentTesla)", "value": "2e161e8423f463c51750ea092ec58410e41559ebdcb94554ab77ead427cff0373af3fc77dfd2df5e776bd0f8ce2f52a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236396, "uuid": "476ac758-d58c-460e-a95f-26f250c63285", "value": "T121359DA56E096657E7D2A0B31804D7B2EFACBD4C6416C4843AF33D8FB0B9DAC0151E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236396, "uuid": "eedf5d8a-feff-4116-b745-b80b816fd6a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236396, "uuid": "8fba4ee6-d578-4164-a1d7-7b4d8fc1f106", "value": "12288:eDX3gBVmNUfqBe4EAsUVxFSsWN2HWFYHg6vpV8aSvkCRbuWlTXQPZIHF/EFH:c+YNUfqBpEAsU4sW28YAwt4SBPZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236396, "uuid": "3c24c67c-f611-46d4-9d16-6279730083c3", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236396, "uuid": "00151038-46c7-44e8-89cf-7e4eb089710e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236396, "uuid": "f00e2f8a-75f0-4047-a9ff-06bc768af704", "value": "21f7fd1bf4759b63e04892f4ecbdf0e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3e748a-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678275984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275984, "uuid": "aac0ca26-12bb-4b74-82b5-57237d159ea3", "comment": "Malware payload (Formbook)", "value": "8d986e6fc6b60c533d5a72dbef674d7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275984, "uuid": "701ab858-0245-42c1-83be-2d29609add56", "comment": "Malware payload (Formbook)", "value": "6cdf6cb265f77f14fa56a630f793bacf3e332db8d3ec583930c5f8c06e4ea427", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275984, "uuid": "3c113459-ac69-43c0-8cdf-9306dafd1f97", "comment": "Malware payload (Formbook)", "value": "fd798f989afac1afe44fb86cd36a2b9725095d6b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275984, "uuid": "61248aae-63da-4c8d-bea6-b125400362e9", "comment": "Malware payload (Formbook)", "value": "0692347761bb766ba0d57a8f087996300c8ea011cbd424415bbb27bf1e12fe1ec76013eb9df87ebc6ebd738a2e6db4d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275984, "uuid": "fdad62c9-760e-47d7-807d-4a71cb46ca24", "value": "T1E743956EE30F0965DF55977B434B9A4A06FCB22DB38540B139AC533837ADC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275984, "uuid": "137250f5-f4d3-414d-a333-e00121ef47b2", "value": "1536:OwAl2g7Btbmck+TN9bBc9SZfaMqk/9doAFYpT3UzUrVv09i85giO8+/AqZaVoNHl:OwAl20Dbmck+TN9dc9SZfaMqi9dLYN3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275984, "uuid": "c6018b85-bae4-4a39-85b2-5454fb7543c4", "value": 58087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275984, "uuid": "02fb33ed-6d4b-47e7-89aa-fe561139a8a3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275984, "uuid": "7ab8d47c-997b-4051-a865-9aa187ce5de4", "value": "AW8K393332.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af38ae51-bdd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678297386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297386, "uuid": "264fe5fd-7ee3-43d5-975d-b7c762b8f2fc", "comment": "Malware payload (AgentTesla)", "value": "6cb2ad56a92f050d6c0a1cc877db8cb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297386, "uuid": "0cdb7d45-0372-4767-a1a9-1525f1e1cb1f", "comment": "Malware payload (AgentTesla)", "value": "6d790c94dffa2eda7fd860cb26decc3f27e50582449a544428271b7fdce8f308", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297386, "uuid": "4f177918-df0e-4695-84b7-5de9b005bdf4", "comment": "Malware payload (AgentTesla)", "value": "df21ea833e67a92905d0b7959794dd0d0b5702ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297386, "uuid": "8ed2e4ec-9984-4953-bc8e-d3bb552da5bb", "comment": "Malware payload (AgentTesla)", "value": "aa7b09c85c5a7ba5620b551ebde431eb6aa36470791d1d0ac225d50e2806f3b52de3d8e85648ee87e931df5970f5296a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297386, "uuid": "717ce1ad-fa95-4a35-b4c4-f9e493b1b1ef", "value": "T14505493CF9766ACAE136F2738657E610F2F580F27311D8576EE2848046B0671E2DE61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297386, "uuid": "0b8e6d35-6cd8-47eb-b283-fff7f5fced36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297386, "uuid": "d969e2d2-2f42-47bc-a602-556350b673a0", "value": "12288:k30m+HxmH1RcxYu2gT4tcvB1QWzAc1RhwzinYlj+U+PakG:kv+HcfEVT/fRhfYlj+tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678297386, "uuid": "05235577-c828-42ad-a119-4a642835f96e", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678297386, "uuid": "e2285a6c-17cd-45de-83ac-87c948a212ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297386, "uuid": "470d470c-5e10-4b40-98d2-3394a951be41", "value": "INV01562-7500003124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0546b5e-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678263082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263082, "uuid": "11d9fa58-77cc-4760-baf5-1a754ecd7adf", "comment": "Malware payload (AgentTesla)", "value": "17e59ba94fc46773279a78f2014b8e87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263082, "uuid": "7b0b824e-b772-4cca-bc38-ec5a0005de41", "comment": "Malware payload (AgentTesla)", "value": "6dbd277a53e2c621a778a18ed9fc38ed556afc145683481aeb55301d1a574961", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263082, "uuid": "ee233c93-d83e-439a-973a-50f0b6f01bdc", "comment": "Malware payload (AgentTesla)", "value": "2bf9f2f31b3707a0a589f99e757f951c7747630d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263082, "uuid": "7bff00f4-3884-4905-bbdc-aee36cb183f4", "comment": "Malware payload (AgentTesla)", "value": "637e46d3a8bb56750259ae86665ce9df6967cf63b63956b8d20ff931371fc5d401ecde4ee82e6f881493f174e913be87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263082, "uuid": "636a515f-d707-4da5-95c4-e848dc19923b", "value": "T1AD158E9172B194B3F5CB016960287BCC2C3CB183B6D9E24B6A3779C096459BFF798E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263082, "uuid": "beb3d260-7f71-4a0b-adc9-8e7cb104629d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263082, "uuid": "4c64ac40-4efc-471d-bd35-14003185da92", "value": "24576:mKa3cOQGOPUtmus+6UFM8qeSgoePBfBf6/:4MRL+6Ue7N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678263082, "uuid": "fa56a09d-3068-4ef3-9cbd-145dcb1ffcbd", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678263082, "uuid": "53d0ef7a-7ba1-4822-9518-12d797a2f2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263082, "uuid": "5692d94f-8892-4e34-810d-9ce34d279c8d", "value": "PaymentXinstruction.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037f0672-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279489, "uuid": "862f2b77-21a9-4429-a706-8df8aee782e2", "comment": "Malware payload (Heodo)", "value": "520a11d709cfbc1637d48ab735e43974", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279489, "uuid": "ce08b689-c835-4ef2-b47e-d8bdcb33c306", "comment": "Malware payload (Heodo)", "value": "6dbfa32099629ee79a13edaf6976948541ea6aafd8fc9eec6a707a7dc04abccf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279489, "uuid": "9591fc36-3c43-4386-bf82-9019a3a16c2d", "comment": "Malware payload (Heodo)", "value": "c77de655da2ccf5537d0ae58d722102f9872f41a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279489, "uuid": "e198da9d-1315-4ace-b1a3-1f51c8f2a7ad", "comment": "Malware payload (Heodo)", "value": "9426dafb40c7794eaa5a54eb7ceedf7875e8dd002a964c87013a4bf9a449093afeaff9979a0a46f0366fadc43a256474", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279489, "uuid": "bab97b16-146d-42cd-8872-2e9f53317db7", "value": "T17B15233C5F67790FF5997C362AF3847AFDF90858DC96E90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279489, "uuid": "1daff8d8-d347-4380-ae66-e719874a4b43", "value": "12288:F4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sZ:6evtlkdJe4m19FgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279489, "uuid": "f467173f-6283-4f0a-81cd-8e854ef403ca", "value": 879745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279489, "uuid": "2bf311f6-e07d-42e9-91dd-de8f3dd4d10b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279489, "uuid": "5073585f-7149-4914-bf12-63ed5b895289", "value": "cn6C5a6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c26bf51-bd7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1678257331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257331, "uuid": "e8dfa8f7-3c28-41df-8fa4-c2ddc88548f3", "comment": "Malware payload (Vjw0rm)", "value": "b226987db14d44762e9ebefcda95e144", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257331, "uuid": "fac4e63c-ff6a-40d1-90c9-54af1c6a16b1", "comment": "Malware payload (Vjw0rm)", "value": "6de643d185952a9903ab06d382c4373e516329536734d90be309004afaa5ea50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257331, "uuid": "ebdaee5f-a1ab-42bc-9b5d-b9764d818803", "comment": "Malware payload (Vjw0rm)", "value": "d86eac68820c39703e52142d3bf450525a9f8d6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257331, "uuid": "1ae0d1a0-9a2e-470b-a346-d30091e7840c", "comment": "Malware payload (Vjw0rm)", "value": "1b79813077aedc1cf3746d758a62fbe5beb990272c2723d579e4a88894723649c7075a2b697a6f042e7ef15e16e5b0b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257331, "uuid": "2eb0be8d-1156-4dd9-9d21-604773a183f7", "value": "T14C81209C2C4B863C53D23B8A802ED14CCDF548B47E28D2B5148CDAC5360E97987B29BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257331, "uuid": "5360fd6c-71c3-4414-9f09-d8b1c13d479f", "value": "96:SABNo5DRk2c24ZRMHXE6/BIH+Ys+fJbEkDdQqR7bJyKhdOS4UK:zSa2c24ZRMlBIeYs+fJA6fRfap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678257331, "uuid": "d44ede84-55ed-4a6d-9367-e4a33a22ced8", "value": 3885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678257331, "uuid": "c2f01ec8-8cb8-4fce-bb93-b6ac0dfa1165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257331, "uuid": "2196c31e-83df-4981-8c4a-05761811be06", "value": "Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962a2f0f-bdd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kaiten)", "timestamp": 1678294767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294767, "uuid": "a5168fa3-05e7-49b1-957a-755483965cfc", "comment": "Malware payload (Kaiten)", "value": "1e2bb44cd88e4763db54993638472f62", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KAITEN", "colour": "#B38430", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294767, "uuid": "d37a064b-e553-459f-81c1-86362d4391ec", "comment": "Malware payload (Kaiten)", "value": "6de97f85f699d9b5cad1f236985f0d03439b01c82d364de4fa00b5ebbf5222a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KAITEN", "colour": "#B38430", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294767, "uuid": "d742879f-d28f-4b10-999d-b8d6f565c8c7", "comment": "Malware payload (Kaiten)", "value": "95190f32093c69a86a1156b78945006c15983191", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KAITEN", "colour": "#B38430", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294767, "uuid": "e565ac1a-106b-4e58-889a-18f9e40ca779", "comment": "Malware payload (Kaiten)", "value": "ee450e97376bebac6ed4c5a52ea02f5c97e09160c56f0086883571b0abcb15f1d59ebfe41b52766ac9eb39b5af6faa6c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KAITEN", "colour": "#B38430", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294767, "uuid": "5404cbff-c4c6-40a2-9cb8-b0fe94957c26", "value": "T1A9866C0BB6A354FCC19BC430476BD6A7BD70786802257E7B3694D6312E67F602B2DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294767, "uuid": "336e59f1-6ee7-47e6-99be-e151395591d1", "value": "98304:GOsnD+jP6i1TMsFKGGehF5Fd555555FdF5d55551ipi0sK0K0K0SxvSxvSx7kGda:GOsD+T6itMpo0ZdKq6JJA/p324ZdEJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678294767, "uuid": "3bcc657f-0411-43a2-b413-47b4c8093949", "value": 8261608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678294767, "uuid": "70d86e91-0d7b-41bc-8f84-47a18b728e45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294767, "uuid": "21895363-2d5a-4a18-acca-11b0e37ef552", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b742b6-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299196, "uuid": "4b64a747-d833-46b6-ac4c-61fefa5ccfdc", "comment": "Malware payload (Mirai)", "value": "598db319602e5186ab80262a9c41ccd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299196, "uuid": "fb51be27-aefc-44e6-b656-98862e0211a1", "comment": "Malware payload (Mirai)", "value": "6e30681119665ed2d7d8e4ddee029c3c7ef9b32451cf872d270129264027f4ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299196, "uuid": "824c4bc8-344f-4c90-b085-1e09073d90aa", "comment": "Malware payload (Mirai)", "value": "94715b61b1480c490dd5ced43386032405701193", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299196, "uuid": "f9d5b8b9-326e-4066-a795-baf9380e7858", "comment": "Malware payload (Mirai)", "value": "ca33e9ea504968e5e0175b8e8dd9484c4053c433b3c4fa61ecfad8f85060a5ab0066e22c875d80318c2a087eb74d0108", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299196, "uuid": "e08f7661-b838-4440-ae7b-ee911e2c82d4", "value": "T11573F756B8814B12C5C512BAF92E128E332317FCE3DFB2129E246B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299196, "uuid": "9d19313f-6212-4c01-825d-db91326e4c6c", "value": "1536:mlngjFJNDCYSmAiXyvEwC3HDXMT9dma55B0sIjiIOXEv9Gc75SYIWp:vFTDFsGzMTzma2OXEv9Gc7wRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299196, "uuid": "bd96e9b7-2c7f-44d2-b0c9-4fba86cf5315", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299196, "uuid": "2f67ff84-a8a4-4ec2-b0fa-63edf456b24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299196, "uuid": "e6f5018c-c133-42c3-9f1b-a851db7a5080", "value": "598db319602e5186ab80262a9c41ccd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0d7fca-bdc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678290939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290939, "uuid": "004e5b8a-f56f-4aa0-ae52-3fe7d4b57087", "comment": "Malware payload (RedLineStealer)", "value": "961ed238b446d027760f34a3cfd1332b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290939, "uuid": "f005e3e1-ada7-4276-84d9-fae24ca7bf3f", "comment": "Malware payload (RedLineStealer)", "value": "6e4851ea613a84b0f163d5f0ce7300d57283a2a734aa7ca002c4c9bb87d4f392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290939, "uuid": "1eaf65a6-30a8-4824-8a03-ec3cebf4e418", "comment": "Malware payload (RedLineStealer)", "value": "e1d552be4167c2d9b1952f7d600bb246bc0406ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290939, "uuid": "23c20219-af47-41c0-857a-10c39c3f52ec", "comment": "Malware payload (RedLineStealer)", "value": "03795fcd090c2b98fca1d5872b6324cddc840f8354b29655f7d924ce3080802a3de572605508ffd8506c2e02937e45cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290939, "uuid": "a45ebfbf-dd5c-46cc-a9a6-6df27ba21f25", "value": "T12264C01256F06C25F2729B714E39F2E42A3FFC615D6BF6D92214AE1F09B01E1C663712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290939, "uuid": "b099a5ad-a8fb-49a3-89ac-1211955068f5", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290939, "uuid": "43cff89d-7926-417d-82e7-3b2258a654b9", "value": "6144:x3k9HOp0U/S91z2xqrZvGjIcpiL8JYwdJ4qLmUPo:xSup0U/iz2xYOjIQy8JYOBLdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290939, "uuid": "1dbae73a-5419-4f00-87fd-eeb28a31b097", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290939, "uuid": "1db52c17-a5ab-46af-91c3-8e3a338d37bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290939, "uuid": "9da3b698-3bf7-4203-9ef0-973a052242f1", "value": "961ed238b446d027760f34a3cfd1332b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4810bc-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284763, "uuid": "13b4b7b9-bef3-4710-aff8-3939ea998249", "comment": "Malware payload (Heodo)", "value": "cfab9e520074708173d255ae761c7ae5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284763, "uuid": "071ddf35-8c1a-4063-9517-357c2e4be97c", "comment": "Malware payload (Heodo)", "value": "6e86f499810d84142bb1c218a77f54868163cab54aeb70477ddbbe9a40694887", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284763, "uuid": "dd62bd05-c1b3-4d53-b051-1c52d28d28e5", "comment": "Malware payload (Heodo)", "value": "0478f3c56e4d4a16f15f5b0b2a6e18c6f2dc8709", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284763, "uuid": "93683179-e43b-4100-828f-3b391110c80b", "comment": "Malware payload (Heodo)", "value": "5de513ee816ed221367d71ab81f0ac133d48590e838ae30e2e1077bdee72882972ed105ab4ee67249863bcf6a0ae921f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284763, "uuid": "555d111a-b220-4854-bd06-1f4407e94bd2", "value": "T1FD15233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17432A9209AF2042794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284763, "uuid": "5943c0b0-cac9-49f6-89c8-27d55a6d97b0", "value": "12288:e4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sh:JevtlkdJe4m19FgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284763, "uuid": "3341bc30-fdc1-4a28-8cb0-62d170611f21", "value": 900134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284763, "uuid": "ab3fb603-6339-449b-8800-d236c4881491", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284763, "uuid": "946a5b71-3958-487f-b088-60e369fee1eb", "value": "cExf0JHW0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce07acd-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299154, "uuid": "abef990a-50c0-4af0-8a13-8bdb912088d2", "comment": "Malware payload (Mirai)", "value": "647578dda7eeb67e34ed6d7f8db8c51e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299154, "uuid": "5a08cea7-2229-48d4-b572-dfa7a8049e6b", "comment": "Malware payload (Mirai)", "value": "6f19fb3b28cc22d50b71e256f8a2b117dda590f49fa5b3d69aa853d863760c3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299154, "uuid": "762cd9e3-8db8-4021-827a-b0c1a17fa37e", "comment": "Malware payload (Mirai)", "value": "550f31cb82ba95b76bfda5fc0efd741912075a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299154, "uuid": "061598d0-1804-45c8-a205-4a65a085d949", "comment": "Malware payload (Mirai)", "value": "a31d33258eec7335fb9ec81262b2c3acae6e431eebdebeb9ed9f4e99498920b40798096931918c219b376f10f33f6560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299154, "uuid": "94765712-13e9-4f14-acae-8d8beb400ee9", "value": "T19A535B02B31C0A07D0A31AB0263F6BD197BFEAD022F4F688651F97999675E365181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299154, "uuid": "bc89ac01-00b7-4e88-9b7a-9cbc14578127", "value": "768:25Zf8gSoVZRyfRTve/7im5ijkRIy2I09/h9eSjEv2kNQ5NM8Z6FV+tQKwWTI78:yv09bm5zIjh9eSQOkNQ5NfZe+aDWTY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299154, "uuid": "6d7fefab-f0d5-44a1-8597-590b6b2359bb", "value": 62932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299154, "uuid": "dc9d79f6-303f-44bd-b5ee-00f155d849bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299154, "uuid": "7c66a6a7-8fa1-432b-8f43-ab0c0303901b", "value": "647578dda7eeb67e34ed6d7f8db8c51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bb4b3a-bd5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678243809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243809, "uuid": "88c5cc45-ba2c-4dfc-825c-3b8e76b956c4", "comment": "Malware payload (Mirai)", "value": "72dd45c47587baf95a8ff454fe657510", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243809, "uuid": "29076106-85c7-489e-acfc-799a3a3c9d67", "comment": "Malware payload (Mirai)", "value": "6f8c7c7b96c0d477cb50bfe9ef96b0282fbd095944c04f411d18a470765a1bb9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243809, "uuid": "be7a23e7-80b4-44c4-b486-185c325c631d", "comment": "Malware payload (Mirai)", "value": "5a655f05e185fc3f0cfa8640d2f22202217569c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243809, "uuid": "97d000f9-ba61-42f2-b062-14fa45153ef8", "comment": "Malware payload (Mirai)", "value": "5fe6dc7f81a80490f1d38f6d4b96db58933c6ea8c151fcc4b40e7bab2f478421634f9e3d19b617b4f97c01d765bd2bc4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243809, "uuid": "43a1587a-42fc-4565-ac16-e04ef61502f4", "value": "T1D3A2D015BF18868BC832297455D9EAD21256FC61F3ECCC192A80D15FF5A33A92870F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243809, "uuid": "348c3184-f678-4814-a9f5-2d0cd89abe94", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKr:M98o08kxofBE+ZkXaqGbp2F2TWul0c5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678243809, "uuid": "d532d9d3-44aa-444e-9cba-d0585affbe30", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678243809, "uuid": "c0ae5a93-0232-4b82-94cc-b8ab652b6b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243809, "uuid": "5350925f-3764-43db-95fc-e4169b34b68f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6abbb43-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247604, "uuid": "ff4bfb18-74a2-46d5-8f91-5cf39134c681", "comment": "Malware payload (Mirai)", "value": "a30f41203cda33782ba43a29de9bdaf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247604, "uuid": "86b33ad1-38b0-46e8-b492-3e76cf50ffb9", "comment": "Malware payload (Mirai)", "value": "6f8d027ac9a3a87ac3d647db04159b9bf802f42e748ad3453f84d0494e12f507", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247604, "uuid": "e341781d-bed2-403a-a35d-5b0ccdee78a4", "comment": "Malware payload (Mirai)", "value": "937d0183d488f459d1a19a3d8c5b87221e8432dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247604, "uuid": "e3167ce4-70d5-4ce1-b316-9b77d9c5739d", "comment": "Malware payload (Mirai)", "value": "803882e996122d919d5324185852cd9c01c8947a7ffd8faf9ab5a0af441287fc95df6cadff8e99ffa5d3e80848d6d0d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247604, "uuid": "d0e2aaae-4d72-4c13-9e0a-d9a9f88810b4", "value": "T1C633FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247604, "uuid": "a4b2d82f-8ebb-401a-b933-7ecd23fb8038", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGn:r/hqaJMcjeqK806MHdMfQXoHuCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247604, "uuid": "4f0cc422-d566-46d2-9805-8591546e964a", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247604, "uuid": "3df30bd8-5912-4435-88d7-4ebaf0740004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247604, "uuid": "a10a9a88-8649-490a-bf8d-afe591cae71b", "value": "a30f41203cda33782ba43a29de9bdaf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df69f044-bde6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678303480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303480, "uuid": "476f764d-2665-4b60-817c-1fef776d98d0", "comment": "Malware payload (Smoke Loader)", "value": "a5f058b1c1a2c24379d88c262024ae9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303480, "uuid": "ab0bbe6c-e5b6-46dd-9d73-12c8197dc437", "comment": "Malware payload (Smoke Loader)", "value": "6f8eb4e3c8240ae778f371c9c702a6091f7dda83b67debd802aeed4d9ea08620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303480, "uuid": "b5764d02-9183-46c7-9332-77a0e991e75b", "comment": "Malware payload (Smoke Loader)", "value": "13cf62e66bac9fe044b543fc2c9511ac190754b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303480, "uuid": "9f6f13ba-c9ff-4728-af71-027ec7cf95e1", "comment": "Malware payload (Smoke Loader)", "value": "fbe3775992a6b6cc60fa5ce93491cd7877250065f50553cd5dbfb869bde4318365a8542765497282ece679b3ae8c88e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303480, "uuid": "7da4d92a-924e-4100-87a4-421ad4952ea9", "value": "T17B149E1172ED6821E5720A315E3EC2E4672FFDF39E2966AB32186B1F09B12D18573713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303480, "uuid": "afdcf78e-818b-42a7-ae2f-bbc1e75919b0", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303480, "uuid": "e91b1e88-833e-4d61-8c4b-8dffa5f9ab24", "value": "3072:zJ3wTRX24eWxZYIgAXs4P0+eht6zxijkgzqWYNImH2sVdIH52c:GFXveWxqIHPtAIYzqBWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303480, "uuid": "3c709787-2a2b-419b-b913-397da89baecb", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303480, "uuid": "dba2fa09-422b-4c56-bc3b-60778a457b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303480, "uuid": "9deb87f2-b009-4e56-b175-ad74b58d5b75", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3b9e7a-bda3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678274615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274615, "uuid": "eb983cad-0d4e-4b5c-90a8-a35132c4b877", "comment": "Malware payload (Formbook)", "value": "82c9a5f1e5215ce3e1d571a5725c038f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274615, "uuid": "cd1668eb-7483-4bf0-a80c-6e501270f0c0", "comment": "Malware payload (Formbook)", "value": "702acb0430f103fa80b26f74c5a6beb1de35b6d3779ae6568fe17ac76c0b980d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274615, "uuid": "a0c4460b-6acc-4f2a-9987-3d6d9020c0f2", "comment": "Malware payload (Formbook)", "value": "d74cee87fd48e1708bc0f9b69594fb1451cedf9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274615, "uuid": "22909b64-a5dd-4ee2-855d-d5a284869f40", "comment": "Malware payload (Formbook)", "value": "8bd174aceb8622199bd3eb7cb01bd6e6dd47ef52dfce2953cf3d2b86e1ef41cf82f2aa69ef3df9e1719b200341a380dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274615, "uuid": "01e173ae-8aa3-4f05-a4f2-199d38bdb45f", "value": "T1090423484DDAC323C3BE85F0A82E5179D9223F2E54753881EEB36D71D08E6EE70A8D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274615, "uuid": "b6b6e403-36ca-47a9-96ea-4625031cfa7a", "value": "3072:AOf5H7753mJo6uw5lTVHJuvVvFbDo14V4kDCpBlHTSHlMJgZCtdr1Gg6WZ:AOhHtm9uiJuN9gvBlGFMekfpuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274615, "uuid": "94bd543a-3c01-4a5c-b4b3-efc2daa678a6", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274615, "uuid": "af43f488-fe69-4267-aeae-a3c9b3a18db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274615, "uuid": "04840160-f360-46bc-a8ed-776d7ad9e449", "value": "702acb0430f103fa80b26f74c5a6beb1de35b6d3779ae6568fe17ac76c0b980d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adab6019-bd9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1678271614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678271614, "uuid": "da7b1ec3-8830-4cf6-b46b-6c1b6b587dd1", "comment": "Malware payload (RustyStealer)", "value": "cd12cb026f70700b6d7d3122360c52e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678271614, "uuid": "73527b42-aa79-4e4d-b9fe-36f9ccbc1f93", "comment": "Malware payload (RustyStealer)", "value": "70805738871f24f390c7b1e62e6b48bc4850399992d8b62bba3160550a0a3655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678271614, "uuid": "0702b9ad-9aa1-4d96-9df4-566789b1322c", "comment": "Malware payload (RustyStealer)", "value": "b944514f2b56e27a9b5e26316f72fd9fec8aa94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678271614, "uuid": "fe1c8ce5-990c-4d5e-9b6a-aab6f94f66b5", "comment": "Malware payload (RustyStealer)", "value": "85517f8df174ea2d759497cc918d6aee583f9001dea6399ad21475ac8ce90fb19db8b3a06c3366bb0cf1eda9de9b93d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678271614, "uuid": "e8dd79e9-0c8d-45bd-97ba-01ee27064da8", "value": "T1A8E58C43F69445EAC06AC274C74B9627FB72BC8A0720B7AB56D456723F63B601F2D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678271614, "uuid": "2967e338-5847-46da-bc54-43ea8238489c", "value": "07d6165a937a57fe512cd3fff119e68c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678271614, "uuid": "1f2ed07a-32fa-4f12-b032-c87d52271633", "value": "49152:T5wh59b5nEKS6JKokJL06d4vD9GJjq/5qS3mynxdD4/7AQxDy:TUnuxBzd1IgYmoIfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678271614, "uuid": "cfe2766b-8a98-4364-9d2c-577f89129527", "value": 3288576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678271614, "uuid": "a33a8a64-4e0a-4402-9e71-25867c3158e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678271614, "uuid": "89ef26ec-11ee-4ead-9672-efe34147e945", "value": "SecuriteInfo.com.Variant.Tedy.308647.10806.1440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5049d5a5-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268021, "uuid": "4712c593-9fdd-4440-b398-653f02254b75", "comment": "Malware payload (Heodo)", "value": "fdff33dfc9218080b5ba5e2b9258c6e2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268021, "uuid": "47c2b798-d7fd-4cc6-af10-4f8239cab472", "comment": "Malware payload (Heodo)", "value": "70a3b6b361021c1f0a93c8251b89529e8f66e66aab79cb3ea7710c7cf8bca30c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268021, "uuid": "c16fbfd5-f163-4f6e-90c4-bccfa2799e63", "comment": "Malware payload (Heodo)", "value": "7121a4de1ba219e84b2dceef6e114ebb5db2345a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268021, "uuid": "636c3c0a-a1a8-42b5-ae0d-aebde7d7e694", "comment": "Malware payload (Heodo)", "value": "5780cb56392fda01ebd2dd83ecad92e2127307e473345da897cad4d3f8bb54700bbe88e66a7163fdd2f505cbe65cad82", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268021, "uuid": "00bacb68-d6d9-40d4-88c3-45a25e32bed6", "value": "T1BD15233C5F67790FF5997C362AF3847AFDF90858DC96E90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268021, "uuid": "c54d3891-08db-44f8-80b9-a3b3cb5ff729", "value": "12288:s4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s+:LevtlkdJe4m19FgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268021, "uuid": "8ff41d15-27b0-483e-8af0-e4a2ca326f3e", "value": 902122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268021, "uuid": "d156b02d-bdd2-406b-989c-0b4d34ce452f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268021, "uuid": "89165b0c-1609-4577-8d2d-92cd9c3f73d2", "value": "84oljGQtqAoAx0u6HYzVs8nqkHMJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e4ac51-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309549, "uuid": "7f6229c2-fb08-483e-bf83-8758bd5d3170", "comment": "Malware payload", "value": "b9a5c81c0e9dda477f9d5fa1a944ad87", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309549, "uuid": "afe49f30-48d6-4c57-afff-8da358bdd3c1", "comment": "Malware payload", "value": "7166dcc58ddaaa984ca15df83285a659443502c608c2290f3b4578b407e87d22", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309549, "uuid": "ace6d663-5197-4b35-a458-d2a15e1e5cb5", "comment": "Malware payload", "value": "641eed472c99d998e7f4f42fdd4e058d49b609e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309549, "uuid": "b07ff050-db64-478c-a7fd-1ab3d40dac75", "comment": "Malware payload", "value": "7d47f10ac7bf325b3de891985355543b363961c9cb2336300424278a91f2eedf1147421a7d3345c3bc0c6fb1c6e1051d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309549, "uuid": "f820985c-aa82-46d1-8692-0169c827030b", "value": "T11655AE223386C233C96E02B01A2ADB5B5579FDB24B3554DBA3C82D2F9DB44C25739F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309549, "uuid": "50351b42-ee2f-46e5-9c6a-8f83172cf548", "value": "24576:YXAxLNJYB4cW7LIJ1MXCOJ05YbswFbQ2d7xLZrudqA:YXcJYZqbCOJ05Yb595zLZrudqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309549, "uuid": "c4ddfac0-ae44-486b-8cbf-0824c888b515", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309549, "uuid": "b20e0eb5-376b-4a64-bcd9-92db5d52dbf8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309549, "uuid": "eff29f98-7570-4bc8-bcd7-4525385ba29c", "value": "N2yyiafum9z.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d426db3-bd9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678272633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678272633, "uuid": "f5a9dba7-90ff-4559-aa5c-5d4535b89506", "comment": "Malware payload (Amadey)", "value": "33336756d7d369ffdf8ed7b65ca526ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678272633, "uuid": "34dcb81c-c769-4f90-acfa-4ba8d887775d", "comment": "Malware payload (Amadey)", "value": "717755cb7dddbde4e40cb611a3406baf9b4485c0a6556ed429b836a4d4a3e79d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678272633, "uuid": "4dab3c9a-778f-4dd1-8084-dda7f4dd1bec", "comment": "Malware payload (Amadey)", "value": "95be9a32dc23626889c7739cc287352e73a6ad2b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678272633, "uuid": "7de2be76-c14c-47c2-90fa-9345d0456fb8", "comment": "Malware payload (Amadey)", "value": "6a13abc7f857245e01a68f06b137d3e4d3ee9a2a1e421b72d5a68f3c2d1391c2f84c5ba00588bcea37fe570b84c3784d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678272633, "uuid": "07dba840-5a91-4ba7-85e2-e2503e1b3fa6", "value": "T1A53408217D16C031D56051B629B9BFF2C19DA825ABB049DB7B800F77DA122F67A30E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678272633, "uuid": "2a3b7dc1-8486-46a8-81b7-b601824ca651", "value": "2017e441801511e85de5448e96ddce01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678272633, "uuid": "a4c50b63-dba8-4323-8289-1f13e7a98d35", "value": "6144:f6KM18xAQYRHij5yetq1+Gvuli30oNC9ci6k:CN6yF1tuli3l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678272633, "uuid": "043ff193-8ebe-49bb-be08-60128d1f6d65", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678272633, "uuid": "9e3b9ea3-6ddc-4918-ab64-17a45a85be1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678272633, "uuid": "dd12bf27-69c6-40ce-8ffc-09c29fcd1474", "value": "717755cb7dddbde4e40cb611a3406baf9b4485c0a6556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159afa13-bd71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1678252890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678252890, "uuid": "244d3699-7aae-43d5-b555-d11a37afc810", "comment": "Malware payload (Phobos)", "value": "8f7bc58c754d6fb7bb0b31fe8a5821e3", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678252890, "uuid": "ad5bc5d8-cf61-419f-8fb3-76c5002f2fb5", "comment": "Malware payload (Phobos)", "value": "71b46e95fba31267475537a338f49ce1cd0bc56c0f15346b05b673051cbe90a8", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678252890, "uuid": "169f1959-65c0-4e61-8ad5-6c58acc48001", "comment": "Malware payload (Phobos)", "value": "f2dccd378d7be5e6bddbf133a78369fdc800432b", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678252890, "uuid": "d857c715-63aa-44ea-8041-7f3cf73bc58c", "comment": "Malware payload (Phobos)", "value": "d3cf3b36cb56e2f2cfa550119841ee63e58d27ce928ff4e0e6a70a7777d02ee696dc5aad081078868327b2774e0e13ec", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678252890, "uuid": "996f4430-7937-43fe-a199-2b8ce08578cb", "value": "T1EB43C00A706A50B2CE664670153B2F5F4FFBA10540B4445B8F7D4E9A3ED1172EB3A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678252890, "uuid": "c186b899-69b3-419f-bd55-dbbfdbbf1f6b", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678252890, "uuid": "ba267ff3-b956-408d-8c92-1bdfd780e2bd", "value": "1536:vNeRBl5PT/rx1mzwRMSTdLpJ//OGCDmR+53H:vQRrmzwR5JLCKyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678252890, "uuid": "8830ab51-6104-4967-97e6-232032af7358", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678252890, "uuid": "6652d013-43bc-4aa1-9509-55d0d39bb7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678252890, "uuid": "9507901d-4a4c-4851-9404-e3a194d499b1", "value": "WindowsUpdate.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d877f047-bdac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678278558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278558, "uuid": "5c600ea0-5d8d-4a8b-84b1-01e38f498445", "comment": "Malware payload (RedLineStealer)", "value": "1e927277321ea1ad6ea6adb21b93ecd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278558, "uuid": "bcbf70af-68c7-451f-87fa-ef6fcb92dd8b", "comment": "Malware payload (RedLineStealer)", "value": "734ea8ecd523dc64cca5a8c4c0541bef85d30caff7c5f90c68071716ed1f9957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278558, "uuid": "d0ad7f43-e1e9-49c2-9558-4fd023ae5003", "comment": "Malware payload (RedLineStealer)", "value": "e9f631c34c72ba0ea2cba5e8a43a5e25971a7960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278558, "uuid": "4cd1db8f-07a1-42c8-aa9e-f8bda447e52b", "comment": "Malware payload (RedLineStealer)", "value": "dae93533963e1b33544c09491231b543778ef00f46bab4840605dd88f9b8d610682c1c8b2cc59980b651064752596620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278558, "uuid": "4625748a-df37-4d44-80cc-4892a38be39a", "value": "T1C1C52B139A8B0D75CDD23BB491CB633AA734ED30CA2A9F7FB608C43959532C56C5A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278558, "uuid": "9aa2f51c-7479-4257-86fe-9befeb462060", "value": "aa69aa26982c04df6d44383c5ed7f778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278558, "uuid": "77852efd-8d92-4253-9a26-78c57f04aedc", "value": "24576:eOuJEYEHyIvTv3YlYhIEY3uuMfqdKrRNFPVHKyako+LhVag+eyjtLjHuvLl3RuQi:LuJxESIvTscrDakXadeyjtGvLl3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278558, "uuid": "40591dc8-5637-4245-b12d-f9bb0ced2c1f", "value": 2737041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278558, "uuid": "a79b35c4-4e01-4651-b196-2313508bc57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278558, "uuid": "7cc2d407-468c-4908-92da-97e6b001e254", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcb03e7-bdcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678291827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291827, "uuid": "3004b321-89ba-4e90-80ef-712bbe6c2e84", "comment": "Malware payload (AsyncRAT)", "value": "8f3db89faf3271a6411c1ba85469809e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291827, "uuid": "6fff08a0-4eb6-45c8-ad5d-4e6c1c9b55f9", "comment": "Malware payload (AsyncRAT)", "value": "73bd75310c7d227be8a35416785e4fa58b79796bed6fdccee63c8a73628173dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291827, "uuid": "ca8e9abd-65ab-4fc9-b9c2-bf3cf3b59d0f", "comment": "Malware payload (AsyncRAT)", "value": "06165cfd91035e9624cc15dcc1c6598d186f2ba8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291827, "uuid": "0f3285ca-e469-43f6-a844-7298d31bfef5", "comment": "Malware payload (AsyncRAT)", "value": "113a4d688b4a05a239afdab92cf2081cd34eecb412a446b436bb8d3860a2ecc765076f57dd6ea486db72dad896090841", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291827, "uuid": "725d8ec8-8184-464e-a3dc-26b09b8ae2c1", "value": "T1AA25475B623CC0E3F88E7DB5091687DA2970ED866230E127D22F7EC1E6771ABE5441D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291827, "uuid": "2032d361-8e94-47cf-b658-f52ca47a8f7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291827, "uuid": "e6d84237-c504-4ca4-9254-337d8c8f6791", "value": "12288:IJEP78/2iNAKgleITsf5C9btwlIjjIgWh/lfgiNLnY5wVxPMFVt25+ZmlkIup7cc:kEP78/17AeTf5otnOxvNLYuVS58WIuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678291827, "uuid": "c8a33131-e837-4e24-9092-7ed6522d6af7", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678291827, "uuid": "108cce17-9626-4627-baad-ff5190a65a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291827, "uuid": "1b124aaa-a6a0-4792-b484-f774adea0e7d", "value": "PO# 4510225181 & 4510256792 V# 10089847 CAPE TOWN GENERAL TRADING F Z E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca996689-bdd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678297432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297432, "uuid": "adff0811-fb63-4ab1-95d1-f5ff05bb6ccb", "comment": "Malware payload (AgentTesla)", "value": "f432ab7d85b162d0b7d191c32aae24d1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297432, "uuid": "91095e48-5eca-46d8-8207-abcc5c064b81", "comment": "Malware payload (AgentTesla)", "value": "73f80947cae005104a0434fc31da38386e4d84838f2547d745e3fd7abee0eb1f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297432, "uuid": "bd63ca3a-8ac2-4177-b42d-36183b4c679c", "comment": "Malware payload (AgentTesla)", "value": "6bce4b1b67002b4e8bc5267118c1092bc18917f8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297432, "uuid": "201ce4d1-291c-4d6b-bdb3-14cc1bf2a43a", "comment": "Malware payload (AgentTesla)", "value": "59f1c5ddb67bd5a32e79c33180368646fabf9191a6cce360171f3ea2881e708dfaa0dd20a3adff2a5118c6e04885c3fd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297432, "uuid": "567fb97f-7536-420a-8b8e-fa07b9f9adae", "value": "T175C423EDC31A5CEA7D796100D3A6C714A612C63C8B464F4724BF6CDA8850EC639F97CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297432, "uuid": "73651601-8ca1-411c-9399-0409edd3d9cc", "value": "12288:YPKEJ1VcHHuZQCRJcAI1Q9zBc1V0szA7YWjwU+Paz0e:YPKA7NKCN0V0pMWjwBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678297432, "uuid": "69583f92-92e8-4bf9-9695-b87643f1ac29", "value": 575224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678297432, "uuid": "168d7cc9-5d1b-460c-8ee1-7ee2eb420a62", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297432, "uuid": "de8323cb-a6ea-42b7-a7f1-d2968d1f9c47", "value": "SMC 15 INV01542.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4506fce-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678286309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286309, "uuid": "36684155-b6c2-49d3-ad38-063ded66c646", "comment": "Malware payload (Formbook)", "value": "075fe88eeb54af3881e5fede625bd319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286309, "uuid": "21620ca4-65ef-4d79-97ed-dff427e17b96", "comment": "Malware payload (Formbook)", "value": "7444076452ac7a4117951614eafa9552214d8b61650f8fdbc83c5de230058b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286309, "uuid": "42ef1a78-ee60-4e5a-86a9-f919fc821ae5", "comment": "Malware payload (Formbook)", "value": "192c3468970e2d9716f97ca818e3b3bab748a322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286309, "uuid": "05b74766-fe69-4cee-8c4e-fea8b7b2ab15", "comment": "Malware payload (Formbook)", "value": "765dfca00395d44450e4a65c50675b29546a20fd241ae0ae5999233b828264bb02832ef8318ff629fdc53eb2e2adbace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286309, "uuid": "c4224f40-e3e6-4ef4-af4d-63f977d9df34", "value": "T1AD25ADA56F196257E7C6A1B31804E7B7FBACBD5C2426C0883AD13D8FB1B9D2C0111E9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286309, "uuid": "aed909ed-30c4-41a8-aa45-97851c809f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286309, "uuid": "02043710-268e-4b8e-9e30-a215d6fe2ad3", "value": "12288:a4X3IBVmNUfqBe4uM5P7o44rLIYk9PcviCnZe/VtomCWhQZ6LCKk1DEOtpvt:xGYNUfqBpVJo4UBbnKjCKQoCKwHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286309, "uuid": "719002d8-c8f8-4be7-a7e1-1fee53a3e0da", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286309, "uuid": "d7c94482-061f-40d5-8f16-715b44a5d212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286309, "uuid": "dc6a64cf-c9a4-4750-ad83-6f34581d467b", "value": "OS&E- PO# X346-042 PARIS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0b20f1-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309435, "uuid": "e2ae4832-5459-40d0-b0a1-f68774e300b0", "comment": "Malware payload", "value": "3ef25c11bafb3cf2f82a97c7b53501b9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309435, "uuid": "51164ef5-bf49-4eae-a5b9-6d59beb77538", "comment": "Malware payload", "value": "746364b0b40c3de84792b673b27f4186795310f803cd00025331af3fa13e4418", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309435, "uuid": "d3b5c205-3a0f-4ede-8e2d-e54140bbb5a8", "comment": "Malware payload", "value": "5b03018cd731d20edd5e87b0ea87e8b149ec3bf9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309435, "uuid": "ba116b61-fdf7-41cc-92f4-14a062beed74", "comment": "Malware payload", "value": "890fec525ffd64b32ddb600a285b0de030083027e07e716bdd005df6f9f55479523e105458963aadcd67043c2120a3a3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309435, "uuid": "6c8c7269-f473-4e02-a10b-396c1988b6ed", "value": "T1B353C2696E58C2C8C1326FAE8F4E47BBE35735E741B3406429CDB5E609503243B9BDB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309435, "uuid": "7d4b387e-8fb7-4dcf-8eb2-798d96685228", "value": "1536:bVF4TPwGmGnlkDLMoloAaPhZ0fSVaXUzg:b74TCGnKDIyo3PhZMkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309435, "uuid": "a43d6fb9-f330-4a2a-9b65-132d3b139071", "value": 61132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309435, "uuid": "775081ed-f381-4629-9546-f1b8a36c93cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309435, "uuid": "7f46416b-d759-4375-b5b2-e6d117991135", "value": "739202_931_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e687cd50-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309076, "uuid": "92b47136-d94d-404c-aa0e-4e0de89e5730", "comment": "Malware payload", "value": "d7e0ed7d9e7e797d111d0ea4143e65df", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309076, "uuid": "e0bd25d3-d166-443a-914a-9fccf9c8d580", "comment": "Malware payload", "value": "74dae10a3a654d1e7ec91d70cd2fb6023654643d0489fc3c3832335189789f1e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309076, "uuid": "3ff79fd2-37b1-4d9e-9940-849ce66e34cf", "comment": "Malware payload", "value": "0782b7f50756beb495ae2ab0119474b78e327212", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309076, "uuid": "5aa56e7b-0e50-46f3-ac93-8f457c914309", "comment": "Malware payload", "value": "88f7669cdfe8a259f5d246c9deffe352fb38fcfe545abd324f5b58f6c54b4ae8d5dea6ada8358c1a0b2d30eab4d8b361", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309076, "uuid": "0f37428e-6b5f-4b37-9e8a-4188ff90a00e", "value": "T19555F1039238AD4BD101C7BCBA6F7559110EBC3631C1A98A364DB74B5733FAA5ABF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309076, "uuid": "32718cf7-1874-4338-822a-145153c66e60", "value": "24576:tLKGABQtHlxjWQmmav30xXB3ItHlxlWQmmav30xJ6YkUf7J3VAfxJ:tLKR87CQmmQ305R27kQmmQ3076A1VAff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309076, "uuid": "d95f6282-1507-4969-ab31-c38e05cbb487", "value": 1287680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309076, "uuid": "51771b74-225f-448a-a1f4-b3e4eaa8dee0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309076, "uuid": "bd79db8b-c2e8-4cc8-9793-28fb54cd2c3d", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74ed121-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309426, "uuid": "18ad42ba-a56a-47af-a34b-95ff82473ce7", "comment": "Malware payload (GuLoader)", "value": "959eb0497382b100e29b5ccd83150823", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309426, "uuid": "049d3664-7c74-4ab7-8b1c-35530d306701", "comment": "Malware payload (GuLoader)", "value": "7523a2c16734d4b5ab66720bc7916ee37e48881f81bb35b0a40e87d38f4f51cb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309426, "uuid": "6ec91cc2-ae2a-46d5-ba40-329925bb4796", "comment": "Malware payload (GuLoader)", "value": "69be38642169607f54fff0347acf5c419f80102f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309426, "uuid": "130cc004-23f4-42f2-b7c2-cccfc799a6fb", "comment": "Malware payload (GuLoader)", "value": "2f539a325b51ff95c24630604eeb31d92aff5ebfcc92aa52a0ecb628939cb71d5def197a6a6487991431a59aaecbc5ed", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309426, "uuid": "de112b3e-6589-4cf4-8450-a123f8f219f3", "value": "T11A534B6BBB8412F84B4692F7854A04BBA50406E37F715C23383AB3A54F177246DF88F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309426, "uuid": "33894427-0390-43d5-a994-23cc21a8babe", "value": "1536:jeK4BsxCZwkJrlek9CLiDhtVAZP3ByjIRp6kD:jN4xukJrleHLWmF3kO4kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309426, "uuid": "2e6f7b19-cdd6-4a9a-8cfd-debe920b656f", "value": 63449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309426, "uuid": "5dfa847e-4bba-4837-9a99-3ed313910ae8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309426, "uuid": "5dc1f9aa-6c0d-4921-885f-5c3797d24f07", "value": "Factura_8.11_13.85.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae62db2-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309083, "uuid": "1aee2422-12ff-4f7b-a0e7-68f471f40731", "comment": "Malware payload (AgentTesla)", "value": "85adb6d01c38c54f4fb1ba22cac393fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309083, "uuid": "121ed4ed-4d29-4adb-a34d-6e7d6a4a84fa", "comment": "Malware payload (AgentTesla)", "value": "75f9950f13bfdcc06e6a62210db58056b59d9277a0ecffb84b5d2afd4fb64eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309083, "uuid": "21fa60f2-cb44-44be-a6c6-b99b34c17368", "comment": "Malware payload (AgentTesla)", "value": "80089c76c140d036d441bebb887ee6bcc1a254d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309083, "uuid": "c3db05f7-f39e-42b7-bf7c-a3b676bb1359", "comment": "Malware payload (AgentTesla)", "value": "2ca2f54f7191463e7b7bcdfd79972f74761e9f8c646f00d177588b86ab801003a3a61aa3100641508757de3d46632388", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309083, "uuid": "776b4d79-4c92-4761-b149-95c96abafe27", "value": "T1C455F1039234AD4BE101C7BCBA2F7559110E7C3672D2A5CA364DB74B4733FAA5ABE118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309083, "uuid": "777b3406-bc06-4e0b-9e61-6f16b1d0d4e9", "value": "24576:ILKgBJtHlxwWQmmav30x+BNEtHlxqWQmmav30xw6F8QXJ2guXZop8C:ILKgt7FQmmQ30ora7PQmmQ30i65J2gug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309083, "uuid": "54ed0723-e366-49bd-929c-979f1af8e4ff", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309083, "uuid": "6d43098c-7329-4e6c-bea1-71566cf16029", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309083, "uuid": "c3d61668-ec55-4b8f-921f-c8e4e3184b42", "value": "DOCUMENTS HAWB R129724.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33de1301-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308346, "uuid": "65bb1fbe-251e-41aa-b94e-1dc0eb5c7066", "comment": "Malware payload (SnakeKeylogger)", "value": "a440a258b87252eadafb1b4f212f502e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308346, "uuid": "c861e593-1649-4246-be44-c542c84c81a1", "comment": "Malware payload (SnakeKeylogger)", "value": "763efb25b2db55ae6abec014eb7d8ffa6432d2b23885af862199a204a2864ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308346, "uuid": "81314cd1-f848-4f53-ab3f-b6df862602ec", "comment": "Malware payload (SnakeKeylogger)", "value": "0f3628e2b475e9b30ef78b41c6055f1a09f2892d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308346, "uuid": "fd18fefa-8887-4b4d-99c3-f60f93fd872a", "comment": "Malware payload (SnakeKeylogger)", "value": "1238a9f7bade61b2a45f965e5106b31b963e60661dc7438caea0939c008b3c526560ce8a080674d5236486b363f30de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308346, "uuid": "1868f7d0-d515-4c59-94ed-0c48a5aa478e", "value": "T1F215CE99B2314533FC8F81790A27C5CF2D44F98B7611E237577B7A82E6491BF7948222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308346, "uuid": "87e838fd-7d12-4e14-ba44-140bc9b9df65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308346, "uuid": "652d2365-ad97-4315-bb6c-b2a54f9b972e", "value": "24576:UEP78/1l93IBNRO7GA0wJ3llMKCU/u5T8XbPj:sj6k7GnwJ35CU/uaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308346, "uuid": "18737d99-6b0d-47dc-b0dc-0f371427cc93", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308346, "uuid": "1a662014-07c7-4101-a82f-3a9cbf0eb91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308346, "uuid": "cdb25abb-4889-44cb-bb0d-c9d6e4ce196c", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cbfa6c-bde6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1678303333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303333, "uuid": "a54c5946-4e5a-4eff-8d8c-0b6ff65fd1ee", "comment": "Malware payload (Stop)", "value": "b80fb8f1c0bb9b4e8d08ab130ab9071e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303333, "uuid": "0fb459f6-278b-43d5-a3da-271c4c2d76ef", "comment": "Malware payload (Stop)", "value": "76a4371031b41468ffa00f983d52207391e0a2d80861f170fcf69645ae3fd903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303333, "uuid": "6ffcdbd5-6c18-4ea1-85ee-46ce19aace7c", "comment": "Malware payload (Stop)", "value": "4b1a28730a1a2224a37ab641f80b1b53ac1f4240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303333, "uuid": "e70b0da0-b31a-44eb-88d4-5f4e6df8081d", "comment": "Malware payload (Stop)", "value": "03d3bb43db7ec79ad14d2e6393a19ed24c4441a632a23e5090698dfe8c9af8b6e533a2302358f0b559885268459cdf10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303333, "uuid": "ebb0fa6b-53fb-40e3-9607-57b5a9242598", "value": "T164E4020193E2AC24E2739B755E3EB3D56B2EF5214F27E7DA2248161E0DB11D2D6E3342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303333, "uuid": "a396b7cf-4e1d-4cf1-a8d9-98aa0b90cbb1", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303333, "uuid": "c4e845c1-f3a5-4083-9032-314fe5f9f989", "value": "12288:dKpGTRIY8uEnlhGT8aGrpSHsydHb3nMq3EFziQv1f3mfMwPspr:dNRIYEjGQloH573nH3EFzVv1uVsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303333, "uuid": "1b4f537f-02c7-4666-b259-d03c405685c1", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303333, "uuid": "e214bce1-5467-4f21-a10f-80354e7c6777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303333, "uuid": "d502c666-21b9-41bd-9a9d-c76e982509b3", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ed1fc7-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (LucaStealer)", "timestamp": 1678261424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261424, "uuid": "3be2bfed-7379-4bd9-a6de-3e70cc94145f", "comment": "Malware payload (LucaStealer)", "value": "d3fb1009999d6e97bbe8735a5b2332a3", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261424, "uuid": "b847165b-c477-4b31-bdb4-aebbe17cc859", "comment": "Malware payload (LucaStealer)", "value": "76abb7d591501a8b6a958230aed7df25a76c96baa9bab41e84e60b78588cc017", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261424, "uuid": "20d9ca2d-72e4-405d-a254-5f28d4180dee", "comment": "Malware payload (LucaStealer)", "value": "e63971572e52aa0905ea1328a5bc47812d68825a", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261424, "uuid": "271a32f4-6dcd-4f90-b7f6-74430d1cba21", "comment": "Malware payload (LucaStealer)", "value": "402f5939a6ae0de8084f366317c9428d49a49494b26f14e6552818c52199808aa7375a2074b1c8545cb60b25aed53f5c", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261424, "uuid": "b5e8e4da-b826-4f10-9a59-60bf23125c5e", "value": "T130240297ABD88435FAA21AB529B17B538ABBFD101834E71FA340DCCD3831445DD24BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261424, "uuid": "13b2821b-994a-4625-ab62-a41598f1328b", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261424, "uuid": "5f78b514-575e-448f-95dd-baff6416d6f7", "value": "6144:s50gUCUNfdDVpsCR47dUahV3yN5Jk1KmUw:+0gQNfdXsCR49KN/k1KmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261424, "uuid": "a64ae1b5-300b-422c-acdc-68d01946c131", "value": 221115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261424, "uuid": "42e03176-7bbd-451c-a915-7725aca67c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261424, "uuid": "b163193b-b6b5-4ed1-b58e-5ed281bf3a6c", "value": "d3fb1009999d6e97bbe8735a5b2332a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aecec2a-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308385, "uuid": "a01ca3c2-bf06-4ab7-96da-d6f151cab02e", "comment": "Malware payload (SnakeKeylogger)", "value": "ada3e2709fd16ad0eeedbc7df837b23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308385, "uuid": "41186f72-2a0d-44b7-b3e5-e3edd80bf121", "comment": "Malware payload (SnakeKeylogger)", "value": "780456b57aaadbd88e551ecb450ecdf82a34a37af423c2ed21f76a78b2aedbb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308385, "uuid": "f3f9e649-e711-4dae-8f93-8d2a3f239fd8", "comment": "Malware payload (SnakeKeylogger)", "value": "6aa37e067b745386ee54c0c78aa4e7ba252ee013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308385, "uuid": "dd740829-3481-49b2-bb64-34e43d6178ce", "comment": "Malware payload (SnakeKeylogger)", "value": "52f4578a0772038a6bb58b215467b8060262ad9282861ea00ae13a756dec19d79112e9b4b3af766ddc274a32fccbe97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308385, "uuid": "33a0b895-0d73-443c-bc54-6790bafc8dfd", "value": "T16905CF5573B19423FC8F41BA192BE69D2DB175033355E23B6B7B3AE1D2016BFB288241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308385, "uuid": "a71b13b4-0e27-4086-9e56-9bf34dd9c6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308385, "uuid": "56f1e033-0f18-48c8-9246-65730ddffbdd", "value": "24576:da/5u615eHmbDkWjub+TcpKNiYNqEKZb2g4YLYw:u3bgCcA2n5Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308385, "uuid": "866361fa-2dcd-4778-a9bc-ef7a51d8ba4d", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308385, "uuid": "0328d066-33a6-497d-be4a-ab45257d8779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308385, "uuid": "57adc490-012b-49f1-b7d8-7823e7e8a613", "value": "Remittance advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51bcb51-bd55-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1678241132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241132, "uuid": "abd3d5e9-caa7-4a01-b744-ebe70bb15d27", "comment": "Malware payload (BitRAT)", "value": "88ab07c52703743422b32c40089601ed", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241132, "uuid": "dc92855b-0ad2-443e-8e7d-5402f7db97ed", "comment": "Malware payload (BitRAT)", "value": "790ec551f63688e1dbeffa8e41660dca92a554e5960f8c8095b92b0b7e78fc99", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241132, "uuid": "b879b3cf-840f-4a6f-a5fa-66faef4fdf58", "comment": "Malware payload (BitRAT)", "value": "5c3bf16f3db88862a66e99912e6fb82e25ce3a10", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241132, "uuid": "c7b4a992-4edf-4745-be73-e34867b517b4", "comment": "Malware payload (BitRAT)", "value": "90824fd60d7a57df2e0e462e53349100e7d683b3ea5f0fdc86c50b7c9951fea1f2cda4ea3d06ccab1b4232ca26ee1e37", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241132, "uuid": "75e53dc5-29f2-4917-adc4-e0e9c0d79d65", "value": "T1C17385C6FA0095A4EC2A9731263ADD7115037C7EA5B4291C3ECF3E7B3EBB4629411857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241132, "uuid": "7f859e9b-62c9-4a4f-a1a6-97dfd2fccb47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241132, "uuid": "ddaa838f-2572-4303-a7f3-325ed06b1a3e", "value": "192:G2pN99ZwLa9l7X4nuInO+++++++++++++++++++++++++++++++++++++++++++j:Gsv9WL4xmhZilZq4KCm+ApH1ThO/Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678241132, "uuid": "7e4bb8f6-04e5-4f88-8bf8-242b57c2d760", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678241132, "uuid": "1783d40f-20b1-4b3b-861a-24e7f45fd218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241132, "uuid": "aad75429-7386-4b36-a0dd-60678eda64ea", "value": "88ab07c52703743422b32c40089601ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8aeb3a-bd47-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1678234863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234863, "uuid": "ad86048c-2c64-4202-9a12-7667d43e96bd", "comment": "Malware payload (IcedID)", "value": "48b04e9517030b0eb65f4b8a48073a43", "object_relation": "md5", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234863, "uuid": "e1892b1a-b231-4e39-bf84-dfad6abb4cb3", "comment": "Malware payload (IcedID)", "value": "7a26ac9b4f78969faee4d2282d79060d03b54e7a33d9efcdbdc3564a1dbd789c", "object_relation": "sha256", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234863, "uuid": "a59bdc98-c479-432a-a796-f38f7e1ebc01", "comment": "Malware payload (IcedID)", "value": "1729aec93db52dd08727193bb699604a0d07eefd", "object_relation": "sha1", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234863, "uuid": "08b9526c-9b4d-4965-8220-d08b5520bc9e", "comment": "Malware payload (IcedID)", "value": "591ba0cd9cbdbf978c785f63a6eaa245f315189bee574718215f7440d047ac37dcd03d49091715b7533b31255563b55f", "object_relation": "sha3-384", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234863, "uuid": "694570a7-5967-4f85-951c-c506d55fd720", "value": "T193E37D27F56284EEC677C13847F9A272FA30B8251372BB278768D7701E60F607A5E254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234863, "uuid": "72710a47-2e79-4cc9-a7ea-b22f2a2337ef", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234863, "uuid": "f2983386-86e2-42f1-93a5-ad73452e92a6", "value": "3072:iUEKtG2CqDgTg2nWSCBbMmni2f0/pLkR5l9rhEAncvW63M9yeF3uN:ilKtGI0Tg+2f0/pLkR5brhEKN8M9yeF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678234863, "uuid": "3d8a72c2-dd37-45d8-996a-b90164d01fb3", "value": 155381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678234863, "uuid": "e64dba2e-91f1-4a97-b57b-6ec6612af5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234863, "uuid": "15801bb9-a082-4f36-8dd2-6d4a9ae909bc", "value": "OSTLERIE.DAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4a729f-bdeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678305275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305275, "uuid": "568c2348-3953-4602-b0b7-6d622b0d0a0a", "comment": "Malware payload (GCleaner)", "value": "6283b21c8215230a7692ae5925d31240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305275, "uuid": "34442e2a-2fe4-4609-9d6a-5054f3a97ef6", "comment": "Malware payload (GCleaner)", "value": "7a35812b1174b2afd578cef81393fdedb925462ecead2c614ab19270d3717595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305275, "uuid": "53da1879-f21d-4199-9ae4-b3d7c1322cd0", "comment": "Malware payload (GCleaner)", "value": "deed519a94857c0d6756a3e5cae06a7fa70fe681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305275, "uuid": "7ff6f0c9-e744-44e1-b70c-1ed7596a1bbf", "comment": "Malware payload (GCleaner)", "value": "708e6f66f9d0b67b1d1dca76772af8dce0db39ad9889e7cac973e8378447a79a5659fe8ded11dac6b59d4de608c68c53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305275, "uuid": "f3428545-b328-470d-b9b5-82eb92e77eb8", "value": "T1FBD533F6639184F0E07287359C78D8A949333837CE65B900B77F835B223B9A59472F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305275, "uuid": "552574cd-e65b-4cdd-844d-e66881fedefb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305275, "uuid": "1005f342-da5a-4d3f-99a2-1ded3ed2ff1d", "value": "49152:AGhc+hIxwJonPSr4/hyCLi2nrQg9a9CRDjmqhaxmP8ytbxSIIt1dIO7HawOKz:dO+hIxsUT+IdNhkYxIt1aO76wOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678305275, "uuid": "76bbcc97-42a7-42d8-85f4-45d4176d27a2", "value": 2926617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678305275, "uuid": "ea4ad5e1-265a-40aa-9a4c-1014b94eff39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305275, "uuid": "ab543121-7323-45bb-b891-064afd56338e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c04f4-bdef-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackMatter)", "timestamp": 1678307007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307007, "uuid": "35949df9-f96b-4e77-b968-c1aa2e2e3a36", "comment": "Malware payload (BlackMatter)", "value": "c1eb609c9ed588d372091d5531a74aeb", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307007, "uuid": "c43480a7-5939-4678-9d4a-54aee2fe8042", "comment": "Malware payload (BlackMatter)", "value": "7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307007, "uuid": "cfb43a6d-e0c4-4865-ad76-98dcc595e810", "comment": "Malware payload (BlackMatter)", "value": "faf042b6cef13d0d46c5b5e7f3f5a595fa0a5952", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307007, "uuid": "2fba961d-1f91-4fa6-94e0-a5c63b95b694", "comment": "Malware payload (BlackMatter)", "value": "f038074d82029098e94b8ea380a2c38027086ab763c366e7df6dddeaa67677cc837adc1af41037a9f595683f1104ab36", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307007, "uuid": "815cfdc7-bcd4-46f5-945a-6a1bce9e5a09", "value": "T1BBE37D11F213D0B3C87718F13736B472B39E8E2C19996947EAE80F59BCA58236F44997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307007, "uuid": "15be4994-8a44-49ae-b766-4db4cc5b9a54", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307007, "uuid": "1b51e32a-ff76-40b2-b733-c31d30a87dbb", "value": "3072:w6glyuxE4GsUPnliByocWepkEa9YmM31iA9uHZiW:w6gDBGpvEByocWeJhRFwAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307007, "uuid": "51d6629e-3ce0-40c4-b267-6c9e90e0ec9a", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307007, "uuid": "a2841d37-2a24-4608-90f8-37a742809e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307007, "uuid": "3762585b-b8ce-45bb-8f43-b362e7e4a68e", "value": "LB3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9583b84b-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678277586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277586, "uuid": "a5d296e9-c1cd-4dc7-b066-3125199f69b1", "comment": "Malware payload", "value": "899b03309caefaf92ce42d4d4589098d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277586, "uuid": "30560e69-43da-45dd-a865-6747c3fc0d4e", "comment": "Malware payload", "value": "7b0140619c811f000bd739dbaca0ab23c5027da5a4a56ada4efa6151fde9b848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277586, "uuid": "040206d4-359d-4526-b5d5-b5cc5340d570", "comment": "Malware payload", "value": "66961cb67974fcb4b98d8a05a17c6d96d8bb794d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277586, "uuid": "e717eb21-8e26-4635-b420-112d3d833e14", "comment": "Malware payload", "value": "97625ec20c2384d2f81f2b0ec5ce1329dba38c6348dc3f8d54b0fed3165de89d5d93c7340a2824936e4bcdf93c0c76bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277586, "uuid": "08613d04-d0f8-4012-9445-307d01bf3c7e", "value": "T1FF156CB1DF702B46D2B481F38AB2568C987317499BC158C7B178C1985AE8AFCCD3E9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277586, "uuid": "17f49366-39f3-471a-bc45-ceb7c599cfb4", "value": "12288:Gl9BEI6gvXwcJCjrsSs6YFXQ3xnU602IzBSDQ2TJ9eShgWxkTaN:yrJCHe6YFXQ3xnNzIMk2lcigFaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277586, "uuid": "65d6020d-deab-4d38-b2af-b8454fb94512", "value": 890496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277586, "uuid": "d3dabb42-52a5-4778-ab21-590c99a2aa04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277586, "uuid": "2e603b7f-8d3a-4009-b3e1-45fcbbe9445a", "value": "mi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4022d153-bde6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678303213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303213, "uuid": "fe9d0c10-839e-446a-9279-d770e236ee50", "comment": "Malware payload (RedLineStealer)", "value": "f94d5a53a021517d1d0481b06ac502ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303213, "uuid": "af775537-957d-406c-af44-20547bc2618b", "comment": "Malware payload (RedLineStealer)", "value": "7c98bc665b12e5b4602947e7f6eab31e12497516e2888e0edbd7c6e9dfd3ec49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303213, "uuid": "205984b2-386c-43c5-9f89-289ced02b3d0", "comment": "Malware payload (RedLineStealer)", "value": "315286f56a0f7d6eba1af8fa2a2749e61564fd66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303213, "uuid": "858f338d-200c-4bcc-bac1-44c7b33656bc", "comment": "Malware payload (RedLineStealer)", "value": "623b3d37c37063eec171be3445e673ea60ad0761aea09de0d5c0ba3d82a8c45dff414ac842a6354219c0b9c0822eab3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303213, "uuid": "7b810de3-c1a7-4023-8841-3e6322ea21da", "value": "T1B6E4020243D1AC70F66387B15E2DB6E4662FF9625A67E7ED3214176F2EB00E1C963302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303213, "uuid": "82367eee-da7f-4f9d-9fd7-95525126f651", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303213, "uuid": "d8f13c70-5d64-4554-90c0-653d812c6880", "value": "12288:T0jgSr2WhVTkc95sRuni+P+9vuxH54VjO/NSR3OXoQ1:Tq3VAsyRun1P+9G544lw3/Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303213, "uuid": "ed041228-f660-4f0f-ad5b-a92b9d7370fb", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303213, "uuid": "050e29f2-6eb1-4ebc-96ba-49a108e27dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303213, "uuid": "cedcadba-7622-40bf-bea9-72a2eadd5b0f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b926b84-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678267503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267503, "uuid": "1580babf-e413-438f-9c6b-ec7b98526d3d", "comment": "Malware payload (Gafgyt)", "value": "16bfa1d27d371a6b69dbfda70ef044d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267503, "uuid": "cb67458c-356b-4b1b-9f0d-9376d7bc07a2", "comment": "Malware payload (Gafgyt)", "value": "7ca3c7af6e5109535aa676e989a14a0c0d3c7b7c96a7e21c497692e7cc818733", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267503, "uuid": "2713be92-6fb0-4af9-a831-3ddb6c054fbb", "comment": "Malware payload (Gafgyt)", "value": "c52b07d3b792643ece5b0900643ecabd4ae741f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267503, "uuid": "06123b9e-e000-4f52-b0bd-2eda6fa0117b", "comment": "Malware payload (Gafgyt)", "value": "f792586974636528d2ec7afc6ae1077a88ec241363d8cbe81777dadee51387b9bf694c0c4ee9c3a2a02334ffbe91d918", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267503, "uuid": "c779ed0e-bd92-4d65-b3d1-6079ae8b6085", "value": "T18DA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267503, "uuid": "b2df5d76-55cd-4fc2-a761-e700b18f9abd", "value": "1536:xfRuqNM5h7t/RiRt4npphaQoRKzO6F6OXj6ufeRTe:OqN8jRiR2phaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267503, "uuid": "4eaf745e-6f20-48c7-858b-295331de7e2c", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267503, "uuid": "701e9ab1-cfe9-403b-ac0f-879c82834373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267503, "uuid": "07b6fa49-1428-42a7-a912-82b431f29a87", "value": "16bfa1d27d371a6b69dbfda70ef044d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97ba2e7-bdd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678297377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297377, "uuid": "39fe75dc-4da8-4b41-be2a-6b1f7981c292", "comment": "Malware payload (AgentTesla)", "value": "c5aff6b7c258ed986493202d840137b7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297377, "uuid": "425c533f-ca42-4df4-a146-615300c944fe", "comment": "Malware payload (AgentTesla)", "value": "803cd779745b8235a9581e8ce8391930d60aca265a8989b47d6d81852fd838c8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297377, "uuid": "bff32987-26b0-4608-94de-d7f2e676f5b4", "comment": "Malware payload (AgentTesla)", "value": "cfb064c417eac55201221c8c1c266cb3859b0089", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678297377, "uuid": "36a3fad3-6714-4e3e-a4b7-c7866be2c8aa", "comment": "Malware payload (AgentTesla)", "value": "9562b42068a745e8fe4e563ade5669d66db48900ab8c635c00166627c1e87af49aaa87ee3c436e0947bac60fc2cd6b07", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297377, "uuid": "cda69c62-558e-428b-8525-4e185281dd21", "value": "T15CC423EDC31A5CEA7D796100D3A6C714A612C63C8B464F4724BF6CDA8850EC639F97CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297377, "uuid": "d4fcfe7f-1e45-4e94-a278-80ea468370a0", "value": "12288:DPKEJ1VcHHuZQCRJcAI1Q9zBc1V0szA7YWjwU+Paz0e:DPKA7NKCN0V0pMWjwBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678297377, "uuid": "653785c6-73ff-490a-a398-1c1387a03877", "value": 575232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678297377, "uuid": "546c9294-8068-4aff-a536-78f2e628215c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678297377, "uuid": "b32c6495-5b15-411c-9445-dc1227f77e5d", "value": "INV01562-7500003124.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95694bf1-bdb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678284029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284029, "uuid": "14bf263f-440b-444c-9641-03f0980e497a", "comment": "Malware payload (RemcosRAT)", "value": "3d917fd5f2f5e18c28d68437ea4e9dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284029, "uuid": "b9eaaf0d-349e-475e-bde3-0e6194391256", "comment": "Malware payload (RemcosRAT)", "value": "807093752106d15ce311660c16c40e2a6987a00ce7e2710b19b64d9501a36f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284029, "uuid": "d68fb663-6444-4006-a603-84c60e5f7693", "comment": "Malware payload (RemcosRAT)", "value": "276f1c5b73545dd5bc1fcf7d4e745a5a6e78d274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284029, "uuid": "59a32929-0b93-4ef8-8c31-46244a481e8c", "comment": "Malware payload (RemcosRAT)", "value": "ee4a2313ccc17e589b20ad37626c824225af80237fee2d3040b3fdab8bf6bbbeccd4aa193813c6f869eb8ebdc2c7425d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284029, "uuid": "731435f6-ca7f-4603-a422-5a7b7c0cebda", "value": "T1B1057C13A3A0DC3AE0732DB89D1797E8596A7D203E286CB23AF43E4C5F7B5517825253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284029, "uuid": "796adc14-417a-499b-ac4d-5fd49d42a644", "value": "582c94e402b6ca3f26239925df8854f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284029, "uuid": "c74c78fb-a9ba-4a2d-9b35-acf27c18a4ce", "value": "12288:oTUapCWOSkmUQNQugJaBHCa7GGzkZqPLX3UHA25TakgFye5TnLF78:6dAskmUVugJd6GG4ZqPLX3UHA2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284029, "uuid": "338a8601-f84e-444d-846f-2b89b83fc0d2", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284029, "uuid": "64a189fc-8821-4f6f-a195-5a12bc230691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284029, "uuid": "2f9ba31f-de8f-4ef2-906c-0600ba7944ff", "value": "RFQ New Tube Bundle of E-2419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd2068a-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678303930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303930, "uuid": "078e661d-857c-4f55-8203-1cc7fb94b2e6", "comment": "Malware payload (Amadey)", "value": "e140d8129977dbdfe12dc938044559c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303930, "uuid": "8c6c1d10-6211-4d1e-ad01-e408c6d272a4", "comment": "Malware payload (Amadey)", "value": "813c874aa6d1c15b3549a5b5453123a9db6942247971264d6ed160d8768f31dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303930, "uuid": "53443a41-30e8-43de-8ff6-db5a74d0e414", "comment": "Malware payload (Amadey)", "value": "2ba13bb7ae8c400fa2ef72e66fb9e2143827fd8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303930, "uuid": "3d142aac-bd69-4fbc-b7e1-14a548eef070", "comment": "Malware payload (Amadey)", "value": "97ad4171d6fc7fe65963d3358eed13f38a4560330395a51a50f358ef23b363fd47bf637b555116ad9396c6c6ad674a71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303930, "uuid": "e315e87c-2a0c-4dee-998b-ae9011cbe6db", "value": "T16254AF13B2E17C61EA664A724E2EE6E87B2EF1504F16A76E23394B5F1A701F1C173311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303930, "uuid": "d711b199-5e7f-45af-81bb-d22aa38fd892", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303930, "uuid": "449eb1e5-ac6b-4076-8c23-5555f3d3b6d0", "value": "3072:Ojz2Ou75UL6hWRQHcYcwWvv+UjivNW6RQjBZR5ZodINFDlGuJloFTP4eUM:yu9UL6w1ZnooieBZ5odAFSP4eUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303930, "uuid": "4db0a494-61b6-479a-9d2f-4b8336d5394c", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303930, "uuid": "93d39ee0-bf31-4c9f-8f25-ef40230d1ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303930, "uuid": "48da122e-040b-4aea-a66d-e4f03986849e", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41205006-bded-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678306221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306221, "uuid": "c8af8177-750b-4017-9c18-33ae1d48384b", "comment": "Malware payload (RedLineStealer)", "value": "d16b8f7fabe874e997eb95c1a14bd0f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306221, "uuid": "89c3d011-2168-4bec-a105-5e2c855ff225", "comment": "Malware payload (RedLineStealer)", "value": "8152ede7f665910747fd8c2c3384e2b721f922c8b6e758882959355c2c7b9872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306221, "uuid": "18226858-0109-4824-9d6e-7f1e4754015a", "comment": "Malware payload (RedLineStealer)", "value": "7662108aab51c7bd80b6eb76bf9e0150d4d5b843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306221, "uuid": "2046e16c-23f9-4889-b80a-280795a6a527", "comment": "Malware payload (RedLineStealer)", "value": "f2d8d3ba3a8b5f1739f5e3370eed534c625aa14db9d0d9478c56bfae9a2c70ac40580f03dd38eb35f5edfe5e96be6c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306221, "uuid": "56d7094e-e1cd-4a7e-a778-a18d591d2d79", "value": "T17664C01253E0EC25E26646715E2EF2E42B7FF9618E3BE7D922145A2F08713E1C963713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306221, "uuid": "311980dd-1693-4236-bd35-2263c653226e", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306221, "uuid": "ee793f63-da22-458a-b6ab-10ee3d636589", "value": "3072:dj79TkRTWocsbPqAhpHHGLxsLuCDFycYcXXXdA9JXNEKR4yZpQv4lkF:dCRyozbP7nGLCLx0SHXmEKayZpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306221, "uuid": "bb97ba1b-e631-4cd5-9311-81e41473408d", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306221, "uuid": "40f90f95-33fa-4cd0-8869-bd88f4b0aa40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306221, "uuid": "8231c336-a698-4a74-b146-ecbbc830d0b3", "value": "d16b8f7fabe874e997eb95c1a14bd0f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5336e45-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299141, "uuid": "5530fa71-e2ef-4450-a766-e6e73c8b6791", "comment": "Malware payload (Mirai)", "value": "2cb88f57d367c39a53ef3ff024ad13c4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299141, "uuid": "f8a70825-9137-4a08-8157-dd8a6430352b", "comment": "Malware payload (Mirai)", "value": "816667bca9047d76ed8f6c7fb61ec14d20e5fc3726fc89b095458fb243def24a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299141, "uuid": "ebfff45d-542f-4afe-bb8d-b64393477ad9", "comment": "Malware payload (Mirai)", "value": "10945ee180c908d7c7ebbf4782c0baabe4ad21e5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299141, "uuid": "e6ae9240-9ad1-4ddc-a9e4-a9098b4b9bda", "comment": "Malware payload (Mirai)", "value": "752597a6cefefe5a1e94fa94bc8107ef0ae85fe6a6f8a9bc0936ec3a05ca74a63215782cb045d2ca9e929ee5f7d49f4f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299141, "uuid": "d64fe80e-ed40-4818-8c7f-3452c4382873", "value": "T17D534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299141, "uuid": "d0f69649-d050-4be6-bdf2-6cbeaca2e02e", "value": "1536:rpmbSQ6U3q7cCBT/lZsK/k/iQMrCupimfFoktCeHJYEQMZ:YShU3q7cEDlCK/k/Ejpi8Fok0KJYEQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299141, "uuid": "2cbf6229-8725-47be-8856-cf6643346d78", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299141, "uuid": "9d200e7c-98ab-43b6-8034-d0741494d9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299141, "uuid": "91dfac46-3dae-4a94-93f9-265afc9f4216", "value": "2cb88f57d367c39a53ef3ff024ad13c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fc9d37-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266826, "uuid": "b2ecfb56-f63b-4a86-874d-4feec91f09f8", "comment": "Malware payload (Mirai)", "value": "2e2a6bc1808cfcf5e70c3aa0fe7df7a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266826, "uuid": "a8ef988d-8ef7-4a73-a264-136e1317397f", "comment": "Malware payload (Mirai)", "value": "8178b7902c5d40543a95c87fc7c27a8bb70a4d603ad184e25b71f4f45d66ee2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266826, "uuid": "a2b73a44-3f2e-4c76-8b35-226de921864f", "comment": "Malware payload (Mirai)", "value": "63fbef8d0c3a7118acc34819585b6aadeabb2ef5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266826, "uuid": "d15f2b55-074c-46ad-b9c2-da5d5a294bb0", "comment": "Malware payload (Mirai)", "value": "27c43011894c3a6dd2428ee2d97ae867536cf43d56e74f5da9421b4985f35e8cc769a9e37557ea44c191f5b151d9b048", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266826, "uuid": "a29fcac8-255a-4ae3-869d-ab70d9dcacaa", "value": "T16FA3D705BB610FF7ECAFCC3709E9170625CD695A22A87B367534D828F64B24B15E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266826, "uuid": "522c3433-2f0d-4427-b108-71a520bd1aec", "value": "1536:Gx65oO81XmDeGXgnvW2Oq9FWrKZPhRyVdA8clKGdg:8YoO812p299F8KjsqK0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266826, "uuid": "5a5ee5a2-ea16-448e-b56d-5ed147b66b29", "value": 101256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266826, "uuid": "927c7b15-d9bb-4089-88e7-17fcec833e35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266826, "uuid": "5c7db2ad-257a-43e7-acea-c866af0d0018", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09fbede-bd97-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1678269579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269579, "uuid": "106b8b3d-bcc9-411f-b43a-4895b8bb17c8", "comment": "Malware payload (AZORult)", "value": "6324ed79b7da9eab94a2c55d00c00e9f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269579, "uuid": "1b3a7dbe-330a-4eb4-adf1-98fbe0811a21", "comment": "Malware payload (AZORult)", "value": "818a834fac6c60400e21dae1e04255f0b83688cdf0159d568400469ff6e4fd7a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269579, "uuid": "4fbbc9c0-db15-44d0-92e4-e8a375130201", "comment": "Malware payload (AZORult)", "value": "46b88afced15187edf9f80609b0f3db5c28b5c7f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269579, "uuid": "b98cc28e-efc3-44fa-b76d-0ea61da88785", "comment": "Malware payload (AZORult)", "value": "983533331a46d9ea833102dbd43a15fb421fc9e1a73f53dd0cee8472d25abb33e5e34688c5e10ae3c114c76d181ae517", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269579, "uuid": "a1d70ab4-e076-4cfc-b963-5bb69474119b", "value": "T1E4538F692ACC7E48010213A29DFA047ABF1475A241B84C77FB3DB5B53A4433B6B5B4B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269579, "uuid": "2df85731-a93c-4c23-a80b-c5acc29c987e", "value": "1536:fV7ueGU475vU68Un0tkNXW9CUnIIRvQNgE:huer475SU0uZW9CdG4qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269579, "uuid": "14cd43a1-210f-4d83-8173-35196d21248a", "value": 65876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269579, "uuid": "238d3c1b-c2b3-49e4-95a5-c35f2b73c057", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269579, "uuid": "ad4b190c-b46c-44ae-84b8-3051c4653d86", "value": "702730_228_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974b32c8-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678279307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279307, "uuid": "605e957a-a159-479b-9456-a2b4ef7a759c", "comment": "Malware payload", "value": "ba40a2b76500397b4ec260e4e515cd00", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279307, "uuid": "1235f316-39ca-4eef-bbe3-a093319b49c8", "comment": "Malware payload", "value": "8195036e6eedf6b72c1dfec856365f40df58f6b74461ace6a55623e331a07040", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279307, "uuid": "73ae8f17-0b9a-4cad-9b6a-041ae4a0eb29", "comment": "Malware payload", "value": "a2f9f1b50c2a83ad359e98ba95b7585520a795c6", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279307, "uuid": "f0e6e72d-30f4-4fe2-a192-bd7e15b924e6", "comment": "Malware payload", "value": "878932ea9ebb43752d3f3eb8d54941cc27ff5adeadc97d4df52e19c16264acac62dc939d999771d8ba95c6b946156073", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279307, "uuid": "987556bc-9574-4c07-8960-0b87fbffea4f", "value": "T17245122073781B0AF9FB0BB68A9462201BB6EE562A31E5597DDD10CF1793B404F92D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279307, "uuid": "c4f10b15-7d6f-44f1-98ce-cc0bf232fab8", "value": "12288:p0UMzHyYogIffWGGjEZJyvWjF6jkS5F3p:aZSYWwEZJyvWp653", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279307, "uuid": "43acd191-1a70-4da4-82be-3e85aade4e55", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279307, "uuid": "b5bb4a92-75d7-41a4-b6a9-bc197d6f5410", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279307, "uuid": "d9ee24c8-5fc9-492b-9725-3118897543d9", "value": "npago de la factura 11-369013.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccf6928-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678279424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279424, "uuid": "09d50ba2-b159-42a1-93d4-13410ce3d534", "comment": "Malware payload (Formbook)", "value": "6682d9d38bbff318f65c39100534f32f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279424, "uuid": "63d14872-c293-4752-bd27-49d630428a74", "comment": "Malware payload (Formbook)", "value": "81b7ee55b75f60bbf42484de670154d6a7c182bdfe1181e3a89bb4483dfd6944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279424, "uuid": "3c3412b1-ad5b-4fba-8bf5-37d47ae2506e", "comment": "Malware payload (Formbook)", "value": "6839ee1960631c24f06b927c8f6fb3cbc6a2aa04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279424, "uuid": "15188532-8d07-4c86-b881-b8ec7cfedc57", "comment": "Malware payload (Formbook)", "value": "cf839e8e268a4b8b050e6269b2d84601260a47ebd005fb0b1599afc1626a985e569e7cbb6610bc43bee93f81dcd08b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279424, "uuid": "8b5ef7d1-a835-463b-9dff-2582bb30c8a7", "value": "T1564412043EF0C94BD9B247721DBA0717EEE564061495CB5B23A02B9DBA391A1DC0FFE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279424, "uuid": "ca484611-8867-4fbd-999f-aa2afec44320", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279424, "uuid": "c6c667f1-c3dd-49a3-9e7a-84fd41f851ef", "value": "6144:/Ya6E8tKKmuHztTgpoMoz6cGpyRlNsjz2peSrheXzaW:/YK8jBJiMpGpyNpeSNeeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279424, "uuid": "12b029bf-8526-4731-9452-fc1dcc815993", "value": 255260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279424, "uuid": "bae58998-2db6-4b94-93dd-5f7a3746a7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279424, "uuid": "20a7a5df-6be3-479c-b774-b841660328ab", "value": "rORDERINQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a8bb56-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678285056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285056, "uuid": "864f848b-b541-4e9e-8a7d-79ef33c83be2", "comment": "Malware payload (Mirai)", "value": "61b4a1433b91de167d90a55524cddde6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285056, "uuid": "9ac5b2a1-ce0a-46a7-b5b4-d15bfeb50287", "comment": "Malware payload (Mirai)", "value": "821a368840067594009b2e9f187fbbb64e391de6653afe9c93ff6fe88ccedc6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285056, "uuid": "f8ee2286-fccf-471f-af49-daf11d32aa27", "comment": "Malware payload (Mirai)", "value": "9c34e44d8d030a94750be3b4a1522f3dd9e13a7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285056, "uuid": "00775acf-4f36-4bc4-b072-e692fa3f9dd2", "comment": "Malware payload (Mirai)", "value": "4d34642437c04a395f1100cee03f9dba663f63cb192acc4bff9ff3b34902d425d23340735bb91142452c839b109fe5d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285056, "uuid": "d09998ff-d515-4686-93ad-b393a8308245", "value": "T179336C36E029DED0C6960134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285056, "uuid": "6a99c05b-060f-4e5d-b35c-73b47e19b4ba", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Am3CZQoV/bnmCozw:Oa4U7G7SvT6ftBtm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285056, "uuid": "b68ff069-299f-4ec2-b2b2-d188a544de03", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285056, "uuid": "4b4e65b7-1b95-4639-92e0-f9eafa85c7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285056, "uuid": "376d126b-7501-4bf0-a2c4-94dcae41ca1f", "value": "61b4a1433b91de167d90a55524cddde6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf0f50f-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1678309491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309491, "uuid": "bb2ae5ef-2bd5-4bd9-9b4c-3914b6683e0e", "comment": "Malware payload (Vjw0rm)", "value": "a2d87864e4ae3f37438382c7059d1db8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309491, "uuid": "6c8a6b5e-2bf5-43f6-b751-ceeb34d79fb7", "comment": "Malware payload (Vjw0rm)", "value": "8238be6c23aee13f83faffb0a2ac1abcb1a698fd87c48aa8f2cd2a36a4a29140", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309491, "uuid": "0c199f1b-f92a-4d51-a858-aa776281efd7", "comment": "Malware payload (Vjw0rm)", "value": "e9fb58de42c5a06f79f2e5121240134402a6c61c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309491, "uuid": "d62bfeb9-8e65-446c-b90b-7c410a965d8f", "comment": "Malware payload (Vjw0rm)", "value": "a5ea03639544bef3a907ba6ae0b6d9be590ce022a22a4ed4d548606992f6cb616f0a01ed642b86cd27444912f507d18b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309491, "uuid": "98d61c80-b89d-4625-af04-ec62dd56fcb0", "value": "T12C552B8A1F281A45B362F420422DB3135CBCE9A72EF745DAD8857B4F2772C645CBDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309491, "uuid": "22019ae5-3455-4366-ad5f-1a906f266d36", "value": "6144:m427cWqyvMWQ4jn9SLjCFmKm+GkM27AhrqxV4ENyrWVvBUk/h+N+ZzGwRmwTeXOZ:sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309491, "uuid": "361e60d6-f2cf-4e45-8f0a-65bc7e8b332a", "value": 1313155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309491, "uuid": "e9f7f054-2141-41f4-a62f-2411c3499c90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309491, "uuid": "71a68cbd-62bd-4948-8d30-17d697e533e6", "value": "03720230050.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d6dde0-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248302, "uuid": "9c0c059a-47c4-4f40-a60b-d34206827995", "comment": "Malware payload (Mirai)", "value": "60c8fb4ca22acdcbfcdd18b7a823cbd5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248302, "uuid": "7c24e5b9-4e99-4133-a59b-4fc6fa69d8f8", "comment": "Malware payload (Mirai)", "value": "8313faf551c6f8223a585d106e89b1119bc9c9fb6a3a0b40da8ae35655b89083", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248302, "uuid": "a60e41d9-526b-4d2f-baf6-032776b277d6", "comment": "Malware payload (Mirai)", "value": "77831e5e71ef41fff896152ef4ffb8c3857d1ebd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248302, "uuid": "d79783ef-ea15-41fb-8948-a79dc551fae1", "comment": "Malware payload (Mirai)", "value": "137ea9e870073cf1016ae7f1d526516f827a145fbf19c09ae852de2b4829f8c3a8beb34588fffa647097b3dbf81c1b53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248302, "uuid": "7cde6466-1f1c-42b0-a8ae-fc5f758cc9fd", "value": "T1E703E751BC829A27C2E1137AB6AE4A8D336163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248302, "uuid": "c4fbab1c-cab7-4592-82a6-b32c6d67f4fe", "value": "768:EgC1DCbfsG5f0OVnlUlAOxFtAZwAEb9jvWpKv+b8+77TUXoTI/NAwW:E4bUG5fHlUlrXYKScv+PUb7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248302, "uuid": "7de80095-b0e5-4f86-ac9f-ee97ed274bee", "value": 40732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248302, "uuid": "1f58db99-516a-44b9-a22f-897815a05f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248302, "uuid": "5e8e5327-3ac1-425a-8cb6-a28fea0a6c5d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21135ec-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678285016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285016, "uuid": "3857f074-071b-46bd-9e06-e8c4e05c66f1", "comment": "Malware payload (Formbook)", "value": "a9ca780bd1217cede486c527e19c70e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285016, "uuid": "2e400027-ea7c-4254-8c82-d46735d6e4ed", "comment": "Malware payload (Formbook)", "value": "83665b988b1a63b2d9eb4f3e3ef565f41a2871bfa2bf11d1e6ee62c8177f657d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285016, "uuid": "70a87720-2706-47b1-9298-70a451486eae", "comment": "Malware payload (Formbook)", "value": "7c96078eb1b80709974b4cc5e2d88fbb8ed4b132", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285016, "uuid": "662045eb-89d2-4e4d-b4d6-65a8ac1d9d42", "comment": "Malware payload (Formbook)", "value": "f317ba58efe6731d287358cd7c398ffb790b383b3b9881f5fd23075b443fbf8cf6cfd371383c9884cb66abd36a5727b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285016, "uuid": "e4904401-a067-4872-94e8-223dc3249e87", "value": "T11215CF9973711573EC8F81B90927C5CF2C40F98B7611E237577B7A82E2591BF7A88222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285016, "uuid": "b9d4cfe3-ffb5-44aa-a99f-a21599fb186f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285016, "uuid": "5fab7dcd-2d23-4069-91b7-886826369ec9", "value": "24576:9EP78/1zHNIuiNbeauZvNWH0D1qECEbBPFHqqme:d5tUAvNWLmre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285016, "uuid": "2dfdb248-fb83-4721-a48a-d72dd3b3cb08", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285016, "uuid": "26cf41a6-1c63-43a9-bcc9-ee3456143c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285016, "uuid": "42ebbe01-538b-47db-801d-8aee631985cc", "value": "a9ca780bd1217cede486c527e19c70e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737234ee-bd6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678250041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250041, "uuid": "62862832-dde4-42fb-8d11-6c1247d763e1", "comment": "Malware payload (Mirai)", "value": "069b103b2a53d4287c67ed33d2414c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250041, "uuid": "b274c4cb-70c2-4f49-8f18-0a385d90f022", "comment": "Malware payload (Mirai)", "value": "83a7c91e11bbb6ddace535530936af8a4be01cd3603414b0b68724175f521774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250041, "uuid": "cab5bbab-9a64-45e4-978b-0c8bd2517693", "comment": "Malware payload (Mirai)", "value": "5be5a40179606526acc6c18e5173e61e6373303e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250041, "uuid": "66daaf8a-486d-4933-b34b-0ff7ff1040f4", "comment": "Malware payload (Mirai)", "value": "f0e7ad425d98203ec16b2eacd21209fe31c2e39cb58253a8021d28058602ca91932f33c817df335e5691d3ad5f7aea58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250041, "uuid": "452a6dce-4932-4ad5-9773-91e661dea4ad", "value": "T10C534A02B31C0A17D0A31EB0253F5BD197BAEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250041, "uuid": "210d3882-03e5-4555-b6ca-82d2ebba13e0", "value": "1536:hOfYVGmOMRBtogdgaipmhxcTN+++9LWLd:ImfB2erANt+hid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678250041, "uuid": "e393a155-4f5d-4a2d-953a-661725b843b6", "value": 62972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678250041, "uuid": "d141756d-beb0-47d4-8303-9624786b978d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250041, "uuid": "86093ab3-f5df-430e-aac3-89c23046e105", "value": "069b103b2a53d4287c67ed33d2414c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77e4507-bdeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678305588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305588, "uuid": "0c2c6901-2710-437e-9b07-570f5f98bf1f", "comment": "Malware payload (RedLineStealer)", "value": "7e0eb4a4061e5b9ea072089a27bd9659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305588, "uuid": "5af5945b-5348-48bc-9b81-ae2f48826737", "comment": "Malware payload (RedLineStealer)", "value": "83dac1d4055156cbe77b497bddee7e321dda31ddd4ea7e6493a2d53742106f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305588, "uuid": "948a7f0e-7ca1-4b18-a0a2-48024467f825", "comment": "Malware payload (RedLineStealer)", "value": "784c4612311008a98b02bbdd698fb4f0ececec74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305588, "uuid": "583a929c-9106-427e-b9b7-69b5a0b8feb7", "comment": "Malware payload (RedLineStealer)", "value": "5c02d0490e3392326f2116d50c7e671a59c3e95b2eda5d704bc7a6a54cbe11327b614c5cfc85ed4077a58d3bea823522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305588, "uuid": "f73a6abe-592f-43c4-80c6-848a533a8b5f", "value": "T15E752342F6D684F1E621443299286B62A87CBE302F14CFAF73C85D6DD934191E635AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305588, "uuid": "97e40ce0-e630-4aa9-9e62-3d3fda595c5a", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305588, "uuid": "f1c00a4d-7760-4389-895a-d49b281fa996", "value": "49152:V5OwywU4JRi1zMFPqLjqmAWWyLBS/R4b2Bic1d:V5T3H8YFkq3gA54bQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678305588, "uuid": "77ffdd98-73b6-4f8f-8440-4af8ab15114f", "value": 1637035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678305588, "uuid": "90eb4cc0-48ae-4400-aa1e-8ca3bb17fac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305588, "uuid": "0f1df45e-bca4-4aa7-8f1e-17c3c7218ce0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfea6ae8-bdb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678280718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280718, "uuid": "c9eeb5c0-6a93-44b4-b368-9e47a969a03a", "comment": "Malware payload (RedLineStealer)", "value": "ff47121f777f093bdb9ce1ba8887911a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280718, "uuid": "29df4aef-9d4c-4918-b17b-010638659cf6", "comment": "Malware payload (RedLineStealer)", "value": "84acf5932e36ea7bb2c94b9c634c5b34b5564ec881596ce0efae3a9066301eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280718, "uuid": "ab713a50-564f-4023-9f1e-6ebfd6627ff3", "comment": "Malware payload (RedLineStealer)", "value": "ccce549bb3d742eb1c0264f71efe5a4a85d198b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280718, "uuid": "55b36063-76af-43b6-ac7d-886fdb204cef", "comment": "Malware payload (RedLineStealer)", "value": "0f7661c9fe04b51458e6559ecb57ce14f74985ca578424f7c74f7ebd050bbf854b112372b3e131971cda1218b004b0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280718, "uuid": "4910c7d7-09ad-44b8-8040-f03655b6136f", "value": "T188E4020252DD6835D6327F718E7FC2AD762FBDA3CE29766F622C1A1B19702D1C622311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280718, "uuid": "57f7551c-90fa-43c5-b4c8-857de0020502", "value": "2115960edb01d3d9bd07271fe70d5d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280718, "uuid": "731973d0-1240-49de-b268-f2e4d06b8ece", "value": "12288:3LgFXmr0bcDvW3fUaC4Gc4IpV4Tg4K+5uL07PMEhEYJsHeChQ:3LgF4y3saC4GF3kN0v5EeChQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678280718, "uuid": "696a0a2e-b493-4bcd-a836-3421d8d68590", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678280718, "uuid": "d406ca2a-3b83-4b5d-baa7-6a7de4cf9639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280718, "uuid": "fbc421f0-931b-42d6-af3e-fadcbde25781", "value": "ff47121f777f093bdb9ce1ba8887911a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bc97d3-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adwind)", "timestamp": 1678309510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "e5a84315-f64c-4edb-8cc0-4c57b52a96b5", "comment": "Malware payload (Adwind)", "value": "9468e52b7db9abd87f4ad0ea4d6b7094", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "edd4782a-60d3-4f50-afe9-14b5dd4999b2", "comment": "Malware payload (Adwind)", "value": "85214124920f091cb6a7c4ec3f7a3a1ee6fda2bca74024d27bf0195659d4e3c5", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "3349256c-d52a-418b-a714-542736f26a21", "comment": "Malware payload (Adwind)", "value": "c73c502a0f2dddf1f7c609ecf799cb84e88c9538", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "1b7560aa-988d-4c48-813c-54b81d791adf", "comment": "Malware payload (Adwind)", "value": "5fd5c41334633c5f20cec16f6207d58819c6b6f6204625b7710083214b746807cf246c1da06954dcc9a8a0ae05249f8d", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "9affbab2-e5d0-4563-8b3d-4c10b0554911", "value": "T11C25CF09F8481F59C9FC600990AB2F3FD2F6AA0A1131D85566F65F8FAB57E8C530A74C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "a372e69d-84de-424a-8319-cf2d77170386", "value": "12288:NquDUbRxMdDpPwIVED6pqLooV6Ffpz9As6h1e1+CexLMEfvPFHF7Bp1VsdTSFRe0:NuRxMbPREDv0m6FfpZoh7C4LHvBHCcx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309510, "uuid": "8e2a4bd4-50bf-46e6-88fc-0d54601ebe69", "value": 967545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309510, "uuid": "cb27fc52-52c2-4c86-a5b8-30a71ff3aa58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "4288f4b6-e4f1-4b92-9b4b-701727248622", "value": "lpo0803023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150ab229-bd85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678261479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261479, "uuid": "c2fa6e5c-eac3-4eb1-8555-cd85d0ebc221", "comment": "Malware payload (Formbook)", "value": "fb98e395cb1e0147f1e8b6d096b32bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261479, "uuid": "fe78ab90-afbe-44f4-9709-61d1cbc4827f", "comment": "Malware payload (Formbook)", "value": "8525673ebf3804711af06b0ffe06a8ee9d732d437c950034caefb408bd0631ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261479, "uuid": "0aa4b823-bb85-441c-9d54-0ea5323cd3a2", "comment": "Malware payload (Formbook)", "value": "66d1a81a55f9641ffb63d9e2d41e15d0efaeacb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261479, "uuid": "6fb2d2a4-0b42-4424-bf8b-c01d4cd95f85", "comment": "Malware payload (Formbook)", "value": "65fe98a200399b2ffa095420ba80964370d9578a8fca92e8f45d3d21b99ac87a6146916bc2ca05e601fa168d8d3b03eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261479, "uuid": "2477b6bf-cc0e-4ea5-b825-d38b30b59537", "value": "T186831935679C8E37CAEDA2BCE864825847B59416A223EBDA5C8451E1FC133914F3237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261479, "uuid": "89c6c3bf-7ba9-4faf-8de9-cfe7efac8aeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261479, "uuid": "e569da6e-c981-486a-9d29-d3f718a5534d", "value": "1536:rEYsYm5Bc+u09ukwAABROWb3f0F/usDnizdpves05B4dgITSO/IVbkG6:rtsYcvyOWb3fgizzmsrSO9G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261479, "uuid": "62ad5748-b1a3-45c9-a588-47804fb7ee1f", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261479, "uuid": "f9eb96f1-31be-4224-bf42-1aa168c888c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261479, "uuid": "7e855ba5-4379-4825-b82f-1d0cb0b14699", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14c8729-bd83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678260856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678260856, "uuid": "327e875a-7bd0-43c3-a20b-3748d68273b0", "comment": "Malware payload (RemcosRAT)", "value": "a5fee412345bb00dcb48ac9c89d24895", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678260856, "uuid": "228fdef3-0e32-4ec9-aa54-80f90f35726b", "comment": "Malware payload (RemcosRAT)", "value": "854d2f9421222e21ebb98824bb5e401ffde3f5f22979ffe91857c9d1760e8640", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678260856, "uuid": "a295ac91-0cc1-4795-abf4-c157034e151f", "comment": "Malware payload (RemcosRAT)", "value": "2159f83fb69beb159459024164a6d22d4d37c98e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678260856, "uuid": "ee7a3035-c5b8-4b62-9a15-adaffcb0a7f1", "comment": "Malware payload (RemcosRAT)", "value": "139e90c7bd8abf4867f031cf9fe9f4a174b8ec0502a087165fc95915e4f33614aca8c1f981ffb96d0051a345e62dae49", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678260856, "uuid": "1d1f99f5-6011-4fea-8f84-a17a54fdf16d", "value": "T10B64025FFA037F45C234E8AF49DFA9243C5641FBEE02AA07746A58475F4168FB02A44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678260856, "uuid": "16084e46-87c7-4ba7-982c-62ad5ad25f17", "value": "6144:kUuxvaoyJ+TOCCEDl0ue7Ie6W8BoyDMNKc6UwYrTW2hjNyKni0RFsZIk:kBucTOpgl3gLWKaM0RUwAW2aKniqsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678260856, "uuid": "94f10b59-7111-44f6-8d98-bbe4717f5936", "value": 313142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678260856, "uuid": "0d053347-b7e5-447b-8c90-edcb85751739", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678260856, "uuid": "728b0610-3967-4386-a042-7275680b9add", "value": "Documents.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b9e0c4-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279377, "uuid": "51be6e8d-a20a-480c-8244-3ded2aea7770", "comment": "Malware payload (Heodo)", "value": "4cd6258f204c00fb138dab1133194845", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279377, "uuid": "c93e009f-345c-463d-986f-88bd454adf4e", "comment": "Malware payload (Heodo)", "value": "855c2640981ac3aaa2a19654d4ded4984469dbbede05273792a5bd2cf4fa3692", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279377, "uuid": "bc9bdded-6acd-4d8b-a40c-509bd0d1356a", "comment": "Malware payload (Heodo)", "value": "6d116011d3aba9a50a4040c8e666209e4e026f26", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279377, "uuid": "64092f1e-66a9-41fd-be31-6041d4095995", "comment": "Malware payload (Heodo)", "value": "538dbfb0345a09fae66530b69b092942c822053158c22b5c8b161561dd3f1974534d9841c7ed6ad13da59a7f686330b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279377, "uuid": "ab825992-a62b-4640-82a2-408931f4484c", "value": "T1F515233C5F67790FF5997C362AF3847AFDF90858DC96E90A17431A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279377, "uuid": "e7220c28-098f-4d16-ac1b-84f7f715ad72", "value": "12288:V4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sO:KevtlkdJe4m19FgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279377, "uuid": "27177105-da22-4b60-9153-6acf89a56ea2", "value": 895033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279377, "uuid": "af6b1116-4e0b-4774-a6fe-0056276d7002", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279377, "uuid": "e18161d1-5736-4210-af7d-a06b6c4d2e92", "value": "0Ho7G4OAFXoirBGUnwQYjy6oFP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99448825-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678310664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310664, "uuid": "4f759422-f816-4d3e-9b35-753b7da4718e", "comment": "Malware payload (Amadey)", "value": "5ff83d0896db3f702f09bcd8c943cea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310664, "uuid": "c2e73dcf-c975-4a3b-b7a3-6615c67fb3aa", "comment": "Malware payload (Amadey)", "value": "857cd795eb4ddafccdbf8c48e5a0c5eb0474ba2cfb68e3a9aa7024ff80533dbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310664, "uuid": "0d99f4e6-213d-4e00-937f-1a3cf4cd45ed", "comment": "Malware payload (Amadey)", "value": "6d3c905275559a797bbb5be5fe41a0daf56f5d3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310664, "uuid": "96b0ef83-589d-40ac-87fe-3cdcd9509b67", "comment": "Malware payload (Amadey)", "value": "6aee854f34db86939d2294b576e93ac8bf061b547f628f3c8f4d30f9b2bfc3cb8d89322a37b362d063e653d73a27a6db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310664, "uuid": "56cd7ebc-6397-4524-9be0-d5e46637ab46", "value": "T16B936C1030D2C071D57E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310664, "uuid": "a43a9a3c-b3ec-4852-901e-eaa909ac0c29", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310664, "uuid": "2758153d-f891-4415-98af-7e7885f2e4e2", "value": "1536:luON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUbaI89p:luhVZbtvbpxLHoUsYuNhV25LJUbaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310664, "uuid": "a688e946-0b18-40fb-927f-5b82a8bc893a", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310664, "uuid": "4dfbaf3e-f361-422c-8b8f-3843717d7fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310664, "uuid": "f1f6f30b-770f-4652-b803-bbc6d335ecbe", "value": "5ff83d0896db3f702f09bcd8c943cea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e8efe5-bde2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678301803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301803, "uuid": "2e98cd55-ad0f-4652-b294-916dd557f6b4", "comment": "Malware payload (Mirai)", "value": "f9c87b82429728f096435bd856aa2c78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301803, "uuid": "0b3289e5-e369-48e5-b12c-5091884776e8", "comment": "Malware payload (Mirai)", "value": "85d7a811601091947a0da02f4dd65f846874ebc9cea9e6022d71f6b60a3db889", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301803, "uuid": "f161dee9-0a58-47ae-8538-ee0594129272", "comment": "Malware payload (Mirai)", "value": "bd1bea59e00de67f752843d4ff8f08a31bedff95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301803, "uuid": "bc1c6676-272e-495e-9887-de0e68dd4cc9", "comment": "Malware payload (Mirai)", "value": "4fab322c1f529c7770d036094b52fd71320fc9bf7ad227f936a33412a2687442314b0d050e66edd408df4f367e1c6364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301803, "uuid": "47c1c60b-b103-4436-a793-6d66eb6598cc", "value": "T18ED2E003F0E58A48E1AAC13464FDFE451090AF4AC5645FFDABC47133A9B67387A90BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301803, "uuid": "334668f0-acc5-45d6-af16-735be535f254", "value": "768:3c7XPIwS9hj4R4aOFch3EtiSZJxrenbcuyD7URQRjx:32XPIjjqOFcxGJdenouy8RyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678301803, "uuid": "0eb9ac63-b6b3-47b7-af0d-d24d387d6855", "value": 28692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678301803, "uuid": "e2870ea1-302a-4912-b70e-9b2d1a4a56e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301803, "uuid": "ba2a6dd9-4be7-44df-a428-b16b3ee2e76b", "value": "f9c87b82429728f096435bd856aa2c78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220a2b32-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274816, "uuid": "33cc6783-497f-4b78-a484-5c4023714b8c", "comment": "Malware payload (Heodo)", "value": "c4579c03afdd6ab4658c5cad680d9477", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274816, "uuid": "a7d92a60-371b-4f1f-9af9-6b2d44abcb12", "comment": "Malware payload (Heodo)", "value": "85ed425201716065d62e7d2085d177b5c58a42380614643c23e20ebef35577cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274816, "uuid": "2c8b5827-f877-407e-9154-7fd64eaf09cb", "comment": "Malware payload (Heodo)", "value": "ed933a69a5b108237d42014320554cddec54d36c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274816, "uuid": "bea20dbd-e4a8-4565-8d0b-ea75eeabdac5", "comment": "Malware payload (Heodo)", "value": "bf8606fff6eeaa28e391833d4a9d553685c0b9a716ad98760a603aa86ffb26be44d505c447a4a8269cbf1d5d84c75aef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274816, "uuid": "f29ed065-44be-40f6-9518-b82658ebf311", "value": "T1F905233C5F67790FF5997C362AF3847AFCF9085CDC96A90A17432A9209AF2056794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274816, "uuid": "19213c72-7bd1-4f02-8bbb-3a9ab28c41b6", "value": "12288:I4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sQ:/evtlkdJe4m19Fgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274816, "uuid": "0af608f9-1208-4ab1-b4af-4acf84be7841", "value": 863465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274816, "uuid": "05acb13e-95ca-4165-a824-9ce756530f95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274816, "uuid": "670b6bb1-4f2e-4894-a31b-f616ea1441ae", "value": "xUCdPFxFutfDFEv8E.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be54abbe-bd6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678250597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250597, "uuid": "e62f3686-ad6d-45ac-a4b1-9a7ee937e231", "comment": "Malware payload (Mirai)", "value": "a40d9fd2b78dceb6a3e9fd0c5420afc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250597, "uuid": "7e70fb79-9165-457b-bc16-a69512cca86d", "comment": "Malware payload (Mirai)", "value": "861ae07502d1c1d32348adaaeb7a0b9bc66e0711da3a678acfb5c4e15e4b2126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250597, "uuid": "97fa58bd-51ef-4988-b1d3-98bc15a76689", "comment": "Malware payload (Mirai)", "value": "541fec2c9144bd61fe6f36c4cfbfe3eaf1c52315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250597, "uuid": "52dd4d3d-246d-4df9-8a6c-a83d796a5b4a", "comment": "Malware payload (Mirai)", "value": "16cc43f04321cbfaa37ec024c531c2baa1e95e03a2f6b4b191ff30ed47852258c0b28b5b8cc373b436cddb3ea79447ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250597, "uuid": "d8c9e5f0-f7bd-407d-a984-5649e5066a26", "value": "T102438D37E86E1E74C04641B074748EB56F23B4C893972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250597, "uuid": "bded844b-d287-4594-9d85-186bac562afa", "value": "1536:9aa0brW/Od9hlCRzaI8KwXFiMpfDCMB2+Wc:9v0brWGd9XFIjw5pfDg+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678250597, "uuid": "01043080-2d65-48f0-8454-fb2f4ea99ea9", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678250597, "uuid": "b10687c0-955a-4d26-909d-d324546a5bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250597, "uuid": "f451be9e-fb2e-441e-a2a9-d33255b36ddb", "value": "a40d9fd2b78dceb6a3e9fd0c5420afc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a745def5-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309399, "uuid": "1927ddeb-4485-4223-a078-e8e115637e05", "comment": "Malware payload", "value": "21fc657c66b8e04cce51a99607a727de", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309399, "uuid": "aba713d0-1424-4b07-8a72-2bcb45236494", "comment": "Malware payload", "value": "86bf51ca3360612dc4bbd5cfc4bb7e2224224477964391dbcb29db8c3fa1fd3c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309399, "uuid": "215e18fe-a06f-4b1c-960e-cfc4b3383aa7", "comment": "Malware payload", "value": "e072d5753cf003cb5dcb9ca8cb34080829a31637", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309399, "uuid": "c8f37e9c-c17e-49de-b7b4-8b694c790bb0", "comment": "Malware payload", "value": "2de8a2dd53a4c18a05bda0accf6101c8cda353b85a067b405dc8fe99e25ce6e3f56fbeaacf2b4635850e92d549319136", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309399, "uuid": "5bd19ae5-a5cc-42b4-b584-1dfc608a6412", "value": "T10753295D6FDCDE5C8346B2A78C5B0BBBB53706A340F4C4792828B1660A4D33D2B4B5B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309399, "uuid": "0a1067e8-dfb2-4e88-ab43-c253d7dbb97d", "value": "768:F+bUERihnU5kTEranYq9RB0OW1zFS3yLrzODp2dX8QSuci6FbDo16GupbPAB:IwhU5kTSWhEFmorzi2zfEbeupzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309399, "uuid": "78d27c21-56d7-4aab-a514-3f4424143cd3", "value": 65052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309399, "uuid": "11dbb32b-7b58-4ee8-a048-228385d2e44a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309399, "uuid": "1de70756-a303-4759-8bb0-c3ec95c48023", "value": "839280_227_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f02a2a2-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcarusStealer)", "timestamp": 1678308419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308419, "uuid": "56f2b945-3284-4a52-96e0-5be0b588047d", "comment": "Malware payload (IcarusStealer)", "value": "6a78bd0e44ac25cf4472a4b5da44b3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308419, "uuid": "38e1e7c7-9a79-417c-b7e8-58d47f1ed0a2", "comment": "Malware payload (IcarusStealer)", "value": "8711fffca6194b39a981b40f0db1225992ab3f96823a2cbe61c6547490b5abcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308419, "uuid": "5f3e64ab-be1c-4a78-8456-f0e078f1dd92", "comment": "Malware payload (IcarusStealer)", "value": "c432433cda71522abebe78989ad773743dfb4d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308419, "uuid": "18365627-b705-4eee-b6c1-be04a9f670c5", "comment": "Malware payload (IcarusStealer)", "value": "c1aa391211377e1c4a88f50f55c0e8cf43fb3de166cfb32b4c2cc6f6400156e0171d9be912ffcb04c7b3ecc3da144098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308419, "uuid": "fde7e3d6-a23c-43a1-9130-58c08d391fd8", "value": "T17FB45918A47FC05984A3EEA52DDCA8FBDD9E95F3640C703301A4932B8B55B84DE4F4B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308419, "uuid": "ebfc70c2-8780-4ed0-ae56-634f7fb0d690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308419, "uuid": "3f7232ee-ccce-402b-9c59-48d2181fb850", "value": "12288:3g5G3DW7oEKY8AZF1+THsPXF3L2LY5ZKhbQvpM2gv1aXlA/Z0BaxL2o:3RTW7oEKY840H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308419, "uuid": "d82c5c1b-9730-4cca-a7f2-69309564e178", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308419, "uuid": "33df9015-2077-4080-b9c8-2e41cee8f9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308419, "uuid": "35b8e461-3f92-4c8e-b3f4-38fcdc6d25e1", "value": "6a78bd0e44ac25cf4472a4b5da44b3b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974ab4fc-bdad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678278878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278878, "uuid": "ee420d22-aca4-441c-b2b6-a0a18ad44238", "comment": "Malware payload", "value": "fc4462b1448b7db9f905be31b1bb288d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278878, "uuid": "e3c4abeb-f9d4-45b4-b5cd-2db1970e1ec8", "comment": "Malware payload", "value": "87884144ff48d4fb0b4dc7d7677369524be8042dd195a1080fddba1dda290821", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278878, "uuid": "442fbbc2-aa6e-4f15-8540-90bc843892dc", "comment": "Malware payload", "value": "815b3bc354ff384c7a51e1fd76d411b4ed589c9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278878, "uuid": "592918f8-1066-4bb1-9ab4-775841b0eb26", "comment": "Malware payload", "value": "60c13bb516380736fe58d100d13e6e35e820f71211ea57dc4f84669e898bfe99e27b758233ce361b3638120403758a91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278878, "uuid": "889e7a2f-f97d-4e16-870d-6d0af6469dfd", "value": "T117142A1261CA7DA1C4310931ABF767D8E33CAE100A66C79F33C82568597C28EB5B97D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278878, "uuid": "8e0b149c-e8f9-4a38-9488-171db55f686a", "value": "b10f24f888005218ad8da0ee59d3b6f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278878, "uuid": "b4fd854c-99d8-41af-b680-1e87fcc17dc6", "value": "3072:3M7l92L2002YwWly6kAeGj7wYp3wwXmx9y7WAMWkQh0khzlqsy7Ft6:c7l9/K9TAMk+sy736", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278878, "uuid": "8c2d6887-199c-484c-9536-3c03525625ae", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278878, "uuid": "6a5f0d9e-d280-4574-86de-36cfe34148c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278878, "uuid": "1365ac14-95c3-474f-9ba3-778dd39d7b53", "value": "fc4462b1448b7db9f905be31b1bb288d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aaf07f-bdb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Specter)", "timestamp": 1678281637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281637, "uuid": "fa1ef098-fbf3-4333-9deb-0993f648cbb2", "comment": "Malware payload (Specter)", "value": "0b43238a9338f371ff52ba2d4d9ca848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281637, "uuid": "13ae4d5f-4716-4455-a7c0-17e76e0b0bca", "comment": "Malware payload (Specter)", "value": "87c67665679f024f2988090987471b722cb6f59441c918802054319de85e579b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281637, "uuid": "6d229b2d-6db0-4034-96d5-05a03e6f1f62", "comment": "Malware payload (Specter)", "value": "01d1e510863f41bf091c771bfb6734ce38e1ae55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281637, "uuid": "a2ba8467-b21d-4044-92d8-66c3cc745af4", "comment": "Malware payload (Specter)", "value": "cdbef922769be4d87944a73155492be6e1a06d994d2108b157cf73cd066fc400c0b8ec184c4009b374437176c214b7d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281637, "uuid": "77393ce3-e03d-4230-8b67-2fc2a4a12610", "value": "T153059E1AF461B258C2C31077EEAA71CD30431B686FE152F3E834BB2797958D5CA718E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281637, "uuid": "7f9c0ad8-532b-44b6-b256-d71391ba6ab2", "value": "24576:ar9T5ItM/3/X84TuZyfc9DvlVB9wyIQphnc7bH:8pauEOwyfUTlH9KQphnc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281637, "uuid": "bdc3b9aa-588d-41df-bf42-40d852da1df3", "value": 852728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281637, "uuid": "35ad18c6-e54d-4b00-a055-c8409045325b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281637, "uuid": "dad1ed24-a352-46d8-9116-62cb5b036828", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ba48af-bdb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678281288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281288, "uuid": "d8faea0f-2455-49a6-924f-d16dc37b5aa1", "comment": "Malware payload (AgentTesla)", "value": "d92a06bebaa2e64c56be17f00aaf61bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281288, "uuid": "6f7d1acc-0049-40b2-a7b4-b0b5d9acf049", "comment": "Malware payload (AgentTesla)", "value": "881207aeb4739ff5897dfa07215f57e6dac8481bd05e3f42c81f43de3fc0ac45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281288, "uuid": "ec9fa6ff-cc79-4be6-aee1-1ba21268dbf3", "comment": "Malware payload (AgentTesla)", "value": "cebb63817143c4b218cc6cb26bbc68ce02e96fd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281288, "uuid": "587b0377-7c24-4455-b868-e8d671b03d81", "comment": "Malware payload (AgentTesla)", "value": "51b0677f6b3b1eb8362c6d2360f8c0eca5d405b386d1fc73db33ce9e7d718ee665dc3455403bc70cfa153f690c9fc426", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281288, "uuid": "5cf34ed5-2cc0-44e2-a9bd-83fb8fcded8c", "value": "T15BF3286993C98A52C72D40F4C4A01108D7B3A1535607E75E4EB19CFA3F0A7DB363ABE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281288, "uuid": "a87e25bf-8a6f-40f7-8deb-ce5741f9bf0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281288, "uuid": "6a011334-9639-483d-8d39-22fbbf9ce879", "value": "3072:zSRBulzuTfg7Ak1qmACeOMWu08Q4QSH+hQfmERU03p8CFgc6:ORBtzg02/AfOVu08Swfm6/+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281288, "uuid": "adbc2a6d-1e0a-4769-9234-6dd944c0f043", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281288, "uuid": "7cd76d05-07fc-4440-8557-326701c67af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281288, "uuid": "a1bbf2b2-e760-40f5-9c8e-ac229c8691a0", "value": "881207aeb4739ff5897dfa07215f57e6dac8481bd05e3f42c81f43de3fc0ac45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dab2b2-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678261380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261380, "uuid": "41ad9882-474f-4e4e-b85b-c9f693aea1b2", "comment": "Malware payload (AgentTesla)", "value": "5123fc278889065816c461686cf52f0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261380, "uuid": "84fa0862-b56d-4111-8e98-c3fa9f0b3367", "comment": "Malware payload (AgentTesla)", "value": "88b472dff56348cc6b3a7fbacdd7a935a259be05c24f72867f940e5dc108425a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261380, "uuid": "76f3d40a-1de6-40f1-9e78-a615fa8069ec", "comment": "Malware payload (AgentTesla)", "value": "2a33b4644e6e4831b0508a81ab8cece0edda43cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261380, "uuid": "70952f4e-c6a0-49e5-81f2-736db8c0cb08", "comment": "Malware payload (AgentTesla)", "value": "329a47744ca5ab00581147e0f5404542635bd45c3c1b21fa35d1f92041ebef596a14e9c68ec7eeb635e253c596024326", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261380, "uuid": "93a63c00-524d-45da-bf19-52e71c75386d", "value": "T1FDE31906FEEAE9A1C3985736C4F7482403B6DD63A557E749A98D33E219273B34D03A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261380, "uuid": "12376e7c-ff7d-4392-9f77-a44380b12e2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261380, "uuid": "595eb2e5-0d36-4066-8da1-0e4f0b70a8db", "value": "3072:8vXZsqG8xkWMiAv5dxy7l/lvXq9WKPDfd4h:8OTvdY6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261380, "uuid": "4773faa6-0f32-4eb6-84dc-f250539b06fc", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261380, "uuid": "2387f9c4-0c87-4886-97a9-b0fd9291e9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261380, "uuid": "ddada331-8dd2-4527-9f69-25adf0c715ff", "value": "Banco BPM Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da2e7f9-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678286109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286109, "uuid": "9f51c358-5949-4361-b701-95b434ae1615", "comment": "Malware payload (GuLoader)", "value": "22802bfcfb5d94b0de943c6eb2cfe4f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286109, "uuid": "dc63dd6d-ab22-4c69-9129-9eefd88cfe99", "comment": "Malware payload (GuLoader)", "value": "88e172bb19b96e6062f5fbbaad8471d71715a74d666fbd1edc6e0ea2dc5a637d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286109, "uuid": "9cef90f8-1271-4c60-99f1-20f572ab76f5", "comment": "Malware payload (GuLoader)", "value": "12ed453d1a219bc987d9a01a8baa7ac0bd6d1b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286109, "uuid": "f73ff043-d09a-45eb-9d02-3a5652feb253", "comment": "Malware payload (GuLoader)", "value": "b36935d0e46260dafd467ddba420c7bbccc5bdeb58e01c080c373d768edbdaae7d09c05805b2f5a55167eb82425ff5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286109, "uuid": "e3674a34-5764-4cf7-91bf-807adf46e12b", "value": "T10AE409A790A04115C9518BF31A7BBF794F1B1FBC96141C1A907432AE66B7BC3DC33A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286109, "uuid": "3b689cfd-4e1a-4c23-aa90-943436be3f3f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286109, "uuid": "e5ebafbc-c065-484d-875d-350a492a4251", "value": "12288:4bV7K1f4pvNYYD7TabeslVSLuPb/5BYmnnCNu5+U3pa1u/+Hga:4bV7K1f4pv+YD3abeslVSLuPb/PYmnC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286109, "uuid": "5bc6a4c5-9f15-4337-b483-574c318d3149", "value": 659424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286109, "uuid": "acf09a08-0c6e-4e47-ab8f-33081f0ee895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286109, "uuid": "1eefc3d2-b429-416d-b324-11456c793a64", "value": "AS12023000024196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2f8a61-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678267751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267751, "uuid": "a87e165f-115e-45ff-9910-6756b2afa38b", "comment": "Malware payload (AgentTesla)", "value": "5be37d0144e047b2742c61f4934e564e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267751, "uuid": "3dbc7884-ee1a-4e0c-837d-a496e5f4ed63", "comment": "Malware payload (AgentTesla)", "value": "893c4a1d075e043f0e7b8e677b1d092416164b67f799e1803f69949c9b951698", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267751, "uuid": "a79d0400-1280-46b6-acef-73295db9db6f", "comment": "Malware payload (AgentTesla)", "value": "04db785ebf539a17444d56075e2f955a98145ccd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267751, "uuid": "1db6dcc3-bd3d-42bd-8f84-752ff3317f13", "comment": "Malware payload (AgentTesla)", "value": "25230d218da2d65122cb6d2def449ed659f297b3e268a7792e232da98b1daf03a06c37816fbc43eee0906a1282d9a02b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267751, "uuid": "26d4c508-e85c-423d-ab4d-d97054cd1772", "value": "T19B44237219BE93752621931E10B38B067D58E25DEF990F16F4E74168CA24B026E8F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267751, "uuid": "00ce46eb-2371-4c42-8471-af75473a2210", "value": "6144:kStVPuwqplcC37RvviVF9p2lXtofD/cG8jXM:ttVPn9CrRvv8F/egMjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267751, "uuid": "f96ee294-75ae-4271-8ef3-6f672f8662bc", "value": 258833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267751, "uuid": "f4625215-0887-42e5-be3a-002afc843d77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267751, "uuid": "32eff11e-11fe-448d-872f-bd3f3b580211", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abedb41d-bdc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678287932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287932, "uuid": "9dc68040-1a8b-4193-9d15-b2f4b6d44503", "comment": "Malware payload (RedLineStealer)", "value": "88792fbc781cb8bc08e82fe73d9d9c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287932, "uuid": "537cb545-2ea5-49e9-b2d5-71ebc290e431", "comment": "Malware payload (RedLineStealer)", "value": "899aa652a5bef37ee362d1906aa058e89919b3b1824d91879c663ef4cdf502c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287932, "uuid": "1d5d4a7a-383c-4960-b7f8-cce4a2bb0976", "comment": "Malware payload (RedLineStealer)", "value": "8e8de2b0566217696052fd39c62677f4b625aba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287932, "uuid": "13bc3661-ae16-4e95-ad92-b333055a170a", "comment": "Malware payload (RedLineStealer)", "value": "55ce8953af76694148c9f97651a35dd62622e87d03839f1c2cdeb1c827e1a994ae78d4ca30873b5894696187c1a00ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287932, "uuid": "911957cb-7522-49b7-9f55-26beeef83e3a", "value": "T163545C0DE9257419C37D84FD958CD3F9DCFE49B793AF6AA247E42075EE021E861A8023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287932, "uuid": "61de8161-7bbf-41e7-b896-0ba034292d9e", "value": "1f7948b75e8007bde9f40a49c22ca16a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287932, "uuid": "20cf246d-2f54-41c8-bff6-51f6434037b3", "value": "3072:IDe6dJXwnWkBJyMKN9CDSBVhiYFuD+JXwW+5WqkTiMG1EsoYrVccdhkX0zCuVn:IdXwnWkvS99r8Yg+JXHqVMG1EtCqMrz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678287932, "uuid": "ae895346-ad2b-47df-a57e-9e2a485fa25b", "value": 298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678287932, "uuid": "02041841-f5ff-4b56-9aae-114c371756a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287932, "uuid": "e8cb2426-3dbd-4572-91ca-32175269f13c", "value": "899aa652a5bef37ee362d1906aa058e89919b3b1824d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d962c2b-bdef-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678307128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307128, "uuid": "18d4a8c4-c866-49fd-8578-29b2c90c0ee2", "comment": "Malware payload (RecordBreaker)", "value": "872f9ec4fc086d344006760ceeb423dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307128, "uuid": "034433c2-b851-4364-9169-ba6d6d64e705", "comment": "Malware payload (RecordBreaker)", "value": "89e18340e51790ee07e1c6845a93f737ef6be8470e5a1158aef24539658eb235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307128, "uuid": "de82eee7-30cb-4d76-97cd-14139787e5af", "comment": "Malware payload (RecordBreaker)", "value": "fc6712dd6ddbf10e89c8766859b6fc1d53a925a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307128, "uuid": "8ada1c4b-09f2-468b-bc9e-db0806dd0483", "comment": "Malware payload (RecordBreaker)", "value": "ca273a0387537174cef852bef66c798036a30ef624c604de5aa234ef1f08daeb494e604b2ce4d742b603ae241cdbb168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307128, "uuid": "28b71cf8-aaaf-4a2b-9398-e4c3b2223e16", "value": "T1EAE623F561F91042E2A68E347FEA7D19B1F5355242C1973E708A29E52B32740321EFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307128, "uuid": "92a36563-121a-4093-a6cb-ab6261e97755", "value": "16cf5db3878b2dcf0f97ac9d337625cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307128, "uuid": "5f8abbaa-db4c-465b-84c7-9262986f9039", "value": "393216:kccC5cYkegfafcwvHgApo65UQea5MCjQXowha8xPgs:7cPdegfalY4oAJdc4mNgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307128, "uuid": "4bd001c6-eff9-44ea-b2a0-e94bf261defb", "value": 14812656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307128, "uuid": "f1c7ef3b-6838-453b-af2c-7c2749cf9d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307128, "uuid": "93e6ce54-a46d-4fcf-8e4c-9eb4186feee4", "value": "872f9ec4fc086d344006760ceeb423dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5617778b-bdb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678280057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280057, "uuid": "c1db6e4a-c078-4d09-b1e4-a21807285d38", "comment": "Malware payload (Formbook)", "value": "8e69e96912a35ef72e0270ec2b3406c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280057, "uuid": "06b95af5-da9a-4c3b-b9e6-d3112dd0130e", "comment": "Malware payload (Formbook)", "value": "8b590e52e52d0d4f86e73e6248acb8b5cb8f4cb6cf2e6607aef2e599cf40c6c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280057, "uuid": "4798ae75-b817-4d5a-983a-09f008929069", "comment": "Malware payload (Formbook)", "value": "d301d608051f68c139128336f25888e958b55baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280057, "uuid": "fa4342e1-f78d-46d4-9cee-7ddcbe1ec19b", "comment": "Malware payload (Formbook)", "value": "28bba75d48b5ac818a34c18d596ebe1d09f08557f002302bcf6b5e41409877550dd022876f07810bf585e976baf7ea6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280057, "uuid": "08a85c17-dd3f-4d94-81db-09b3276b266b", "value": "T158256A3B07A81AD2DFB4E2BEDA44ED48FBE09542F555CD4E19C208971853A0329DBCDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280057, "uuid": "c848d647-1930-4d69-851d-1f5c3fbe4588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280057, "uuid": "307f39c7-5e13-43a1-9055-10f07aa5ff05", "value": "24576:Gfrgpk1/tX0BhzdbPF/pqZWejVC/6R03HGP7a:GkpQ8hzdXqZ5JDRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678280057, "uuid": "fb7ffea3-b0d0-4df4-9707-f433359888c8", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678280057, "uuid": "6be61d71-475c-4cbd-a336-c8d9447a7d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280057, "uuid": "45e2487e-cb4f-466b-8887-3e20eac844d5", "value": "8b590e52e52d0d4f86e73e6248acb8b5cb8f4cb6cf2e6607aef2e599cf40c6c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bc1538-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308368, "uuid": "cd8f244d-3793-4cf6-88dc-202b729df39d", "comment": "Malware payload (SnakeKeylogger)", "value": "57c0c2145f5ee4eaf5fe1bf2a80773d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308368, "uuid": "3f97f728-1a74-448a-baf3-e69a82cfa91a", "comment": "Malware payload (SnakeKeylogger)", "value": "8b5d7a796b73fdf3898ef5899cdb03f92270b9fad8c520cca19d957bce8e59a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308368, "uuid": "18aa9379-e492-4097-a5ec-de9d447b335b", "comment": "Malware payload (SnakeKeylogger)", "value": "2544198ae47d327848074bba5ac0f3d26b44abf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308368, "uuid": "1d862833-7ee2-45b7-8502-fde03740efa7", "comment": "Malware payload (SnakeKeylogger)", "value": "1f25710a4004ff4438791b8d20def4dcc74cf58fa9fc310dacbcd4751ecb069d886d5906320bd65bb4856aaaddd23f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308368, "uuid": "8c8dda96-ef96-4e04-a2ee-93efce2ec3fd", "value": "T19E15CF98B3714573EC8F81790A27C5DF2D44FA8B7611E237573B7A42E2491BF7A88212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308368, "uuid": "b9a934dd-1406-4830-8bd4-3a558b819aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308368, "uuid": "334670e4-2fae-4cff-bc2a-081d956a717e", "value": "12288:zJEP78/2iNnLhfJknQC74E6AlQ5BiQjD0TgKZtp+FuO0erNw0Q9ks31yFOjSHX3I:VEP78/1hhfMQCfIPjhcpVOftOk10uPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308368, "uuid": "02fc1aaa-0186-4e4c-895f-bf28c2a99818", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308368, "uuid": "0c3b7b74-0ed5-41e7-8d19-6d859b026589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308368, "uuid": "1e57dec7-0f6b-4990-bac3-70272d1a0ecf", "value": "57c0c2145f5ee4eaf5fe1bf2a80773d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4a730e-bd58-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678242403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242403, "uuid": "c392ea26-14fd-4126-8256-71825184fa74", "comment": "Malware payload (RedLineStealer)", "value": "078594e2ec8f1b2481d493ca8b67af44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242403, "uuid": "af88c687-fa60-4f17-80c1-ed996dc4db0c", "comment": "Malware payload (RedLineStealer)", "value": "8bb2f1b6ab119fe6fc0293fa4e325c01dbdd79a5dcb2b73db5d151217dba7c0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242403, "uuid": "8986a4f5-3e21-4268-a4fc-abd12ca95bf2", "comment": "Malware payload (RedLineStealer)", "value": "d961fe2be92902c074b04272f277320fa994490a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678242403, "uuid": "98c0425f-0f02-41a6-9485-6d0f210a2215", "comment": "Malware payload (RedLineStealer)", "value": "360230877b170bb46ab559a787a00ae1ffdc0d26bc5a687877dc726974668c368296e3b95e7342b4116db7e0fd13fc1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242403, "uuid": "df4e53a8-27ae-416f-8bf5-72643b8536ae", "value": "T1F584DF13A6E0BC51D76A4B329E2ED6E42A1FF5508F6BA72A633C4B1F05701B1C6B3315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242403, "uuid": "44069557-c958-4248-87a3-42236151d8a4", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242403, "uuid": "94a4368f-18cc-45cb-bd1f-95d454fa899d", "value": "6144:deG3L85kZb5aR5MO+eul+xtlVsQbz7DptVuBTKreZv/74DYTP4eUM:YwQ5kZsTMO+kbuo7VcTKiZX6YTUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678242403, "uuid": "6d07091d-a932-4e1c-a392-3870873cccf4", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678242403, "uuid": "073619b2-489a-4739-8295-fea4af286ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678242403, "uuid": "96fd16ce-696c-4feb-9e42-804fba75937c", "value": "078594e2ec8f1b2481d493ca8b67af44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d206c3-bd69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1678249717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678249717, "uuid": "80bf4f26-cc07-4ba2-bf77-27b8ec176d46", "comment": "Malware payload (Adware.Neoreklami)", "value": "9926000294771eb592dd85d1b894b76e", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678249717, "uuid": "0adbe96a-1f70-4d23-bb88-0b4cdfc891fe", "comment": "Malware payload (Adware.Neoreklami)", "value": "8c394e93be7bbdd0af7794c7f247e6c87fc35e03615dba0b9f501abd74b2e66f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678249717, "uuid": "e417ba56-d6f2-44f6-bf67-184a51d7fa38", "comment": "Malware payload (Adware.Neoreklami)", "value": "089d3cdb45fbd944727d7aaad73f1e1bdec777c0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678249717, "uuid": "7ca27c70-7250-4ae4-bb1e-3499988af341", "comment": "Malware payload (Adware.Neoreklami)", "value": "5e04177f4198a2e954333b139c9e659c2222afe45054ccd6f678406dd45e3bc0e010b85114137706ec650f27215b1374", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678249717, "uuid": "a801d1f6-f341-4f1f-889e-704e4455026a", "value": "T13376335079DADEB2D9D12377DC243CD1C0F0FD6C8E755A331B9AA79C1CA639680382A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678249717, "uuid": "9e827953-823e-47fe-91fd-6bb536d61bcf", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678249717, "uuid": "ce5d1b2b-75e0-41c2-939e-8fda02c0bcbd", "value": "196608:91OiFpCxGANsXXTn27YXaYtk/juWqW+T1H0ksf5QvH3w:3OiLCxGesXXTn3KYC/jurW+TijBQPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678249717, "uuid": "30edfac7-e1af-49b4-aaa9-9842a75f4b39", "value": 7597621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678249717, "uuid": "982bce3a-3a08-4e81-b51d-9e4e31365b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678249717, "uuid": "781086d2-4c3d-454a-8968-ac7f30b0119b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5863b8-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678282698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282698, "uuid": "f2ab3de7-bb63-4950-babe-9ef0f31f06e1", "comment": "Malware payload", "value": "8879fffa94fe9d89d461965c022bb316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282698, "uuid": "9ca56593-5524-401e-a851-dac9bae59213", "comment": "Malware payload", "value": "8c67b6334dbb1b10977e14fb66feb21638278b488305c0c02253a5942cdcf9fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282698, "uuid": "2b56b087-0da9-45d2-a99c-7cf80ba17487", "comment": "Malware payload", "value": "496255e9010e11059c3b82b5ad7a26105eeeee99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282698, "uuid": "5bf4e6bc-d640-4cbe-977c-b0cb84a9fd07", "comment": "Malware payload", "value": "18f8ca46cbb9f448e368a6e6c3940befa691ce0820990888fe43476f25f9bbb20d8728c649de253d172ad994b776adea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282698, "uuid": "87361f2f-65ed-4f91-b860-d72fad2e85d9", "value": "T1A7059D5CAA62F0BBD43A42F817C1C276A4116F386317DCD7AE825D2EA1746F4723621F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282698, "uuid": "1c862c73-67b7-4c07-b224-14d0bff8c744", "value": "12288:kpxVVzpLHKfxhmxu0bN1HhXlY7yWnlzfNe01hVLZJUF0QagG7pBoLaCbIl30zRK8:hUIgG1BoZ0dCIvrt1QgxX6cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282698, "uuid": "1fded51c-5f13-4d15-9ea4-5539d982b6f6", "value": 840852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282698, "uuid": "ed056190-d194-4d92-8d9c-dee1e7557010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282698, "uuid": "2e818c2b-1794-46a6-8dae-8b9b1973d6c0", "value": "3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1e0956-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678259535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259535, "uuid": "27b60759-9500-4d71-95c9-e2f3a20f32e8", "comment": "Malware payload (Gozi)", "value": "c6f3e8fca98ff28eaf0ae05d55d25a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259535, "uuid": "db6c8c85-1608-4f97-a023-d571bcd03286", "comment": "Malware payload (Gozi)", "value": "8ca6d4d0d27c950e7bc234bc16b0a89bf9122ac5b708fa215ce7bf4009387350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259535, "uuid": "17ad4b89-ecd4-4c7e-9a55-4d36ff7c822b", "comment": "Malware payload (Gozi)", "value": "f55311179339c6a63ff8bd4fa9e778d42f53711f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259535, "uuid": "e0d2a995-c32f-4045-aeec-b8f51ac268c6", "comment": "Malware payload (Gozi)", "value": "4aff208e85de319d9362888e4b55235d9231f956f9f40d4c7dd174f02ddc8f63da3810fe4ce4acfeee2777d56811e522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259535, "uuid": "704be90a-64d5-408d-8560-120e6b529108", "value": "T107148E1253ED6C25F6735A319E3EC2F5272FBD638D28667B22146A1F08B12E1C572732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259535, "uuid": "de678a38-9643-402e-89d9-e5c5c9d26a0e", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259535, "uuid": "b4a7b452-f098-4cee-afcf-4f460c19d6ec", "value": "3072:vb3yZLXEOZu0UYKgcN6ugTCIKmO8YUAWDE/Rp9gRFGH52c:u9XTZu0zKnNYDlO8YI4Zp9gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259535, "uuid": "b20704f5-d76a-461d-a6be-1d64755bb4d6", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259535, "uuid": "789c2938-ec3a-4cb2-bf9e-47df9d12a73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259535, "uuid": "0ca32bd3-156d-4f1d-aaf3-2371871d31a1", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d619060-be02-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678315181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315181, "uuid": "f312bece-5615-4e85-9171-ae4a8c69da73", "comment": "Malware payload (Mirai)", "value": "1870ae08cee4d075e6880e1f7f34c216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315181, "uuid": "549bb725-fef8-4463-8e96-fe5927e477e8", "comment": "Malware payload (Mirai)", "value": "8f04196a2affe10bebd9774bd0cdcfb8bb1079c40557f967e9f5d352fef0857b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315181, "uuid": "ef2a693a-45ef-477e-8515-fab03ff307cd", "comment": "Malware payload (Mirai)", "value": "6c175346be2e15af9c9d443b76c6720f83ba4a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678315181, "uuid": "222f5dc7-7bfb-4faa-88a1-04a4dc7eddbd", "comment": "Malware payload (Mirai)", "value": "42831fbcc20920ea0d08d0b90eed7d4b0150ddea9f9db99672d0cb1b61fbf130d11ebc63f651499ab5529381ce6d765c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315181, "uuid": "a2e6efd6-691a-4d74-878f-89fbad18401a", "value": "T181F2E1FCD70820E6E56DE178D3704B48BC2A8F678142D50F50A6CC970E796EDB8926E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315181, "uuid": "839a411e-0b49-4932-be3c-ff90886aeeb3", "value": "768:eH6pNhZiBrzgBu05Rw1IBjaVXJeg2bHQfSUD7UJT1Tz/JgGlzDpbuR1JQ:eCDZi5wu05CGMVXkfbHJdV1FVJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678315181, "uuid": "1aa93694-6b81-46a2-a327-df2481f1da77", "value": 36628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678315181, "uuid": "e2dc5660-81b8-48a7-aa54-b78b3bbfab51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678315181, "uuid": "31be13e5-0f18-4c88-9c58-5e8b9a64e637", "value": "SecuriteInfo.com.Linux.Siggen.9999.26765.15052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239216d0-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268376, "uuid": "e9ab22c7-557c-4ab5-aec1-643db05f412b", "comment": "Malware payload (Heodo)", "value": "af9df0ea24f3c0ef58bac6bb1b7381bf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268376, "uuid": "a1689a2a-3cc5-44e7-8ca3-9fd5d88f72fd", "comment": "Malware payload (Heodo)", "value": "9044e5a27afb170dc13133af5a3f38dcd146af1a32a7ff2c6f8735c5459f4fb1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268376, "uuid": "07b28050-566f-42e2-a143-1d45a108fc8f", "comment": "Malware payload (Heodo)", "value": "bac6f7b263cc8d551a781402b9cd16794efa9b1e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268376, "uuid": "970dfda6-78d6-4f21-970c-468cf3365a80", "comment": "Malware payload (Heodo)", "value": "78a5058bee7ca788d3424ffef9e14282517dc8dd73b0a747b59e9b4ba8c411ea0da2f8eafa0fa22c34bd48f750166899", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268376, "uuid": "b2c8bfdc-342e-4bd2-be65-e7630939d503", "value": "T17615233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268376, "uuid": "4f62997e-de71-4fac-86f9-698fdc886647", "value": "12288:Y4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sc:PevtlkdJe4m19Fg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268376, "uuid": "ff4c8113-3561-4d20-b24b-1c702ce70598", "value": 898108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268376, "uuid": "133f24b3-cc2c-481e-bc52-de3fde6cd7ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268376, "uuid": "d4cfb7a5-a17b-4e87-bf4e-b537ff0f4dcd", "value": "5HhOyg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e828ec0-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678270676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270676, "uuid": "cf9d9e59-3062-4363-a532-b24baf86f350", "comment": "Malware payload (Formbook)", "value": "c1a8c992aac5a10c6ca89cedb772d567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270676, "uuid": "81ede438-6682-4dbd-9e83-a81dd9a0ad36", "comment": "Malware payload (Formbook)", "value": "9123b739b8d3d1c2f5a3dabf8c358c77175422d0e83f5edadc7584bd50eb484c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270676, "uuid": "06c059ad-9afb-4546-8ed7-a92b99fa64b8", "comment": "Malware payload (Formbook)", "value": "99ad74abf2717a297260df450e105e8a40cd16fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270676, "uuid": "bb11eb01-9cf2-402f-b045-d206ebc6595e", "comment": "Malware payload (Formbook)", "value": "1aa929cef91d268627e866af7ef8b65d63bdec3dc9f388938dc0e48c0c0e8a4654f64b01a94c7852b6ef84efe5b00a56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270676, "uuid": "d70433f0-29d3-431f-9422-692c5402d89a", "value": "T12144010235A1C5A3E86209711DB9DAFB6EE1BE058E024A4B77D0BF5FB5721C1E81F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270676, "uuid": "0d92ce48-de19-4de4-8c76-0e72db9de12d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270676, "uuid": "a1d1a0d6-5518-4cbe-932c-f546e78e241f", "value": "6144:gYa6+YxKBm16Bj9lWAbkKXVa9S02ZVh2Qs/cEpeXzhdGZbghHrOSh:gYI7maj9tk9Svu/cW0zhsKhFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270676, "uuid": "725fce62-c326-4341-a265-7a35bce261ec", "value": 270398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270676, "uuid": "012f5725-f7f1-4a78-8db6-b423615733cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270676, "uuid": "4453ae7c-7f29-4db5-bd1f-9dcfcc658255", "value": "c1a8c992aac5a10c6ca89cedb772d567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4ae2a1-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279400, "uuid": "f25c9423-1e4f-403b-bce7-0d71be58a07b", "comment": "Malware payload (Heodo)", "value": "f4ce51fccba47a77a807245c1ce2afc6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279400, "uuid": "015b1e5a-58c5-4a91-93a6-a618fb0b9a96", "comment": "Malware payload (Heodo)", "value": "920f91480032a3dd05b442f6359dd5ed5a1a3d2ba2a598f93bde3d2e079da6ac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279400, "uuid": "2645fe8f-f937-4fe3-96a8-d7b9f37a540d", "comment": "Malware payload (Heodo)", "value": "a5586a887733f87118c3b13de0a9adef0bad5590", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279400, "uuid": "21d0c884-5700-4610-99f6-34dfe08a1994", "comment": "Malware payload (Heodo)", "value": "fc400958f7fcb182b46708d442b09994d6f248d9c410b7b6c8ebba830f503dd25b2f4a3dd8770b3ce96ff6113b7d9081", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279400, "uuid": "5e20f1f0-5c78-4cce-a2bd-30fc03f54c56", "value": "T1CE05233C5F67790FF5997C362AF3807AFDF90858DC96E90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279400, "uuid": "2bfe56b5-464b-4b2f-bab5-7df349c0468e", "value": "12288:Z4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sa:GevtlkdJe4m19FgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279400, "uuid": "b0c44428-2d83-4924-baf9-cad6faad231d", "value": 871648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279400, "uuid": "5bcc7844-d609-49b2-87b1-3c59b84df861", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279400, "uuid": "e96644bd-1d0e-484c-9d98-04237b5c6bf1", "value": "fhXtJjQxIQQje4vAhjT551BHSJRO5q.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef150b-bde0-11ed-88f6-42010a9c006e", "comment": "Malware payload (BazaLoader)", "timestamp": 1678300714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678300714, "uuid": "ed8498b2-5447-4218-97ce-a0e6f136bfb6", "comment": "Malware payload (BazaLoader)", "value": "359466a449e57e086afc52510990d029", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678300714, "uuid": "3fb17106-5ae1-4820-aa2d-848efffe703f", "comment": "Malware payload (BazaLoader)", "value": "93a4b67fd14380dee622c0992a5cad89a79e459d138ffad661c96ecad1b673ec", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678300714, "uuid": "0118d8f0-0396-42dd-8e46-2f02cd916a5d", "comment": "Malware payload (BazaLoader)", "value": "c123385c0f261cd626e2ebc4cee485a9fa53b423", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678300714, "uuid": "d35805db-8c71-4fbb-a4c3-c8cdc9d51a2a", "comment": "Malware payload (BazaLoader)", "value": "5cc97fc04e1f0e06016899ded888f5b6e644176497b92a3100c27625b97b5e035c95ede2c0d23c25a48019127f77945d", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678300714, "uuid": "12ef41b7-24c1-4e5e-8fde-ea6c23c364b1", "value": "T1CBB6332B911416FCD7AF20B5811A7A23F73AB605137AC9FE62C11A8DDF633A10D36764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678300714, "uuid": "f03b7c91-8ec1-4811-b871-eca6646116ee", "value": "0c09e76087cc598c56527ef512a6e528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678300714, "uuid": "a52abf75-f127-4e53-98df-60aad9e3082b", "value": "196608:hYqfGgD58xx1I5xuHkFwJTCj+XMpI8zDS41/2l08IhA1/Qglx8a:KquaivQoywk6u1/2lDIh+Ycxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678300714, "uuid": "d9754c2e-0385-4aea-8c39-94848d0d0583", "value": 10427824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678300714, "uuid": "3f87ce5a-1ce8-40c0-9a8f-cc94bfc5b7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678300714, "uuid": "93917bdb-0dad-42a8-a18d-09367a2ee14b", "value": "how to get facebook ad credits.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582c3039-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268035, "uuid": "5347069c-144e-468d-8335-ad7aad37a2f2", "comment": "Malware payload (Heodo)", "value": "40120a9dfc39cd4ba0eff69a48f70238", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268035, "uuid": "14360cc8-bd85-467f-8fe6-d64f2f173d09", "comment": "Malware payload (Heodo)", "value": "93b2278ca162e14b6913007e15f43779011e0f38cceeafd07621a21cfba0691a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268035, "uuid": "fb47f677-5d74-411d-b526-c78005c63ad9", "comment": "Malware payload (Heodo)", "value": "217a6b28acd9d669aab30d0fde28749c155bcb0a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268035, "uuid": "6993592d-f8fb-4647-8180-b51b51e0bc66", "comment": "Malware payload (Heodo)", "value": "4961113149f1190ce8c1428ce163d44a1ee28a80d2be18ea9e0b190ce31c627f9e6a072dc40d4a304233633ec4cc9d28", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268035, "uuid": "5f28e70b-073e-4810-b798-d3b192f45b92", "value": "T1D605233C6F67790FF5997C362AF3807AFDF9085CDC96E90A17531A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268035, "uuid": "c141dac4-fe23-40f9-8a87-fbdf4347999e", "value": "12288:z4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sD:8evtlkdJe4m19Fg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268035, "uuid": "142e5052-70bf-4296-95bf-8d066890b794", "value": 870588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268035, "uuid": "3eb933c6-2667-4d38-bc44-d1caeb6bd0a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268035, "uuid": "9d6f1fd3-66df-4303-8775-2bf7d27f5aaf", "value": "fzdS9e9CQGF2FHyArbSaFFA9qCI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1e4b92-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678278106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278106, "uuid": "7eb74b9d-a33e-44e1-a084-6cefa99c8a74", "comment": "Malware payload (SnakeKeylogger)", "value": "ce30147aed92a20e3e1a9ce3daa29f75", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278106, "uuid": "f0c2ceba-d1a1-4eab-a347-af1312512d74", "comment": "Malware payload (SnakeKeylogger)", "value": "93d96bbf21e47a499496602a45728d358dbe44a9130e2b3b1aa2822e8f8532bf", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278106, "uuid": "7a4c2246-dbcd-4fa0-86b4-86ec5c232591", "comment": "Malware payload (SnakeKeylogger)", "value": "5e83b061764c300cfe5f149ab40fe5276a384ba2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278106, "uuid": "e6653e3f-0975-4b31-adbf-27013438e194", "comment": "Malware payload (SnakeKeylogger)", "value": "a4041850df06e1611778f30a452610239e4311ad18afb360f4201ccf568c0933b86e22ea50b4e5fd03fa4548c3f3bfd4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278106, "uuid": "3bf4067c-562d-4024-918a-b8d7eca4cc6e", "value": "T115E423019BAEFA7F73E49B211555676C18D2A94A6AB3778B7B40A1FC00B34D43F32164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278106, "uuid": "4d7b1971-6735-4476-85e9-7801ec42d290", "value": "12288:0aM/+8NXD1hkNfyJFslSWPL5XwJ4Q2U+jWMW39q0ybYqpgt/31ZHvETo8nPia8Rx:OTyK8hFAJZ2/WMqqRMqpgt31doAjPJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278106, "uuid": "d966c646-5dc5-4e90-81a9-ef6e39fe240e", "value": 668338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278106, "uuid": "b48cc35f-7775-4fdf-975e-c1818b7827ad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278106, "uuid": "1338d000-dabf-4243-98b0-5e107701a6fa", "value": "MT103 Halkbank,pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1eea7b-bd4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678236606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236606, "uuid": "51d5e677-d22e-4a26-9c04-87d7a5a3e905", "comment": "Malware payload (Mirai)", "value": "a35bb322294f36f0cf5ab916229a814f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236606, "uuid": "0a8f546b-e11a-4b3a-a5fa-6e332655270c", "comment": "Malware payload (Mirai)", "value": "9671043f7160b88c59ba21d91768f83605175469eb136fb6a3f6fe1308583171", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236606, "uuid": "92458067-4628-49df-b659-cbfa63d21a93", "comment": "Malware payload (Mirai)", "value": "588465d276a45f55727d53b85f795c973a3e7601", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236606, "uuid": "9262f579-cd09-41d9-936f-beebf4bf8889", "comment": "Malware payload (Mirai)", "value": "b1b603193cb4f749ab869e3498c33aaa14068a3376ac69d0a9f8f2e36caa7545e7ce0de599eb33f6938c3e4b8322d683", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236606, "uuid": "b00feb1d-b59b-431c-a7c0-ad44ca7182a9", "value": "T1A972F682DD83DCB5F82E13B5A0BAD725AB76F12A951DED0AD3912531FE42800A21734F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236606, "uuid": "24df8aff-b5c5-4e28-9b92-b5bc561bd434", "value": "384:fns86HBkeLosnLPuiiFOAC1PoA9cm6bt+s5kTGVV7:hIdo2fACsm6bt+wkTGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236606, "uuid": "bcc19f97-c59c-420e-8e3e-b362306902cf", "value": 16984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236606, "uuid": "21885176-4484-4d03-8bda-f19c729b8443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236606, "uuid": "c26239d2-69b9-412d-9d21-7bdca69f6231", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ecddf1-bda1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678273824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273824, "uuid": "3587a827-f116-4f60-ba62-fab4fd141436", "comment": "Malware payload (RedLineStealer)", "value": "6e80037f5d7af03d11e4705504c3c0f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273824, "uuid": "50827888-7398-42a2-9022-86d5fd094901", "comment": "Malware payload (RedLineStealer)", "value": "968abf589a80baeea44d2e9af46cbdc5619b0414990eb418703f6609cefd399e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273824, "uuid": "9db703ae-87c2-4026-91f8-ee9466509a44", "comment": "Malware payload (RedLineStealer)", "value": "72838b810160535b7583b2e51c54dc3b0a83bd98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273824, "uuid": "c3bed570-1bef-4689-ad55-d501aed39e80", "comment": "Malware payload (RedLineStealer)", "value": "4f468e3a32fbea5acc080fa2487338a423ec23e4920e3da30f4669986e91087fedd5f45c1e3e74715b25df780c6a538d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273824, "uuid": "09684fad-f915-4c69-ab46-c7d18814ff7b", "value": "T15264D10163ED6831E5325B715E3DC6A9262FBD935D7936EB33542B2B08B02E18A73713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273824, "uuid": "3a52d8b4-3cbb-4448-b872-924ebcd09b3a", "value": "2115960edb01d3d9bd07271fe70d5d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273824, "uuid": "ef0e9535-2451-46c7-b812-7d26fb76c8be", "value": "6144:L3XYSiqYdgBiRfJiqcL1Nbdd9TUlj5BWgAIH:LHdiqYdCL1NRd9MdBsIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273824, "uuid": "29d9d8c6-3a73-4161-83d6-a64ca8d3c637", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273824, "uuid": "3cbb08b4-7c17-40b7-b518-c4de806056b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273824, "uuid": "56518851-76a4-4bf2-953a-524acee24d73", "value": "6e80037f5d7af03d11e4705504c3c0f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9062fb-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678267851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267851, "uuid": "9cf35255-65e4-4503-a5f5-4acf68211ee9", "comment": "Malware payload (AgentTesla)", "value": "9d8418a30f0c274b333d089583c35904", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267851, "uuid": "c1c3913f-5e5c-4792-9dd8-4e72f10c752a", "comment": "Malware payload (AgentTesla)", "value": "978ec1f3c0109a3f008be32342ddb8c51737675a54dd5eb15325f3a39f73f4c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267851, "uuid": "e01466cd-ed5f-4983-99ac-82d8be5092e2", "comment": "Malware payload (AgentTesla)", "value": "751c96cbd194c9a643cca3f845f620ec2a6a5be1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267851, "uuid": "0b9c44f2-5fc4-4849-be1b-afbf58b0db9f", "comment": "Malware payload (AgentTesla)", "value": "e6e96a738a93d08360887597a357c11c241168f81f80f7c1edbb4850987719215ca2ebbd5b7e481a8a4194ecfc48e5b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267851, "uuid": "2795efc7-74eb-4e48-8ee8-b840a0d5a86f", "value": "T12944120177A0C076C9A35A71AE3A63B7CFF9342224BD9B4F23601625B472711B82F7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267851, "uuid": "365f8ee3-d3b2-4554-8046-0add23b09313", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267851, "uuid": "d8c0135d-c2ee-4829-969f-a8b6b1b9bc35", "value": "6144:vYa6L5s7/WvUZ8J86wp4HyISRaNOBZo+IOdHnAB2bXqkkObc4:vY55s7/W9lwp4HyILNcdgB2bXqpkc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267851, "uuid": "ac995d7b-cf3c-4d08-97fe-0c7f2af0dca8", "value": 272274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267851, "uuid": "33adcd7c-c317-4d09-9598-af8c26486c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267851, "uuid": "ef28d194-bb6d-40a3-b703-85c1bf41266c", "value": "SO# A56DX04471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b10269c-bda3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274428, "uuid": "6b342c9c-ac5e-4c23-aa79-58a2ba68df1d", "comment": "Malware payload (AgentTesla)", "value": "8292cbeee2dbce7c7c2d27dbfe7f171c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274428, "uuid": "994ae834-8e7f-4145-80b1-51a251e7c861", "comment": "Malware payload (AgentTesla)", "value": "98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274428, "uuid": "f53c0953-f015-4759-b96c-de44126a3e5e", "comment": "Malware payload (AgentTesla)", "value": "ff606b2b53ab35edcbc11aaea8bfc33d033bfff2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274428, "uuid": "fd607954-f6eb-438f-a6d9-9cd9105cddf0", "comment": "Malware payload (AgentTesla)", "value": "9e24c93bec16ebc550291f7775cbbbfd58ad813cb344090f2a7069a2c68062445c08680a29f77d32e9a6f6d78f094f13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274428, "uuid": "72f14abe-0d32-4797-a07c-2273da7ce138", "value": "T1CAF339689AC94D31F31D8074C5AC311406B2E146461FE75F1FA1ADFBBF4A7C3762A8A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274428, "uuid": "1b0dbe65-8f9d-411f-b7e4-9fd6574497a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274428, "uuid": "b14fb05f-dc88-40e6-b3c9-1319f2e005ca", "value": "3072:sFEDBdPxMBr3M4t4g7PVEmrz7iz5ZD3GkAgyjOXdd1JP3il:GEDTgrLNEO7qZD2kbCcJvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274428, "uuid": "06c16773-9b98-42fc-932b-2e7953a33fd5", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274428, "uuid": "95480698-0f0d-4c86-a060-1200956d9a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274428, "uuid": "33881d5e-572c-4be0-baab-1e3334de3156", "value": "98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5e02ed-bde2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678301734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301734, "uuid": "02a22739-5219-4adf-a0dc-d530d9239a64", "comment": "Malware payload", "value": "bd093c510ef13fc977fa4c37d105abc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301734, "uuid": "e08c4e42-26a4-4238-9a74-49d332221058", "comment": "Malware payload", "value": "987e743d904e1174e62081cadb2aaabf9af5de7265f5cbbbc0de772f2e865f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301734, "uuid": "e20173ef-3aff-49ec-982d-56e16964c5ff", "comment": "Malware payload", "value": "538b2dc4338b909d27b41c0844406a7aed23b7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301734, "uuid": "72e97b22-d075-41af-a6c0-2912eb06d3cc", "comment": "Malware payload", "value": "6b20f45d1f91d2d7643b5c4f9690fd3c6d25bc8727b52962f0d7f51b8a40cd4f67b4f3c4956ed34744ffbcab03ce3116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301734, "uuid": "99dcd5eb-dbe1-4765-bbc7-2e76829898a6", "value": "T12D967CA922A025E3FC67F1B848570721DBA9B12B1B28595374CCD3D43F46DA02BFDAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301734, "uuid": "2879e50b-b9f7-4f09-8d81-74a38ff189eb", "value": "436e083d3fd67ad9b1e18c1d8d8ab463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301734, "uuid": "f264766d-656f-4dd3-a7e0-eecd22e0dee7", "value": "98304:lDATTQ1iSZ/AcUyiJHEjad4M45rBoUBcgmc3QVuzjx:lss1fYcUyjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678301734, "uuid": "b4c4d4f9-8ce9-4a55-a564-734981904f1f", "value": 8688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678301734, "uuid": "56534daa-b238-44a2-9c76-85af3eb0dd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301734, "uuid": "bd758af2-365f-4f94-ac93-c6825a1d4103", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39da85b-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247572, "uuid": "151d7dc4-1296-4e69-b6e3-f7916e36a1c1", "comment": "Malware payload (Mirai)", "value": "75e1b6424d9615e8a986334c5ecf56a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247572, "uuid": "1fbbad51-c6a8-44a2-b149-246c457c5f6a", "comment": "Malware payload (Mirai)", "value": "98bd0529813950d3a7760aa9a835f4f2eb76282a4c4ac070d5e59da43b380c1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247572, "uuid": "d7365fad-178b-468e-be78-7357384c1385", "comment": "Malware payload (Mirai)", "value": "d5b147fb94fc5a1f22da26b7eacc355722197fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247572, "uuid": "99cb138a-8950-41d6-a502-5cdec01340db", "comment": "Malware payload (Mirai)", "value": "fea36b84f6c5ac29e2e78e01d6e18fed2c45a586d4de6702f8c259605dbae2fb57342e11313f946eb0a9a157d4cc84a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247572, "uuid": "932db137-e20d-4bba-9405-3c80c01f4c5e", "value": "T1BF82CF3051AB79E4DBE10431FAEECEC657160BF8D1FC369317586B78C94210261F82DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247572, "uuid": "5bad9ba4-a14b-49b8-a41c-0a0c24295205", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa5hymdGUop5h5lv:6GV0P6+kom0tVAoNvm+to15s3Uoznlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247572, "uuid": "4521a84b-9d84-4ecf-9631-b60a0b834bae", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247572, "uuid": "7f6ebbe3-8d95-4a68-a5ec-3e95b3b5c63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247572, "uuid": "07e7b767-efa2-43ae-ae70-f4df2c4dd423", "value": "75e1b6424d9615e8a986334c5ecf56a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd03cc27-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678275988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275988, "uuid": "011378dc-d283-441c-b71a-5e8c0f4e9314", "comment": "Malware payload (Heodo)", "value": "ca47df19508491f93e1555bd92856897", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275988, "uuid": "12c6e3d0-1d5c-4064-b030-4c836f78bba7", "comment": "Malware payload (Heodo)", "value": "9934f7f892cda3af2abac8f2456976883fa8da87f08f0da67ac6e0311072d41d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275988, "uuid": "cf15d3b5-95fc-4fe4-96de-fdf4c5c02f42", "comment": "Malware payload (Heodo)", "value": "3b86feb665b53b6ae31c634b555fedf7ca5820f8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275988, "uuid": "79230a01-4fc9-4695-b833-7d3ee3e985a3", "comment": "Malware payload (Heodo)", "value": "5906006702413cec64a5095878cb42082640fe6c29764d45c3ebf6c6fa69771c20b9873d43c261079523bb14163f7122", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275988, "uuid": "a3e80a09-b325-46fa-823a-5360a0e4de7b", "value": "T1B205233C5F67790FF5997C362AF3847AFCF9085CDC96A90A17472A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275988, "uuid": "982fe6f6-c1a9-40e1-a403-b4e4b2c296ef", "value": "12288:v4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sZ:wevtlkdJe4m19FgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275988, "uuid": "e5fae092-9781-430f-9b3d-2331eb152f64", "value": 862476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275988, "uuid": "d3285e9d-3528-4a99-aefc-e1b773dc4685", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275988, "uuid": "c19d038d-2ec8-4dba-b06b-773a90934af7", "value": "zT5jFTGubdDbB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c519198e-bd85-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678261775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261775, "uuid": "cecba7fb-ac5a-44ac-90c1-895deb6067c2", "comment": "Malware payload (AgentTesla)", "value": "3c7670785f9f4e8ee9a498f0a6c626c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261775, "uuid": "77247dae-4fe6-491e-93f0-9b94a7760759", "comment": "Malware payload (AgentTesla)", "value": "9975c3c2c7bb393e635997f7e9060557ddc22931a8d700e558b7bb2c8d6ff892", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261775, "uuid": "df52b2d5-f1be-4e41-b0db-d16fc03aefcb", "comment": "Malware payload (AgentTesla)", "value": "25ca09ad40dd13fd8c9e58e83fac4d85918ae1aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261775, "uuid": "085c1504-2765-4ac2-87a0-22f3b97431c0", "comment": "Malware payload (AgentTesla)", "value": "6f9312d60783585c2801d13264dd5b2248f3f34948b3e5b80f8f4cb3557cfa64075530cf7a887cb26ea85ce0804be9c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261775, "uuid": "43794d84-1488-49c2-b193-34bc219ce716", "value": "T146059EE42F5D7263F786E1B3280427A7DB9CB95D251BC0181EE2118FC1CDE6C5252EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261775, "uuid": "ea92448d-19eb-4ad9-b80c-3ac5340c302a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261775, "uuid": "a0c10215-7382-484b-a620-1135c4103536", "value": "12288:y6bXxZvpmx4kMywFb/PLjQXPWZaDW75LE21zE8/8TJ:y6jx2z9Mbz8fuai75LEMH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261775, "uuid": "1bdc0f19-53a0-40e8-8e29-a97d84ce3b3a", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261775, "uuid": "1946f621-f0c1-4fbe-bc99-7a1c91a0a96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261775, "uuid": "d5bcd2b4-c9ea-4d0e-a767-d56a10ad9f0a", "value": "RFQs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4ed0bc-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678285060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285060, "uuid": "ed1af776-2513-4e4f-bf9b-c24b1fc47250", "comment": "Malware payload (RedLineStealer)", "value": "fa4fb9a47a5c0a66436b31233b240805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285060, "uuid": "164fd129-4716-4809-9a08-02054ed50182", "comment": "Malware payload (RedLineStealer)", "value": "9a8e2af5a18276ce61de6ee043b6e5445dfd1d449453a124158d8275d97193f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285060, "uuid": "bc7d9a98-984a-4a8d-9201-1541cafec0e9", "comment": "Malware payload (RedLineStealer)", "value": "775ebc65e59f26cdda543ba37a551aee076ae1c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285060, "uuid": "3edca665-dcbd-4bbe-abc9-66b42aac254c", "comment": "Malware payload (RedLineStealer)", "value": "844557afbbc5b29dca95c2e49d496592507d5fb4c329a5acf0a5c988917185eb0366ba40077eb295383f59d107e44a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285060, "uuid": "8c08072f-9090-4e9d-a70f-18902402a0d2", "value": "T1A605CF9973B25423EC8F41BA192BE2DD2D7571437315E23B5B7B3AE1D2015BFB288242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285060, "uuid": "c715478c-b6f2-496b-9738-64d4bf57e554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285060, "uuid": "eaac2ee3-63ae-4f3f-822e-2edd3d7e4bc7", "value": "12288:vYa/5u62iNxL3EJFvqc3NxYdO+AQPrXKELySLeoA/IjlLCCzCDf0T:vYa/5u61HrwvqcL+AQPbFhlAalLnrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285060, "uuid": "77046af9-da91-47b6-b9f6-0e675fc916fd", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285060, "uuid": "ea523360-5231-4ea7-927f-cd76bdd58e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285060, "uuid": "1035cb43-3682-47e9-bf33-d0a04fc1b2fd", "value": "mollyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da1eb92-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308390, "uuid": "15196ef1-83ba-4940-8342-376d51981cbb", "comment": "Malware payload (SnakeKeylogger)", "value": "1dbef183df438146c812a78dc0ec8319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308390, "uuid": "559398bf-9ceb-444e-9397-d03ec6f2c737", "comment": "Malware payload (SnakeKeylogger)", "value": "9ad90b66ba9684bd452c7d9ef3e9c7cf561db81e32c3825d0e2d502228be0024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308390, "uuid": "c28b3a60-abd3-4969-8253-cae604a52fd4", "comment": "Malware payload (SnakeKeylogger)", "value": "46c76d6353e133f9b3e0aedb6f3b12eb90b9edb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308390, "uuid": "10dac0fc-50eb-4f93-a378-b30be4c9b322", "comment": "Malware payload (SnakeKeylogger)", "value": "9c5a3c1725019a85af2121a762593c4aea60d833d63eddc5c55c557aaf19ff956aa3bfebe06f9991d490d09424577248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308390, "uuid": "e7810963-d77a-4f54-ac3d-a901415babf8", "value": "T18C05BF5573B19423EC8F41BA592BE19D2DB171433325E33B5B7B3AE0D6019BFB288612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308390, "uuid": "08548f1a-36b4-4c28-9bc5-9fdcc1d62d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308390, "uuid": "7ddd91d3-b55d-4c9e-8179-5d901281a8d2", "value": "12288:Fa/5u62iNFDsfAG2CD89iHiYK4YH4+bbGB8Otkjev+N3yeZsSwYEiGV5v:Fa/5u61Psd2CI8C14YlGBnqnwYiV5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308390, "uuid": "064c05f5-3f7f-4f82-9b2a-701e386d36ca", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308390, "uuid": "394c7207-883b-4340-8446-4f26079467e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308390, "uuid": "617e0b61-9eaa-4da2-89c9-383c684e2831", "value": "1dbef183df438146c812a78dc0ec8319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f473edd-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274811, "uuid": "bbf878e4-10b6-49b4-86b8-61be948ec0ca", "comment": "Malware payload (Heodo)", "value": "ac7615a4f13e75e6b8c01228b9b83781", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274811, "uuid": "599fc71f-8f51-4c29-b960-f29193751ec7", "comment": "Malware payload (Heodo)", "value": "9ca9ca532f636c8d63c83d7eb09cc88be04404fa4be1410023d54e0f890fc680", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274811, "uuid": "9ee86e2a-03f4-4bd8-91ce-827f43b9b22f", "comment": "Malware payload (Heodo)", "value": "73a99b548c5ba8eb3571928460e80c7b6a87ff41", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274811, "uuid": "05f9f6a9-f9c1-47b5-9be2-76af077266c8", "comment": "Malware payload (Heodo)", "value": "8c21914e97e4f049392674e9acc3a978ebc3062f84c627d0e13c136e5faf9b662f612936ea1f29289dfcbe2a604b44ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274811, "uuid": "23ecc9c7-5db4-45f8-95fb-4ab5ec07bf98", "value": "T1A005233C5F67790FF6997C362AF3807AFCF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274811, "uuid": "a3c26376-9a72-4f0f-9043-899c0f260660", "value": "12288:F4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sB:6evtlkdJe4m19FgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274811, "uuid": "69645ece-baab-46a4-9b3b-91d0b52c88f8", "value": 857383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274811, "uuid": "637d542f-e6b3-490d-a8e6-b9176a651107", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274811, "uuid": "f23efa0a-f587-464f-885e-bfad7e769b0d", "value": "Wh3HhZOBHtfTPLMMKPTDRZYuer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9955a805-bd8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1678265137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265137, "uuid": "c50e8dab-4b74-421d-95a7-403f3ea885cd", "comment": "Malware payload (STRRAT)", "value": "99247e1f4dca7c9d293d4c631ffbb192", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265137, "uuid": "adde1d44-12e7-4487-8add-a836f9f7ff63", "comment": "Malware payload (STRRAT)", "value": "9d42d96899c340c182f877bbfb458cef5fb8e08620ff517acccbd2965011b3dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265137, "uuid": "ca9d1765-c955-4581-a35c-1879c466cb4a", "comment": "Malware payload (STRRAT)", "value": "52a6dc0cc7cabcb0dceea0aac2130e6d05f3c0da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265137, "uuid": "354ad8dc-7413-40a6-a015-80bd8a789478", "comment": "Malware payload (STRRAT)", "value": "9460063358ad6601c1fab4fbbb1278b71d02467ba7d374166d0b822e041ca77fda6afc4247907ce55c07ab366ca61480", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265137, "uuid": "bc67b1b5-5a29-4741-9d60-a0ff6bfb03f6", "value": "T189745BCF97852F19DD76014883BB2352057CFADEA027AA7EBC329BAE9A51655300C35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265137, "uuid": "5862dfe4-1860-42c1-831e-8ff74923dfae", "value": "6144:GQJjlNRC12geYe4ga+eM7oo6ZRzWg7UdNrhWMSIALuB5gPBx38nHJEsDq:Npc1LezCRKEXfsB0sM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678265137, "uuid": "f66db699-49fa-4561-af55-acce80e45991", "value": 370123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678265137, "uuid": "cf2941a0-76af-433a-8075-84441d40a9cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265137, "uuid": "6824a85d-2939-48ec-a486-41e4df301e0b", "value": "Mandy-POP from istyle-frank 2023.2.8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffea5f32-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1678261444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261444, "uuid": "0cd26f7a-57c2-4ec7-a672-b8e88a5ac73a", "comment": "Malware payload (Stealc)", "value": "74f91de02d2e0a5a3c391890a685a0a3", "object_relation": "md5", "Tag": [ { "name": "74f91de02d2e0a5a3c391890a685a0a3", "colour": "#CC9999", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261444, "uuid": "acee4a47-c21e-4fa4-8007-798c45a48468", "comment": "Malware payload (Stealc)", "value": "9e1cc2a7e7a7cc723e5b5f7a8c168444dbe69250621ab831d255cef422a5b210", "object_relation": "sha256", "Tag": [ { "name": "74f91de02d2e0a5a3c391890a685a0a3", "colour": "#CC9999", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261444, "uuid": "2174d5f7-2253-44b3-9c91-dc4b92f617fa", "comment": "Malware payload (Stealc)", "value": "18209aa8cb5b746b518defc68f19cbf3d7a0c2c7", "object_relation": "sha1", "Tag": [ { "name": "74f91de02d2e0a5a3c391890a685a0a3", "colour": "#CC9999", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261444, "uuid": "b8f01b41-2e60-4742-a491-3a8edceb31a2", "comment": "Malware payload (Stealc)", "value": "c61e0d098e545b5cba3c53d5632c5be5b4e5dbabf01dab5f3c1c140121701f554bbf73e22ca00accc94512e7e0ad4309", "object_relation": "sha3-384", "Tag": [ { "name": "74f91de02d2e0a5a3c391890a685a0a3", "colour": "#CC9999", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261444, "uuid": "ebf5df0a-d58c-48bf-9a8c-59bfc6c4dfba", "value": "T1EB54B013B3E1BC65E56746714E2EF6E8372EF5508E5AAB6A23388B5F09701B1C273311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261444, "uuid": "4c9a3f4c-ab0b-4049-879b-c71b269b043d", "value": "8f598b287bab54810f24d54c0484bbc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261444, "uuid": "82c75495-7721-4d4f-a22f-9c9eeafe7fca", "value": "3072:Y0pMl/L/I1z27q0utrnd2K5OvOM+eOJYuO7itvTP4eUIO:YJ1LMSotrSHrhuAyP4eUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261444, "uuid": "0d1ad6f1-bed9-405a-b3d4-2979758d6794", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261444, "uuid": "7f5ced89-169f-4ee0-ab9e-4ce3e445adff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261444, "uuid": "d5c03fcb-3b68-4371-a6a6-6fb15da0fe41", "value": "74f91de02d2e0a5a3c391890a685a0a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f08d996-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284716, "uuid": "122e6c62-d44a-4e05-af9d-84929b28d89c", "comment": "Malware payload (Heodo)", "value": "d95728aa52bfb0a08229c90cb3ab112e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284716, "uuid": "7e8e9de2-7750-4169-92bb-25f01b4947a5", "comment": "Malware payload (Heodo)", "value": "9e611811309f84d1077753a9ad259216e81a0b51601cee5109edf078507a668b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284716, "uuid": "dfba7195-c981-4617-9c49-568e9e73949e", "comment": "Malware payload (Heodo)", "value": "556af1a84a593b332391c2b375f65c3264030a8e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284716, "uuid": "c6ca73e8-d562-4038-b74e-0b5fa1374660", "comment": "Malware payload (Heodo)", "value": "46b3424351dba6dce2e1128258431798b71d76eb46a8f8ed43cd5991ee9f6a7213973923b6838082b7d5aeb4498bf657", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284716, "uuid": "005495a5-1704-4fdf-844b-999acb6b0873", "value": "T1D305233C5F67790FF5997C362AF3847AFCF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284716, "uuid": "2216d7bf-4bcf-48d7-8a9b-bee53e76aa91", "value": "12288:z4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sh:8evtlkdJe4m19Fgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284716, "uuid": "b6dbe7fa-392d-4db8-a2a6-e5f5d4bcd449", "value": 865546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284716, "uuid": "1a79e950-a296-4ac2-b461-2f2d00783083", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284716, "uuid": "1550311d-0dc6-49c0-9277-51fd923e9e57", "value": "ZsN9UllpZr8GQVZiS3fIh3YbPlMZ1Ajr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cc02c2-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678282524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "733d68ca-d61a-4313-99ef-61d7f92b6793", "comment": "Malware payload (Loki)", "value": "8016b6a790597a057bba93809528ac19", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "ab4f1cda-8252-4112-b84d-2edd6b2a39f5", "comment": "Malware payload (Loki)", "value": "9e8bb028eb7d96a59075b2b960b96596b378e1d8df2920cc1d29745f99c1aad6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "ec78b72a-fef3-4a50-8e1f-82c00833d7f8", "comment": "Malware payload (Loki)", "value": "8a5ae81af1cca7248a3103bc1421da1d121a60d7", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282524, "uuid": "287653fe-784b-4829-9083-4cc0aee16544", "comment": "Malware payload (Loki)", "value": "56bb755e1aa18de5a6badd6984ac2ce76d5ca103e2e490740d67d2e48d1f41518ef95b21d9fa6d6bd616c4c5bb4533a6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "c57f1dba-3b53-4e91-b1d8-62b8323d2eff", "value": "T16705CF9572B25463FC8F41BA182BF29D1D7571033355E23B5B7B3AE1E2019BFB288642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "a17e0b74-4c18-449b-a4b9-10f8d9fcafe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "694db31d-e418-492e-9243-f8e7b6c8e80d", "value": "24576:da/5u61FmyOydeqko3WFFFr9u7/f0T7Q:uPneqkYiFv03WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282524, "uuid": "468ae894-70d2-4b69-8dbf-763142c1daa7", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282524, "uuid": "d2c3a720-820b-42c0-8871-78b68fc06416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282524, "uuid": "8dc0a796-0ee7-41c3-9aee-d91a291e2096", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e57d1c-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678309449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309449, "uuid": "c6fbed6e-130c-497f-8c92-48c28e39a5f6", "comment": "Malware payload (GuLoader)", "value": "2ce436640f0cfd4ce967f536ff46e27c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309449, "uuid": "3b8d6ae0-18a8-4266-ad40-30e21c1ee2b7", "comment": "Malware payload (GuLoader)", "value": "9ef8ea8ee417630232ed035d0b4959aeb57dd3c0e8c1b3119284c0fc6944448e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309449, "uuid": "29bf9347-a7dd-4cb1-b312-20e7c2e0059d", "comment": "Malware payload (GuLoader)", "value": "35daf993a6d424824f248249c03cf7c2566cdc69", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309449, "uuid": "47886cea-e7fe-4720-b6ac-7df505cfb0bc", "comment": "Malware payload (GuLoader)", "value": "47d83e3150ca98bba9213e29337994fe5c08d64f91c5ea95ca8654b54c3fd55ab489a336bf6331a7ab0fd6bee3595d79", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309449, "uuid": "a6ae4bef-b09b-440f-9152-8f5303154159", "value": "T149D27D21DD072624845F2BEB9C460C758968887B912B0979BDAEF37D780334CA77EB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309449, "uuid": "d4dc2463-b635-4bbf-a488-d040275b0702", "value": "384:+v3bg7tfNXLcX5o6wiDgyXVlsA8U/4trpsza9CsXAEXEwXTsSLGwiF8Mxz5w/UR:oqVXLcC67DgyX/x88f6L9Z4Q/UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309449, "uuid": "c614a7f6-9187-449f-a72e-a88ac6a303e2", "value": 28422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309449, "uuid": "69b43d23-def3-4025-b0a0-3b6192ff7fb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309449, "uuid": "ac032f3a-a055-4d7e-af3b-b0218555b342", "value": "Proyecto de estado de cuenta de HAWB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfb259b-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247588, "uuid": "8917b47b-074e-49b3-8d1b-c3c93c995aa6", "comment": "Malware payload (Mirai)", "value": "bf262fa177a890e23e535e9daceefc4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247588, "uuid": "e370eb9b-3cc1-4af4-8231-3815a22e5184", "comment": "Malware payload (Mirai)", "value": "9f4b2ce41d82d1e8828cee013c1d8829f13ec05b264615976e2c0e3319da5841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247588, "uuid": "87a953bf-b115-468c-b622-cfad122ec8d1", "comment": "Malware payload (Mirai)", "value": "692334f5d6ef3211dd88baf719b981e5e010b871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247588, "uuid": "ba345fd2-e9f5-4d4d-87d2-2e270caabe1c", "comment": "Malware payload (Mirai)", "value": "5e72fbbb3099c693a460963938316c5a0e340d70c25e6f9173936e8843e3634e5b3a0c4fc818f0cdb6b84e37d2e0ed82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247588, "uuid": "9a827bb9-db6c-4cf3-a2ca-b12224303073", "value": "T103336C36E029DED0C6960134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247588, "uuid": "fd0d5af9-c93f-412e-981f-2595978a9b93", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247588, "uuid": "6dd1a9e6-4e2b-466b-bd83-1a47172c1558", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247588, "uuid": "600f1694-d1f0-4ce1-b444-8289ecd1746b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247588, "uuid": "f49aba3e-a971-48e7-8327-3d20d93062f4", "value": "bf262fa177a890e23e535e9daceefc4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd03ec4-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268393, "uuid": "3f95d51b-f51d-450d-9288-685e4c559cac", "comment": "Malware payload (Heodo)", "value": "2751aa961f1f4a7702993e345dceb0bb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268393, "uuid": "46f01872-ea82-4e18-b318-3254ecc7b664", "comment": "Malware payload (Heodo)", "value": "a05bda2e34aa25e7a4b7ba909fb9fd58b8bc78d92baf42f760f00910607036fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268393, "uuid": "e5079018-b8bc-4038-900f-5891be42837a", "comment": "Malware payload (Heodo)", "value": "245ef7091927c8f81a786c1e21b307e97fb045b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268393, "uuid": "de47c62d-bf20-4c59-9963-7c2ee199f1ff", "comment": "Malware payload (Heodo)", "value": "74cac64506a8f4fdec450afc96df03e155f442770fa2c5f248a816d89b7b3998e6a8c8c8e350fde09d6613784408547c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268393, "uuid": "5166b0fe-141e-42b2-8972-3f61cb8d7358", "value": "T14C15233C5F67790FF6997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268393, "uuid": "efc96862-c991-43f9-af72-e70c711871f8", "value": "12288:k4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sU:zevtlkdJe4m19Fg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268393, "uuid": "09ee11c1-f859-4df2-8c9b-541bacbaa352", "value": 880801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268393, "uuid": "47a68f71-854e-4753-8969-5299587d58b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268393, "uuid": "c4c51537-79be-4227-b6a4-b0b1446396ca", "value": "dkzMKbgiHZub5c9CX4IK2G.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62c344a-bdcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678293613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293613, "uuid": "1036e3ba-6bdb-4c92-ba72-52957d5bfea5", "comment": "Malware payload (RedLineStealer)", "value": "1461aa5bf89331e12f3fe81e3d77d4a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293613, "uuid": "c5934772-e05c-47c1-8a94-d7b73f771691", "comment": "Malware payload (RedLineStealer)", "value": "a12518fcdbf4356e37cb65eed176d260f460dd66cd0ff2ac5f22fcd90bad8868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293613, "uuid": "dc49da87-2a8d-4e35-9f2f-4b90bcb51b11", "comment": "Malware payload (RedLineStealer)", "value": "59fb909f744bec66e27eca86ece71e9458fc8632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293613, "uuid": "6f2e1ef1-9b36-4616-8ceb-351aa1bfeaa4", "comment": "Malware payload (RedLineStealer)", "value": "81e74762ecb75ecac092f4edcb1e2f105316cf3f94795b3ffdab54201645db3db9d5b36e133206e0f6c8cf142bcf2fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293613, "uuid": "41566788-9768-40b8-aefd-6d036d075210", "value": "T19BE4021253D0A835F3264B719E3DF2E46B3EFD529E6BD6DF2214261F1AB11E18522322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293613, "uuid": "b061598f-7053-4525-9ab9-3e0dbaf92e59", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293613, "uuid": "10a880ea-5eab-47f4-bcf8-5dacaef83dfb", "value": "12288:v5rp8fUywaGuEjgUcLxVchVeUdhuj0E1Eg1nrSTlZ:xrcVGuVzLEreUdER1ErBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293613, "uuid": "9a4edf36-8fb3-4f14-8b8b-581438b16498", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293613, "uuid": "e4c919b0-4463-48eb-a065-6bba039c74b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293613, "uuid": "4db9bfec-9b88-4196-a66b-fc3ae6dcd5cd", "value": "1461aa5bf89331e12f3fe81e3d77d4a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0588b5de-bdfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678313423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313423, "uuid": "21de931a-de68-4d0f-8e23-f1dfad554637", "comment": "Malware payload (Loki)", "value": "a48fe7029a3db82d307bb80fe37811e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313423, "uuid": "3cd79c15-2f20-4b0d-bdd2-c76ae2d5fbbe", "comment": "Malware payload (Loki)", "value": "a1822503b15e0c7a4c03efac1b480709e39cb9fe965ff206d86fec6e98855a58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313423, "uuid": "4fa7e56e-c58e-4175-9fac-fd08c007b4e8", "comment": "Malware payload (Loki)", "value": "9f73f909ce86a5539960e4260f7ba8b449555605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313423, "uuid": "0bd48dfb-9363-4a13-86aa-66616870bee5", "comment": "Malware payload (Loki)", "value": "db3cbe77859c85465791ea7c541992ea738a1fde9598cbc077c9fc6eb059327d7c217bf415808903e31fa4303c478d80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313423, "uuid": "9da53762-3e5a-4ceb-b7cb-d9cebf2cc76f", "value": "T16E05BF5573B25523EC8F41BA192BE2DD2D7171437355E23B5B7B3AE1E2019BFB288202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313423, "uuid": "c43d0c5d-6fcc-4234-906e-0ac3ef9bbcb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313423, "uuid": "6362c8bb-a1f8-465a-8d3c-a2021c6905af", "value": "12288:Na/5u62iN0y2MZe2VttnWgkjjokli6y/TREDramY259ADtT:Na/5u61KvQe2xHklfydEP/YEWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678313423, "uuid": "bb0ccfed-c63f-46a7-875c-d83e1d0cc0a7", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678313423, "uuid": "c9ad8553-3110-4dd3-8c3f-a39af611e4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313423, "uuid": "7984b76b-9343-43f0-ba6d-9a200530a79c", "value": "a48fe7029a3db82d307bb80fe37811e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eb5768-bdef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Petya)", "timestamp": 1678307331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307331, "uuid": "b87b72cd-f33c-4444-807b-95ce2a977a3f", "comment": "Malware payload (Petya)", "value": "5a91f712fd144ea66bfc7c43dce3ffba", "object_relation": "md5", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307331, "uuid": "fedc4fef-d942-498b-9d4e-24ecda11d624", "comment": "Malware payload (Petya)", "value": "a1f30cabf6d8e2d2796eb166d49bcf86a3dd18fb92da8b861adf9247373cf70b", "object_relation": "sha256", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307331, "uuid": "16933aa6-12e3-418a-82e4-0f99817fece2", "comment": "Malware payload (Petya)", "value": "de4e5a53add2e5487cf30969e7304e46d7946e96", "object_relation": "sha1", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307331, "uuid": "0117a9d7-8643-47ca-b69e-cddb056c510d", "comment": "Malware payload (Petya)", "value": "11a00926a830a582a5f7562abe93600985c3e2693978402c6ae9fcdf9dd5cf0c622dc3b742480ecf968e745ab357d3c2", "object_relation": "sha3-384", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307331, "uuid": "99b79884-b3b8-439c-8b70-7d4b74ae6d7f", "value": "T1B7448B0D7990E92EC4B222719A38D7D2FD3B79314F24A19FB7C4695DACE08C19938B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307331, "uuid": "3acd7696-553c-4190-9440-30752ac3308e", "value": "eadbe699c9f56194b9bbdf2dd7631233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307331, "uuid": "a8e140af-07c9-49f8-a12a-62ae002b2378", "value": "3072:eTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3jB4YgTl:e6nrD0ZMcPBAL7c0fTHs+2sNXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307331, "uuid": "51c04b85-44dd-4915-9855-7363640f84e6", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307331, "uuid": "6c5bf38d-4deb-4975-a697-7ed46d17ddeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307331, "uuid": "9e5a235f-59f5-4492-bb5a-ba6586b3cd55", "value": "bitsadmin.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6510489-bda0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678273427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273427, "uuid": "8955dec3-4856-41e7-b6fc-839b2a23167a", "comment": "Malware payload (AgentTesla)", "value": "a61c784f54aa2de0609b8dd99c5160a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273427, "uuid": "c167fc8c-566c-4385-965e-717e9f300c53", "comment": "Malware payload (AgentTesla)", "value": "a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273427, "uuid": "305df7f6-0626-48af-be79-a69464e7eaa9", "comment": "Malware payload (AgentTesla)", "value": "5cd9d12d72c566bccfabeb130fe67b121dc40479", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273427, "uuid": "a56f33f0-5cef-4658-9a96-faf107379a33", "comment": "Malware payload (AgentTesla)", "value": "fc60fbcc1e06d9803a537b8392247ae1c52b498f503a91a747f5230559c1588fc0698f059b4800f7b516e299399b5934", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273427, "uuid": "7a799cd3-ce81-4e19-b45d-247561a361bc", "value": "T1B9F3172892998EE6C32D40F9C4A01148EAB3E1435607EE5D5EA5DCFB3E077C7363E865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273427, "uuid": "28d3bc17-6889-4add-bb9c-485fdfdcd68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273427, "uuid": "ce206be9-a45e-41e8-ac3c-ab27ab726076", "value": "3072:wRBoYX8vD0ibr1D5bJm+p3+mR4JoSwVp0+rHx7t7PM30nz9cpA:wRBe02h1bs+pOm6Wl1Xhz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273427, "uuid": "3d7a9cb1-d7af-46eb-847e-534f140550ea", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273427, "uuid": "c77a663f-2ad4-42aa-82db-a6f8a33af2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273427, "uuid": "256cb3ea-99e8-4086-b5dc-e39a3afebfbf", "value": "a2870a7e527b3847a2d634626573a2c4f8de4403109386df37e2b34535865a6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e214820-bda9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678277091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277091, "uuid": "29081ba6-6f75-4cbb-8e6d-f85676865dbc", "comment": "Malware payload (GuLoader)", "value": "98a0eef01b2a863c62ac92b843414e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277091, "uuid": "1d77d885-6a7c-465b-9619-0a52fa8b9791", "comment": "Malware payload (GuLoader)", "value": "a2abc0171e53b987ece172a528a8938f4372cb4feef3d812b773c0e48dbd40c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277091, "uuid": "129ead9b-35f8-4dc7-96b5-159941fd8ce2", "comment": "Malware payload (GuLoader)", "value": "8a2d2396bf489af8cec01aad25bb5af7c19a6be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277091, "uuid": "da46ee16-8314-4625-80af-eb20c6f068b8", "comment": "Malware payload (GuLoader)", "value": "6817f73d32e374ce06ac3add73ec80f34e2b62df320139d6fc706c7dfd2962757e1f4952bba3e5cc9befd5a8dc4fba83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277091, "uuid": "823954ad-197e-4f2b-bfc3-70bd5294027b", "value": "T12FA4124A5A258D33CC710B7006D65A62DFB95F121CD1698F6B40BFFA2D71BC19A0F22D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277091, "uuid": "e473c2c7-1956-41f7-86b5-7f80426709b8", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277091, "uuid": "47ab26a6-f32b-4691-af07-dd4bf6d56ad7", "value": "12288:wq8BUxXKwJW9JtlKxx0QhC+IeQ+ImWmyJYj1fL:18lwJW9JtQS0n++ImdfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277091, "uuid": "bd85ed65-7dbf-4d20-b735-522e116f677e", "value": 468600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277091, "uuid": "8813e1eb-659e-48d3-8002-1ff943e3cdd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277091, "uuid": "5247f181-4585-4537-b06c-7d77cfc9d1cc", "value": "a2abc0171e53b987ece172a528a8938f4372cb4feef3d812b773c0e48dbd40c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832c1acf-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678310627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310627, "uuid": "a3982f2f-54a7-4e5d-ae91-bf31f4ead22c", "comment": "Malware payload (Amadey)", "value": "312bf0a2cfe4b485ee52c40fbadf1915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310627, "uuid": "c35cf4a9-b7b7-4677-b2f8-550a11242fc8", "comment": "Malware payload (Amadey)", "value": "a2caf09f2f84b33ddad43f33d84a49c2f47f32201312f7bd92875a88a7eaa4b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310627, "uuid": "287e83dc-1b1d-4e4d-8293-d9f961f73a39", "comment": "Malware payload (Amadey)", "value": "985f5f293da8c72d42e7e6cb66ff9af8fb0b39b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310627, "uuid": "f93a6739-e63a-4a28-85df-13a954642383", "comment": "Malware payload (Amadey)", "value": "9b2429dfdab86e18068c37eb0f06e1dff1556945f1728bf0aa69378b461fbacd1c6f6a224138df290bbe77e216b4dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310627, "uuid": "a10278eb-4aeb-4017-ac8c-c3bea6b56a46", "value": "T1E9936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310627, "uuid": "52ba1c4c-1643-45a8-96cd-91c451792e0b", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310627, "uuid": "d4daa080-9e34-4a99-834f-6a5c9975f599", "value": "1536:IgYNPCKLbqoYkbpplW9YoUsxXbbcouNh72ZszsWuKcdJUJkaB89p:Ig0CWbBNpplToUsNuNh725LJU+aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310627, "uuid": "18c6f953-2582-440b-9262-60727090c4af", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310627, "uuid": "311a47c8-b0cf-455d-8b42-8f535f9e2a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310627, "uuid": "601082ba-d59c-4307-b46b-01b21e50fb64", "value": "312bf0a2cfe4b485ee52c40fbadf1915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd6d556-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678259721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259721, "uuid": "382edfde-f68d-4875-82ca-f4968547fa85", "comment": "Malware payload (Amadey)", "value": "6d5ea2bcf69acd71d45c3319d466ae27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259721, "uuid": "404857ac-9f2b-4c1b-b310-2801c601a4a9", "comment": "Malware payload (Amadey)", "value": "a2d2e85551546b62fa238f23860cff382bcb3dfaff891d070105a01ba5c15626", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259721, "uuid": "01beb2cc-c739-484d-85be-efa64ec1525f", "comment": "Malware payload (Amadey)", "value": "9001c4de07c3e302941e94c0b1a36d37a94e7a2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259721, "uuid": "eb38f32f-a672-4885-a9f2-ca3e6e2b89a2", "comment": "Malware payload (Amadey)", "value": "3f8c06cc8509506c90892066b771233706e3aab61d320587f65a0244292e0ad0a9e1c45338fd2e4c9e2feeaee15b45fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259721, "uuid": "462e0c76-b1e9-4d2f-99be-53698bc0e539", "value": "T190F41225B5F3CCB2D9AF093558608E60DF3E78725155C9AF33A8779B1E301C19A26327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259721, "uuid": "03c98570-e4ee-4430-8d68-b9e685405913", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259721, "uuid": "d63d88dc-9889-4483-bc8a-259ab7265aee", "value": "12288:Y8e9XPVWVO3jehZwzZmwMq02rSw5ZSYJ9YIMG/aE32JBiEOlqGrvP:ycVTPwpdSY0jGjQB3W9zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259721, "uuid": "e3910419-d6b6-4c76-a2ea-e3d24c2bfcea", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259721, "uuid": "3667bde5-8f0e-44e1-b81f-3e6587e38568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259721, "uuid": "a2b3a1e3-102f-4337-9714-6fb28287111d", "value": "6d5ea2bcf69acd71d45c3319d466ae27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ef1d7f-bddb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678298528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298528, "uuid": "95f8b2d4-b30e-4364-bdbe-845ef0fd011e", "comment": "Malware payload (Mirai)", "value": "c424b275e53289e6e4bae3fc6146557e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298528, "uuid": "b26d36fa-75c7-4fde-83d2-02a402514d26", "comment": "Malware payload (Mirai)", "value": "a3438a6858cf530ff507f0aa980941641e0a2b388e66d25f5e6f65cb8b9ea4f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298528, "uuid": "a0a2f619-46b2-44be-b581-030dcf803b4f", "comment": "Malware payload (Mirai)", "value": "d220f0dd6189614d1512291537d771688dc2e869", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678298528, "uuid": "28018b00-6e25-4df0-b8a2-76c51260ca99", "comment": "Malware payload (Mirai)", "value": "6fb5d20aa374d0a941fa1757da4507acb055ba2c5d6f102903bfc68b3d12ba155a6189007a7f7342cbb5d4421a8865d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298528, "uuid": "ceda750c-07e8-4207-b24c-0a570d963418", "value": "T1C7438D36D86E1E74C04641B074748EB56F23A5C893972EBB1AAAC2795083E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298528, "uuid": "06198e62-354e-4d75-854d-c7f7639f8112", "value": "1536:Naa0brW/Od9hlCRJ6aaKwXoCcpvDCMJ2+Wc:Nv0brWGd9XLa9wSpvDI+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678298528, "uuid": "e7a76ffd-1654-49a0-998e-9704334df9b3", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678298528, "uuid": "51bc7637-c79c-431c-b7c0-beacb22b43bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678298528, "uuid": "4e8c4793-8255-4d08-a2f1-e5fef560a44c", "value": "c424b275e53289e6e4bae3fc6146557e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2356a75-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309444, "uuid": "19e4cec0-c8ae-400a-9c6a-44f5f55f0039", "comment": "Malware payload", "value": "a4876007d9afb92163ed9933656eacbd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309444, "uuid": "293f44f9-f5f5-4a82-aeb7-88ef1917e8cc", "comment": "Malware payload", "value": "a58c4155a01aab820977ec8d2880edc9408b320f54ec7089db79e50da1b525a7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309444, "uuid": "8089781f-0087-4748-8c66-a0e346460637", "comment": "Malware payload", "value": "8eafbf2887bb39ac089c95b50bf34fd27b7ee36f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309444, "uuid": "1dbb27d1-c8de-4047-947a-def753250097", "comment": "Malware payload", "value": "937ced3ea8a8be44d9e412348b357a6feaf38c5c17bbf360322b29453233914e0ea44c1b45ba6a626ba3e6b8b5b17812", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309444, "uuid": "b71ee6f9-baf6-41b8-9b7e-5a1178f5952b", "value": "T12C4408023E8BF93C155F2D0455381E779F8DFE66C61951622A492FB983BB08D137F82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309444, "uuid": "1129a270-a7b0-4af6-b0c1-bf502423f14b", "value": "768:NGiZmuiZO+YlWGNOHGxOrBr/kXiFs6d3f9GdsGd+9dP1EC4SV5BW:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309444, "uuid": "eeb18b7f-ac21-40ac-9f86-d9c119c83679", "value": 274270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309444, "uuid": "aa547771-c46b-45a8-8aa1-98131aa594ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309444, "uuid": "512c9f75-3cb0-4a87-ac15-8613bf5f85f9", "value": "ORDER_2308044.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b04ee5-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678277424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277424, "uuid": "31fd1678-28a8-4139-87af-710d88973383", "comment": "Malware payload (RemcosRAT)", "value": "da8108bf1e25cf09dc151d539b651708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277424, "uuid": "7fce3837-a0d7-4b9c-87dd-73a1d4d838d6", "comment": "Malware payload (RemcosRAT)", "value": "a603a1b6eb639ad80548d9eed42e19d1a7b1b34874a6f6a0b5423785741a99d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277424, "uuid": "69efaa1b-d0a5-4f32-b9c2-574682d45a7f", "comment": "Malware payload (RemcosRAT)", "value": "6ada965e3bbd43c87eb3f96eb7415fcd51a50ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277424, "uuid": "4297667d-f23b-4257-af4d-d49eef2bec28", "comment": "Malware payload (RemcosRAT)", "value": "6a14c9e6a1d8c52d99e46400bc5fa561b59cd06ec9ab9bd7f78f7fcf14bd19cdc55807a4fe462cbcfa2fc83e60b3ce7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277424, "uuid": "d7310395-acc1-4045-9b18-c11ecc2efac7", "value": "T14705E63A35BA5BE6D134F73352A3E020B2FD5856A303C81CFDD62AC64F609816DD992D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277424, "uuid": "b556eea2-828c-4d97-ae14-d85c9f1e2168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277424, "uuid": "c4c25211-6603-4699-b78a-9ec0ec6b2408", "value": "24576:MKSu0TsIBMNjnNNOhAe/S0B4JLcn19joJbKhQ4PtY/:FNJLG1mFKaEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277424, "uuid": "af821a34-ad60-4356-bdd3-76e884ca923d", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277424, "uuid": "3ad914d7-0f06-49e6-8dc3-c452f664bed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277424, "uuid": "2c8da27b-be7f-4ffa-b3e8-c314d395a71c", "value": "a603a1b6eb639ad80548d9eed42e19d1a7b1b34874a6f6a0b5423785741a99d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1221e2-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678259423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259423, "uuid": "ea18023d-258c-4aa4-aca6-d42fb6d18ad9", "comment": "Malware payload (Amadey)", "value": "097f088299e0d2ef80a2fc99274605cd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259423, "uuid": "79758c0e-64de-4443-85c3-ae90dacdb6df", "comment": "Malware payload (Amadey)", "value": "a7a9f5effd1031c48c4abf0eabda7a776945b6f41eeaec5a009a305ca000a44d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259423, "uuid": "64f58853-4102-43ce-9fba-5c023da8067a", "comment": "Malware payload (Amadey)", "value": "c04af8cbbd46870cc6fa97b112955017e99b6f5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259423, "uuid": "3c7a892a-5a98-4a09-bc5f-c0544b1ad76b", "comment": "Malware payload (Amadey)", "value": "08520d7823cc3c65c3e67c1281c6fb5f0ecd2ea64c4f1d32081738821a64413554cb48cd689fd42fc6a779de9a39b342", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259423, "uuid": "f1cc53b3-a595-4a17-b98e-60ba1331a00c", "value": "T161F40222B6F07C65E52606765E1ED3EC372EF0119E5AAB6B22389ADF1970173C1B3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259423, "uuid": "2a368c1c-165f-40bd-adb9-32252bf6893e", "value": "8f598b287bab54810f24d54c0484bbc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259423, "uuid": "acb07343-fc98-45d0-a2f4-afe98158811d", "value": "12288:YMz0BzhxBD4SwfNy72mBhvOtmVQwvZiVCtzybJPileQ+l4UGcHnNuZ:ozzBJwe2mnvhVQwhiVCtzybJecl1GcH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259423, "uuid": "ba43cee3-0f6a-4418-b4db-2014cd8f5722", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259423, "uuid": "fc0d3ef2-0dec-4164-be64-f124dc033adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259423, "uuid": "aaf7c74e-7feb-4bb1-a3fb-d230d6001328", "value": "097f088299e0d2ef80a2fc99274605cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b40022-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678309583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309583, "uuid": "bafd3a5d-b50a-49e8-8807-156bc9a9691f", "comment": "Malware payload (Formbook)", "value": "4bb0614ef97d96d375ffb854ff0a877e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309583, "uuid": "c3311b7b-79fc-4fb8-a6dc-656a978ca85d", "comment": "Malware payload (Formbook)", "value": "a865fc0e3e991a049cd158bf25d5ece089037075bacc38130a6dc8c165e5f803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309583, "uuid": "35774c95-d0e0-44a0-8274-37d1e059b660", "comment": "Malware payload (Formbook)", "value": "9d3c456be36751aef5e60912390caf2c79ea3402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309583, "uuid": "eea1e59f-c4a5-4c8d-9fda-9592f5358b07", "comment": "Malware payload (Formbook)", "value": "88ea2c373fb21a32cb0d274db3929756b5f61ee781c51704fbf8330e16f402c89e839ce7a28351aaddbef4184aec36bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309583, "uuid": "c6055b53-c85c-4d8e-984d-602560ceb054", "value": "T1CB441248B770E1A7D46287724F7A065B6FBAF11750F42A8B27409AC9B9325C0DF0F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309583, "uuid": "b650f79b-24e2-450a-8140-54eaa2bb7b6c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309583, "uuid": "aa85d0b5-89a6-4f96-b104-697a728bd9c6", "value": "6144:/Ya6OTVHcQnvo6NfOIfNV2NWqxVCfIXs/LMxnN7TG:/YQp9nvo6NGIfrkF0/2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309583, "uuid": "08ffeb0e-d0bb-4c43-9192-783787964213", "value": 256386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309583, "uuid": "36e4b524-4860-452d-bd81-fa2e8ad58e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309583, "uuid": "7577ffa3-282e-4271-8ce5-d09a2f57f448", "value": "FedEx Shipping Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6db5e6-bdb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678281997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281997, "uuid": "966af133-a85e-4683-946c-499fe086a4b9", "comment": "Malware payload (Formbook)", "value": "5c11aeac56f6f1d4bd644367df8dfca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281997, "uuid": "e6512e9c-ed9b-4f7c-9569-a2cc7d60a2e0", "comment": "Malware payload (Formbook)", "value": "aa119aa1257cbf09e6b7502840e0279f7a215ab8f3d75cdce262ef823c7dbf7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281997, "uuid": "87f64fb6-b6e8-4a0b-9350-9a8eaf6caebe", "comment": "Malware payload (Formbook)", "value": "81e725269608155f66e42602e35ae8708889c032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281997, "uuid": "17a54daf-1b4a-403b-bc0a-5e35aca7aca0", "comment": "Malware payload (Formbook)", "value": "ec9cb983a5bdcc5420c7802401edacafd178fadec65a1b279496e1adc08deff2509404e8cf44634313129be78a189705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281997, "uuid": "36ced2f1-6b18-4964-aa18-3a4854f3778f", "value": "T1B6D4231A2AA0C8F3D5770D304E26A75A1BB9D52159ADC30F67210FBEBE36741CA5D3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281997, "uuid": "58150b39-dbdd-458c-a7ce-522149e10076", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281997, "uuid": "3083555a-ae65-4d97-981f-40a36e837de5", "value": "12288:DYPFXXBWybVgyJIj3rIm/RY2YOMrTgGZvPXzc2YBjBUT2hU0iGOpQnpL:DYPlxxb54rIm/RUOMrTfZvPXz4jBUkvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281997, "uuid": "48f6c593-f0b4-4109-bc4d-053a636821b2", "value": 641754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281997, "uuid": "dec14396-e976-422a-ba32-25ab27c5b431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281997, "uuid": "32ae780d-3ca9-4fc3-a45a-08c104d6065d", "value": "aa119aa1257cbf09e6b7502840e0279f7a215ab8f3d75cdce262ef823c7dbf7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb89009-bdb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678281840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281840, "uuid": "4982be8b-d52a-477e-8067-d030c71dfb98", "comment": "Malware payload (RemcosRAT)", "value": "e191d3582e7361069121ae5beb9a8667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281840, "uuid": "3be0280c-fa69-454c-aad9-b834155ed81f", "comment": "Malware payload (RemcosRAT)", "value": "aa8f0cb77774a1f43eefe9952ce8750a2398b6f85abcd11c974ba8fd0c74b30a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281840, "uuid": "b78cf41a-1295-40db-84cf-701f162f5965", "comment": "Malware payload (RemcosRAT)", "value": "e23b2b40b33f1c633fb5b62ecb177f8de9d5f84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281840, "uuid": "06f5237c-c5ba-4d38-acbb-4ae6ed3d1c2c", "comment": "Malware payload (RemcosRAT)", "value": "f2f671e958255d132a37eeecf6bf43504546eb2ace452ce37bb795df9d28615f106c8c5445a472464b213dc1e398affd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281840, "uuid": "3d3c276a-dda1-4710-863b-fda8f73f3f57", "value": "T10C1523E5232B577BCAB84BF314B02581137532376A02EF2E1D4946D85A12F02F946BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281840, "uuid": "af6ee04d-f2dd-4c15-aad9-e50d8407d6a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281840, "uuid": "9ee7bf6d-6ea1-4f29-ad42-2014f6cf1519", "value": "24576:g6cGFWz+QeT5mz7ppNmvfSpjIKHyvtfcGj/J:g9CWz+pT0z7ppIvKpjIEyvdLjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281840, "uuid": "6d18816b-38a0-49ac-b0da-ddf432ae9a9f", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281840, "uuid": "8dbb1b92-897d-4e70-90a7-3b24977ad4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281840, "uuid": "9025f3a2-6957-438f-9694-c81af0156d0e", "value": "aa8f0cb77774a1f43eefe9952ce8750a2398b6f85abcd11c974ba8fd0c74b30a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f041eef-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309627, "uuid": "8e53ef73-567f-406a-8038-915eb3a551e6", "comment": "Malware payload (AgentTesla)", "value": "78c60b2f7926aa42c3ba0b752eb70694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309627, "uuid": "925db6aa-30b0-4dba-b422-034cac66498c", "comment": "Malware payload (AgentTesla)", "value": "ab159481cc790facfdb9129994f4dd37883b22d586fbc222c589d9e26fbdf8ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309627, "uuid": "fc4d7ce6-b389-40f3-afb3-98a7ae50c7c9", "comment": "Malware payload (AgentTesla)", "value": "0ed4e17538a7bd2244a3fb68102a30745e0fb448", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309627, "uuid": "35ec3d09-b4bb-4d6b-a51c-377ca974867c", "comment": "Malware payload (AgentTesla)", "value": "1837e651c13ecb5d15d9ab0a7dae6884c166b4a4d16aeaa85f484f0624a4bfb1bae33bfc348313243dc51d795c67f0da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309627, "uuid": "610db03e-4409-4649-8bd2-f8c1ca1963c1", "value": "T14315D09672B19463FC8F41BA582BE1DD2D7171037355E23B5B7B3AE1E2019BFB298201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309627, "uuid": "bc81011f-3d7c-4cb5-a116-3ddd622de358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309627, "uuid": "b3f2dd97-7ead-4ff1-9b80-b4ebc6cf5a4c", "value": "24576:Ga/5u61t68pt4ILxE2K8FQquRvLFFLZmXdy:j5Eh2QqcFdmXdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309627, "uuid": "238bd961-c14c-4a4b-949b-c43525486801", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309627, "uuid": "c86963df-e5e2-4be9-83ef-4df323337c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309627, "uuid": "75390b3d-d5c9-4be3-a73a-769d6c0ab447", "value": "DHL Receipt_AWB#290045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c9dcb0-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277822, "uuid": "6485c581-2cea-4c1d-b199-ec942fd53f99", "comment": "Malware payload (Heodo)", "value": "b119847e7c7c20fbd08468af8513ee5b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277822, "uuid": "38d3c063-0423-4d1b-8d98-0035a23415d0", "comment": "Malware payload (Heodo)", "value": "ab37580175c3e4d2e5c8e6553b9efc7f37f60824d69007798b12e42b4160d0dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277822, "uuid": "c7fe0edd-b1d5-433b-98f8-3d0f90ef3a21", "comment": "Malware payload (Heodo)", "value": "701053b96c8f16495c1d705512224f12c78fbfe2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277822, "uuid": "45989856-d3e6-4b7c-8862-e7a6e69c2089", "comment": "Malware payload (Heodo)", "value": "745ddb6cd8acb5d2bbb6993c52f6093313c1f9becf0a34a711e8df8f95e87ad652dac178e0b947b2d1919c9b60396222", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277822, "uuid": "516d65c4-218a-4b60-bf65-1d2fa4d2639a", "value": "T17805233C5F67790FF5997C362AF3847AFCF90858DC96E90A17472A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277822, "uuid": "35982193-abf3-4d4a-9aaf-c98c80e6d51c", "value": "12288:v4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sQ:wevtlkdJe4m19Fgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277822, "uuid": "9a6d5b50-29ea-4429-9516-3d50302528e2", "value": 869610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277822, "uuid": "64a272bd-9ec3-4dc3-9ad6-3f6d453bbcf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277822, "uuid": "17535e83-587d-40f5-92bd-ef3e17992f89", "value": "wkHOf4p32L3LVW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f01f18-bd8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678263704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263704, "uuid": "d05596f4-f585-4ebe-ad15-cc28c0fc5d91", "comment": "Malware payload", "value": "8bf2e7203d55b0ffe9744f74f8db0a04", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263704, "uuid": "0d6033f4-f187-4940-b377-86e582849d6a", "comment": "Malware payload", "value": "ab64c40df8ec26c3e2a0a98bacfea93e0a608e8cb453a9acfba80c5beeba6ffb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263704, "uuid": "408be1f6-387a-40e2-baf8-2ba096aec992", "comment": "Malware payload", "value": "85af4b5588f5017e3a8ad459634867a8f6fd9c66", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263704, "uuid": "b47b11b5-a9ab-480d-894d-05fd300d280b", "comment": "Malware payload", "value": "0b75dfbd2747739d384a15c08922dd198291172a9641c822b544859a806ee27397014439378d670228f3e38ef0ccfefc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263704, "uuid": "291c5b57-4e4d-46e8-87db-8201decf79dd", "value": "T1017423015E1A91FE82591BBF289533DBF9CC93CFB3932E2236656243954D31B487F584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263704, "uuid": "a3cacc3e-dea1-4f35-823b-1bd6dc9cfdc3", "value": "6144:B7ne0CwhZ/3ZCTU4sOIcA2ZwvEFZxNlsaljn+AF6Pp:pzBrpCwPzcAisEFZKi+AFUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678263704, "uuid": "a65fb33a-ec23-4d2d-8f15-b39d4647ac1a", "value": 340058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678263704, "uuid": "97eb4dbf-74f4-482c-8850-350c36a92a22", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263704, "uuid": "bb30a92c-caea-406a-9af5-d6c09ccf148c", "value": "doc0001765546500711700.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ea79e9-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248307, "uuid": "69789f07-e3b1-4fe1-a669-4af417d4dc34", "comment": "Malware payload (Mirai)", "value": "4c6c517ad736b7e41730d12e40dcd890", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248307, "uuid": "4360755d-aa8e-4504-bf4d-482c17be0d99", "comment": "Malware payload (Mirai)", "value": "abbe141f5de7a525802dd5b0f6eed9d3173394166b0146f5f4435e7dbf90888a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248307, "uuid": "2f78e30d-be4b-4a8f-a95a-44ed5e6bcecc", "comment": "Malware payload (Mirai)", "value": "c17b2c2f5854eba94bb9331aaffb8cf553592521", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248307, "uuid": "f4bbd5fe-1d45-44f3-ad80-0de4194e9305", "comment": "Malware payload (Mirai)", "value": "fe73c7bf01a8481daf7506af4de24a6736d82708e80eec04febad8247968d4c9c3ac92c327bd7ada011654aed26ddd5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248307, "uuid": "c28feea5-fa6a-4de6-a5e4-637a7f075750", "value": "T189730856B8814B12C5C512BAFA2E118E332357FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248307, "uuid": "b7a72d98-1f52-48cd-91ca-388ee6654749", "value": "1536:Wln25xPBXk1wnnkL7+KEk07TptkyaaN0bIuiFNPsvHTG8V5GYIW1:bxpXCMkMPXTaQNPsvHq8VERA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248307, "uuid": "ae17ec4c-e29a-462d-a5c2-05c9e641f8e3", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248307, "uuid": "f0eb7720-0051-4906-a71b-51613c35c38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248307, "uuid": "93b62f32-da4e-489e-bb2f-466a04ec5d5e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e509b5c7-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309073, "uuid": "4b2ea68e-ab4e-4c47-84db-8b095f62e8ef", "comment": "Malware payload", "value": "69c0666f1f76fe3f9ff84cb42571a12e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309073, "uuid": "fe2bdab1-6149-4dc2-abe1-30532ba5be0e", "comment": "Malware payload", "value": "ad0fc61ffd51accec08c7193f30b497b1eedc82c22b9b8aab434e4c08e761239", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309073, "uuid": "353f56c7-f486-4af8-838e-6b18c7f4072f", "comment": "Malware payload", "value": "04dccc9faefe79862ac320df07d15b4f3c4beada", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309073, "uuid": "a30215a3-d9b2-4c69-a08f-407ec2e9e334", "comment": "Malware payload", "value": "2c8278cd9d7ef2327473b3cad75b725fa07fb17c87783e321da25caf55ca98ae20284e958da3581686ee89f71ceb862c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309073, "uuid": "0aa63f18-e7d1-4231-825e-91366a1b1112", "value": "T14394136832E9D743C14F403289D980AB8038FE56EFF7D6677399330E917A750A95B84E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309073, "uuid": "8659f5e6-161a-4d8f-9706-118204840603", "value": "12288:Q72O9kH+SOAIbG8JIG3D7nn7SLScf9JUcy2:m19ktOAEG8+ED77Uh9JUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309073, "uuid": "06573ec7-8875-4fb5-b8ac-ff294bac2b3c", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309073, "uuid": "c947b6d8-89b4-4a52-be89-4af26a7c8cd4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309073, "uuid": "117797d0-e610-46ee-975f-a892176f3c2d", "value": "980 8 March 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564ccef7-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678270608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270608, "uuid": "3bf0c6b6-2559-4f99-8361-eed8e37c6bf4", "comment": "Malware payload (Mirai)", "value": "53c70f06dbf4f7dfae20c4eac5b6060b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270608, "uuid": "1fc933fd-eae7-486b-9527-1566f9e0b878", "comment": "Malware payload (Mirai)", "value": "ade3bcef283cc8163e6061beb5932eaf32962101a83df5d69349965e6156db93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270608, "uuid": "9a7729e8-b36e-447c-b8a7-4b6808237c83", "comment": "Malware payload (Mirai)", "value": "16d251259e76649396494cc629eee5e3dfb740d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270608, "uuid": "f5cd9026-57d4-4e95-8154-c4f8d768123d", "comment": "Malware payload (Mirai)", "value": "b61d01c690347964918c030068d8fb057cfe8b1c106961412317d258a26852a550d5a01263785b6bc0d569ba87e27896", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270608, "uuid": "20136107-f074-4bdd-ba52-6824e283cd1c", "value": "T16D733C9AF401DDBDF84BD67A4417090ABA30E3C547830B3663ABBDB3BC721A55913E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270608, "uuid": "b9b44b17-f83f-492e-bf85-13a1078d7281", "value": "1536:ds3XKUFjPUlAxfj2BSM6K8ND8Z4F8BlJW1OxyU9PdJuGk4ROsqQv8:d2Umxfj2BzQAZ4WW1IyWP/Ysq68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270608, "uuid": "33972254-9bad-4e8a-9318-d804772eb2ed", "value": 80424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270608, "uuid": "543d93fd-38c2-4a1d-9be9-9ffe5290294f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270608, "uuid": "367dff56-601f-49f6-81e4-5ebbf88e3fac", "value": "53c70f06dbf4f7dfae20c4eac5b6060b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3c0c1a-bdd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678296925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296925, "uuid": "cc8ece8e-8ebb-4775-82ef-f39c8d6667a2", "comment": "Malware payload (RedLineStealer)", "value": "966182e8882f190aedc79532be30a107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296925, "uuid": "0ff24dd0-184d-4420-8ec0-ef711fdc7a75", "comment": "Malware payload (RedLineStealer)", "value": "ade76c27d8fcf82e28efe778f9e848f6da9ecd4bb2129bb59278d78b69523ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296925, "uuid": "7ee9f141-4736-4ed9-a9f6-6f907aff9fb6", "comment": "Malware payload (RedLineStealer)", "value": "5ac411a465f5415f14d5da6fc76a92e4b042f60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678296925, "uuid": "fbb4cf4a-6f5d-43eb-b40e-9dc590b2a74e", "comment": "Malware payload (RedLineStealer)", "value": "0eb24717ea2ca383fff1e409181045a05e3c8b774b9da1b82bbd7d8a2f8a578de88bdd7c67954171df1e0f1df60ceab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296925, "uuid": "7c59092c-a76b-4127-99c7-62afa765953a", "value": "T15554D01253A1EC24E27687358E3EF2E52A3EF9615E7BE7DA23141E1F0CB21D1D562312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296925, "uuid": "661a9e0b-b8e4-44aa-9b98-d34c66c35981", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296925, "uuid": "b9d0005b-6fcb-46b9-bb8d-051afacc5714", "value": "6144:fMoE36gqo3tsH15bUQzxQQGq+bXIAjh6XyAuGQ/qnZiy:zY6gqo3tszbU0xQLq+bYC6tYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678296925, "uuid": "cf03b065-f2b7-4d91-88fe-ac1a9e491c66", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678296925, "uuid": "4f035d15-0e23-4588-9b58-1270eeaf560b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678296925, "uuid": "eb284e61-6bc3-4f96-9ddd-df7206935884", "value": "966182e8882f190aedc79532be30a107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc5faa3-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268416, "uuid": "dc32f268-5fa0-43a0-b392-8983b0660b26", "comment": "Malware payload (Heodo)", "value": "b68294947488080ff0a99def9ed22c4b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268416, "uuid": "faa8f1cd-1877-4bf7-9c4e-16071e93bd78", "comment": "Malware payload (Heodo)", "value": "ae869a73754e3cd48c17ca12821abf2d188aeea7603b412f4fc7d5d0b6b2d9a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268416, "uuid": "a68f78d9-5701-4c23-8bd2-3f528a3a26be", "comment": "Malware payload (Heodo)", "value": "8bf91771e28c84adb2ad80e92e9d4e13e6c52b6c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268416, "uuid": "1e854005-e6cf-41ec-8e5c-b64a43ea5f96", "comment": "Malware payload (Heodo)", "value": "4367841ae57466dda7807a1ddbd81578febbd768592a81504ae268263bd37491d1cfe868d61b1f081dc19b0ce7bfa142", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268416, "uuid": "bc530770-0751-4baf-bef0-e059315fbc22", "value": "T13305233C5F67790FF6997C362AF3847AFDF90858DC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268416, "uuid": "225d65f4-0319-4769-8fd8-55a0e379c76e", "value": "12288:O4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sx:5evtlkdJe4m19Fg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268416, "uuid": "36374142-08b6-490a-ae9b-181b4172bb27", "value": 872626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268416, "uuid": "253d446f-dcc2-41b9-af5a-7c3a651a7aa8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268416, "uuid": "90e56d4b-1ec3-4d9a-bb78-c20fd4831ed0", "value": "PU7syr1XAm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b043ea6b-bdd3-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678295241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295241, "uuid": "cc61331f-c83b-478f-9e52-26145724d98a", "comment": "Malware payload (njrat)", "value": "98e0f3cb35131e5b5b96423e1d86d66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295241, "uuid": "0dc7504c-e081-42f7-81cd-977f98e2ecce", "comment": "Malware payload (njrat)", "value": "ae8a19111dcc0b707fab05a94d6a712a7912f7ec99c6d11d403dc6b901d84d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295241, "uuid": "d0b0d338-ce32-497c-8cc1-8cc938cd5214", "comment": "Malware payload (njrat)", "value": "efbf7fa1a3b17619e176e2f0b6630cea5bdec03e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678295241, "uuid": "c86291c0-ff51-42c3-9859-cb9d60a37a7b", "comment": "Malware payload (njrat)", "value": "0bad26ac78c3f81cf0d17bcd3d512d88767694c9fa98bd8863494440c536530d12d6d25fec831238f94a93f0a6e27cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295241, "uuid": "057aa0f6-8951-4734-a113-a17726eb5640", "value": "T13DE208067BE94225C6BC5AFC8CB313214772E3438532EB6F9CDC98CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295241, "uuid": "2d64da75-7bf4-426f-a0d9-0616b4adb427", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295241, "uuid": "95d9db03-82bc-41ba-b20e-abbc70197ca7", "value": "384:V0bUe5XB4e0X/Olnw0Q0mS03AWTxtTUFQqzFzUObbh:2T9BuWC55dKrbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678295241, "uuid": "e588528f-979c-4618-9989-b1a7d29d030c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678295241, "uuid": "b34f22b5-487b-4912-b07d-50339d227d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678295241, "uuid": "c79c7de6-cdd7-4c6c-bd1a-083371eaaefb", "value": "bKq1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a517e8-bda2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274238, "uuid": "7e19a502-3d57-4c84-817f-6b789dd9fb05", "comment": "Malware payload (AgentTesla)", "value": "b389f7504a5fd70eaf821458668ee1de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274238, "uuid": "1c5a8edf-6633-408a-982e-7688621a2930", "comment": "Malware payload (AgentTesla)", "value": "aecc4329e8761c80d9f107298a27303c5eb7abbd735f37b06785c8436dbbf7ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274238, "uuid": "0c9da13d-93e9-481c-abc5-913fa795663d", "comment": "Malware payload (AgentTesla)", "value": "bf36fd00b13eaf899d40d917ce6a89f5a170494c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274238, "uuid": "09cacfda-7191-4e0b-b10d-e215de8d867d", "comment": "Malware payload (AgentTesla)", "value": "dd3e1ced40ce3ac8778b88b4ae02f39a3673604f6a47ecd2fc02c888148ffc8f0907f2ccd24615a360d1d63e1c9a622b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274238, "uuid": "f65c667e-2b5a-4f4c-86d0-eeaffbb1cf3b", "value": "T1E8F34A6DA2DB8E51C32D4078C8B1101807F2D1B69617E75D1EB1ACFA3F867C3762E866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274238, "uuid": "9322659e-ec55-4fd1-9616-c576a517a574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274238, "uuid": "0a0f3334-6ddc-42a8-8b42-1d9f36bb080c", "value": "3072:Si816ZlbD857Cv6nZqAMn/ykxM0wUht7Tthcqsf19:SnolbnvJDykxvP7TtF81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274238, "uuid": "dcf5a783-e513-432c-9549-150a9fece82b", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274238, "uuid": "4edc1d26-522d-436a-b8ac-e74429c3cecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274238, "uuid": "6fc8a63e-f8b0-48b8-a72b-e983aaab0a6e", "value": "aecc4329e8761c80d9f107298a27303c5eb7abbd735f37b06785c8436dbbf7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57914e3b-bdc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1678289079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289079, "uuid": "fbd33380-9b88-4444-a874-f8db8ee927ae", "comment": "Malware payload (VectorStealer)", "value": "24f2bf961c5ebc9007ba75b6f029388b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289079, "uuid": "a214915a-8676-439a-98d5-71a903dcbeb2", "comment": "Malware payload (VectorStealer)", "value": "af28704c38179bcfb8bc5757baede2655bf3737d74f28ea28f27c4c7c40f44cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289079, "uuid": "7abc7595-a7db-4827-948d-8d15af91c552", "comment": "Malware payload (VectorStealer)", "value": "69a709244389e702c8a31f72c1f1e05459efde16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289079, "uuid": "cb03cbf2-d933-4a7b-aca6-f94cba958aad", "comment": "Malware payload (VectorStealer)", "value": "6b03796ad1c708520288fe22c4a816b53131bc850264a271216431674b7d9a4b9d8b606ab8e38b4b40146dd13680c4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289079, "uuid": "13446b98-ca41-49cc-84ff-b97116a06ef7", "value": "T19975F15572B15023FC8F41BA192BE5DC2E7176037714E23B6B7B3AE1D2016BFB288652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289079, "uuid": "a56da67f-30ec-4696-85b4-57b80f9f80df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289079, "uuid": "bc742f4c-d9c0-42d1-8e60-3e711e93b1a7", "value": "24576:xa/5u61x/7UyezBAStv7Zmv1OpK/Exl1Oh8z4zIKx/GuHa7pp/gfWSfko/O6nVh:y7/wyCdtucK/Ex/EgMIKxOuHKcko/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289079, "uuid": "473d5284-db5b-414b-a8b6-6c16dd1431e8", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289079, "uuid": "afdb4010-090d-48ee-8601-0419edb49b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289079, "uuid": "52d33338-ca9d-42ec-b97b-263e4a0bea3a", "value": "VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b9723c-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274844, "uuid": "8fa73468-8407-45bc-bf56-1807e3bc2f4b", "comment": "Malware payload (Heodo)", "value": "9118c9fce73c1e93e50f01d5fef6c476", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274844, "uuid": "bf0b1929-b10d-47f6-988f-1809679aaa23", "comment": "Malware payload (Heodo)", "value": "afbc2421cd177bf8ca5e42f8b51c0330f1a7bec7b3214483ce653c691dbbb235", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274844, "uuid": "736ab854-6c1f-4940-abfa-2c3e23beaa5f", "comment": "Malware payload (Heodo)", "value": "585cde3af705f67b38ec9841a3e607320887d27d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274844, "uuid": "391dada4-27fe-4f92-a850-341c29047679", "comment": "Malware payload (Heodo)", "value": "219b91e25e99c1cf0b44ba96650b729aabb9815a93c77f680827f93ab047937216312533a00ab66e9de1123518c25003", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274844, "uuid": "a82310eb-f08a-461e-84b3-788581336022", "value": "T19AD412B1F4AF3319ED21F57811EADC431391B47F03C005D95DA8897EB2BE12A755A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274844, "uuid": "358d01ca-99d1-4906-b229-148d6a948263", "value": "3072:s1lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3C8:s12c/z4a5GLNIp1WMkd3tC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274844, "uuid": "f9a9dea4-7789-4aad-9d2c-dc93b0ff2d37", "value": 642054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274844, "uuid": "e5cbd3cc-97f0-4256-890c-6bf85e09e0eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274844, "uuid": "2a392acf-9cb1-42b5-a570-ec9dc44378d3", "value": "PO000206886.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae95139-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678309405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309405, "uuid": "20c65891-62ba-42be-9a49-4ceef5108ba2", "comment": "Malware payload (Loki)", "value": "92008e7704f07c65a76988700802d659", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309405, "uuid": "757e45e0-c174-466e-a03b-cf1ef7d91a62", "comment": "Malware payload (Loki)", "value": "afc786d184b9cd1ef96ece21fe46a70cdd2f572538786d0d5310b1a05030f208", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309405, "uuid": "781d3880-5fe4-4f3a-bd06-d078685deb08", "comment": "Malware payload (Loki)", "value": "c2c9807464d04da596aa0a883360b83ef9fb1f8b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309405, "uuid": "b7374719-1c53-460b-b366-758fe18a2e48", "comment": "Malware payload (Loki)", "value": "65233a31b77537e800eff9bc09c7a7d63e144d6f177c66609dd3f3fe91b3c04163d797698223b50d20ed65442086b334", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309405, "uuid": "dd9dcf0d-d4f1-47d0-8de0-c36cfa9dc7fb", "value": "T1C1F2B2801D8C6A9D943B12F7455A05B9E2036AF70B32463A6C1EF6B48F06F5DBE2F057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309405, "uuid": "28493f74-b2d7-438c-9697-5fab3f9de9ae", "value": "768:ld3S2noRmO6vSFUEkfm9pfPqVJnqy91JSRo6Dd1wjEZhyOo+YneX01:/BoRmWF2u9pHqVb/IRliImIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309405, "uuid": "982470fa-2494-40db-b952-63c5a17f0186", "value": 35837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309405, "uuid": "0633210e-df4c-440e-be4c-e6298530dd9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309405, "uuid": "e0052c96-344c-41e1-badf-9024439bfeb5", "value": "SWIFT 5900823.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a90752-bd5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1678244843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244843, "uuid": "d632de06-5ca5-493a-92ac-8778df2e02f6", "comment": "Malware payload (QuasarRAT)", "value": "312febbc1c1ede4365eb4c992cfa819f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244843, "uuid": "6861b6dd-8647-4de8-bf35-e40480f1fd68", "comment": "Malware payload (QuasarRAT)", "value": "aff9dae78f13a7e13244cf022de01470272b00e4f6961a40a61c9e9c9b8ca7ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244843, "uuid": "366db33f-a988-430b-9ffa-c5aae8152dcd", "comment": "Malware payload (QuasarRAT)", "value": "d214fb013da24138d62330f59952d2b0ae13674a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244843, "uuid": "1e9d9e1f-c58f-4d0b-88da-2c653c8aa999", "comment": "Malware payload (QuasarRAT)", "value": "befe4a5b6bd36bfc39ebc0813f4a728192390c09df862707c49ed7a27f7298e7cbc123c49d35f598c30d8f46231164bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244843, "uuid": "20594995-2d55-43b3-85e7-aa5a50575e17", "value": "T128748C137398E93BD2BE573AF43606150BB5D457BA16F38F9A5886B82C133868D503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244843, "uuid": "8123bdb2-5290-427e-b7d6-5b491007ac9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244843, "uuid": "d52cf62a-5cab-4a86-9ad7-57e4f1386c25", "value": "6144:1OqQ4i1FFiEKQ9KytPDDlS0hubvSFV1pDE3uuITyn3KbG:kpliTyBdD1EmTyn3KbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678244843, "uuid": "2bb736e5-70a4-4460-a43f-0280e35ef469", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678244843, "uuid": "6ea5c555-8065-4f90-9e36-ab593d8fdcb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244843, "uuid": "d4d54adb-d0d3-475f-ae45-94619acdc0a6", "value": "bKoW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703c9e9a-bdc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678290409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290409, "uuid": "b59148f7-1756-4097-b292-165f47be912f", "comment": "Malware payload (GCleaner)", "value": "5c82f9d43748af8b52b4d11ea71cb323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290409, "uuid": "1c414e33-092a-434c-9e84-f30fedae6bf3", "comment": "Malware payload (GCleaner)", "value": "b024a39550e5668bff7fe4d1cacb83c770c7b21d1b5a52bf81acb847c7414031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290409, "uuid": "53671126-f176-48e3-b3ab-8a4d80f5a8d8", "comment": "Malware payload (GCleaner)", "value": "51ecf6fc4f4e13f1a7634ae2e09b0ef3549a5be1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290409, "uuid": "b287158a-e3a3-46e5-8f65-8c52c493daed", "comment": "Malware payload (GCleaner)", "value": "13a5e99013d42f5430230ef364def88058225e9498402222af82e742f20a6079e2806224d13fe56702eee612fc0c5291", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290409, "uuid": "f1dcc406-17e3-48d3-95d3-2359da7bc337", "value": "T18C44BF02A3E0AC25E6364A315E3AF2F4363FFD629D6BE7D922142B1B09711E1C563752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290409, "uuid": "fc367c0a-0488-402d-be29-f8a85e35fbd7", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290409, "uuid": "690b8a0a-42c7-46d9-9d50-5ddbe0c18a71", "value": "6144:Bpr91XKOC5bWr/gvbh4XcqXft+hCmaX/uqt:BTxjC5bIIvbeVvtAZuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290409, "uuid": "29dd2825-4711-42f6-a738-9c0b6b17332b", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290409, "uuid": "0b81d719-02b3-46aa-a89f-1ff2046149fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290409, "uuid": "47419d13-f404-4a5e-934d-d901184d5cae", "value": "5c82f9d43748af8b52b4d11ea71cb323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ac436a-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678310606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310606, "uuid": "b6323991-da10-4c5d-bb13-8e07b49c749b", "comment": "Malware payload", "value": "bbabecb60a7d91dc4b01da5359280b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310606, "uuid": "e3a3ca3f-fe22-486a-bfc5-c8a84eb39652", "comment": "Malware payload", "value": "b02a4cdd494c1e0963f824ecaf7d676f3c1572be89ddd7e89c79b5f16bdebd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310606, "uuid": "3e445e66-5f32-41c1-b286-adbb0a10528b", "comment": "Malware payload", "value": "54bf0389253f6817d60d269a4c24cd6db8139623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310606, "uuid": "45a808c2-bc7f-438d-af67-691870c9bcc2", "comment": "Malware payload", "value": "953573f4cfa10187c3208d37e298275edbbd2225318993565b2c72c67590ebd85ccffca4c79666d6351abf8c1227f261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310606, "uuid": "e5d4004b-835b-466e-9038-6cbadd8c492a", "value": "T1632633EF5AC2FD6BFC9EDA30C60DDB1BF609D99D132311640316D28DE0B96428A1792D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310606, "uuid": "2f6520a3-5a85-4b6b-80ec-4355b170940c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310606, "uuid": "772ac5db-06c8-4d7c-938e-0deae97e9bb5", "value": "98304:hJMf8K1TFdBNgfXxLePYQ0QPkP3dOpd0Yp0uORyyStn2Bq77F46X:XMf8cTFLeZLSBFPSdOpV0HRyqBy7F4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310606, "uuid": "01f27c92-6b04-4b12-b964-7458e15da070", "value": 4510208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310606, "uuid": "c371a713-9122-40e9-bf73-f292a04ff819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310606, "uuid": "6275096a-c410-4e35-a665-cef16ca82068", "value": "bbabecb60a7d91dc4b01da5359280b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d599f94b-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678284995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284995, "uuid": "93657130-aa36-4640-b3e0-ae806bb771c0", "comment": "Malware payload (AgentTesla)", "value": "f44f099f0f8c17a1f7ac134c81ca8cf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284995, "uuid": "1883f66f-a04e-4610-8e21-227172b26c79", "comment": "Malware payload (AgentTesla)", "value": "b0d84d52f04c8ebd0f32b36034bcd094d5115db5c598b75bd534a802fb9a901d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284995, "uuid": "323d8f9b-5b9d-4500-b444-1365187617d8", "comment": "Malware payload (AgentTesla)", "value": "fa195ea7274c028dd398a611a67f9092b7498fd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284995, "uuid": "0ac6235b-ceed-4bbd-9247-b275bc8340a9", "comment": "Malware payload (AgentTesla)", "value": "f80ec374a3b7718d91c71f0835ecf7dbe54fc6d1fc6412b85670b159c04e0be0a4bec3a9ad9af7923077afd88677dca0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284995, "uuid": "3eec4b87-f98a-4ddc-a097-195c6739d9a1", "value": "T11615CF9972B25423FC8F41BA192BE69D2D7171433355E33B5B3B3AD1D2019BFB288642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284995, "uuid": "d6172835-d81b-4e43-a420-0de4958c90a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284995, "uuid": "f372cbc7-5fc3-40c7-82df-933d5c2670b7", "value": "24576:8a/5u613OOV8QuRB91/4g/jtlkHDycAwRA2OU:ZFOO8/RBr/4EjbuDycA6AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284995, "uuid": "57141627-806e-4727-8e46-970b0c213229", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284995, "uuid": "3d8f2013-77d8-4bfd-9e0d-552aa3ef22b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284995, "uuid": "f99fd710-088a-4fb7-8295-3171720564cb", "value": "f44f099f0f8c17a1f7ac134c81ca8cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db82ad9-bdcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678293492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293492, "uuid": "d5917a6d-af84-4441-9eb3-5a8ca4bf090c", "comment": "Malware payload", "value": "884f0fce0c9f6f0d78db09ea11886e3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kalimpau", "colour": "#85C27A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293492, "uuid": "6e7c7d63-98fe-4260-be19-6ba73a20de76", "comment": "Malware payload", "value": "b1d8a98f6f0c6560e56991c9f96e2f94e058e547061c5d89bf50890b3cec7109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kalimpau", "colour": "#85C27A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293492, "uuid": "5496fe0b-eb5a-4d8b-9af2-c1abc48b6ebb", "comment": "Malware payload", "value": "3b20bbf73e9d096a848cacd138da040a67ba65fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kalimpau", "colour": "#85C27A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293492, "uuid": "cb624fa8-3b00-438d-8429-5be57e86f29b", "comment": "Malware payload", "value": "4a9c543832be7ac2a5033f0113fd1a6f549e2cda82d23b06f3d746f3c10a159a3622857fff73853c1808f61e5221918e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kalimpau", "colour": "#85C27A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293492, "uuid": "020f1d10-3c19-45ad-a4d5-1358a0e68644", "value": "T1D4264B03F8815CE9C1AFD130CAA59262BB70F898473423E32B61B7B52B76BD45E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293492, "uuid": "d0834461-e080-445f-bd4a-a47a07ce6169", "value": "49152:8Zm4Acrb/T5vO90dL3BmAFd4A64nsfJwdMkalwkvll7jRCN7GsibSF7yx9unEzrG:8ZBR4wkvbtsDkZAQHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293492, "uuid": "38e122a2-de7b-4a0c-bf12-9f4c07c67ed3", "value": 4669440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293492, "uuid": "1c9f004c-552d-4b55-af19-39342a72f5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293492, "uuid": "eb93d1a2-3f1e-49bd-88d8-cede03d82aab", "value": "xinit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6f9390-bd57-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678241982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241982, "uuid": "28e19008-bd07-4e2c-9352-33f66aa7bf59", "comment": "Malware payload (AgentTesla)", "value": "862855d603fbc2f5088cc956f62c009d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241982, "uuid": "32ee9e04-f57a-4357-a13b-5c04f060c193", "comment": "Malware payload (AgentTesla)", "value": "b24f91678b1ea52dfb9b6b2ed16cb5ad6cf9dea8b62788ebf07013473be26469", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241982, "uuid": "f637abc8-cc73-4214-a100-6e09043e982b", "comment": "Malware payload (AgentTesla)", "value": "f57256d14174ed7da3ec8600cd9a9b74808f1500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678241982, "uuid": "0ca3d02d-d56b-4630-809f-075438f52acb", "comment": "Malware payload (AgentTesla)", "value": "21203bf96224c30b3011858cd9b84d81bbd5727f678b874758294c069a852731ccd8a3b049325c153eedea664486e3b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241982, "uuid": "49fa2334-abb6-4d51-b166-2d59613957d6", "value": "T1E865BF59B2B15463FC8F40BA591BE69D2D7071433365E23B6B7B36E0E3019BF7688242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241982, "uuid": "1ebb16d6-9f01-4406-92db-df2702f22938", "value": "12288:8Ta/5u62iNVd0cPnlpDcbz6cyyxVv7Vbl9d74iYwLStOc2b4HV9Tx4uJvYpG:sa/5u61Xd0Glp6xndUiYwLStOc2mVBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678241982, "uuid": "ce3717ac-1a16-4126-b052-c0f8c283d417", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678241982, "uuid": "227efeda-68af-41c5-bd39-fc7bd75c70a0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678241982, "uuid": "74239aeb-aa46-4ef9-9433-692b1c33dc96", "value": "nPagamento.jpeg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f188464e-bd5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678243811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243811, "uuid": "2f59743e-9902-4662-851f-25f96eb80519", "comment": "Malware payload (Mirai)", "value": "7b97a0baabccdaac5ecbb8052a74058c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243811, "uuid": "c7fd87f8-dd80-44b0-a647-cf4d672e36f2", "comment": "Malware payload (Mirai)", "value": "b29f52d72ea5c47329cd112443e73d0cc527a9cc626ff382dcd8ceb1b0d053b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243811, "uuid": "71b14293-e679-410c-b88f-aec03752f253", "comment": "Malware payload (Mirai)", "value": "75dedab757ffb0658969673e0fb13242ab9f4b09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678243811, "uuid": "ab36fb44-e8e3-4716-bcc8-40e6650d8bf7", "comment": "Malware payload (Mirai)", "value": "a617b83f83299fd493d947ee0ad35a94b6134b6d9ea2b3c964b6418090c4099718bb484220494d5d1733b27208c59174", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243811, "uuid": "eeff0764-0f0f-404e-a8e2-89eaddbc7400", "value": "T183A2D01176632D65F3EC1C38C96E8357B9671BFCC0F6327679415620C90920A3E3DA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243811, "uuid": "77c367b7-378f-4744-a538-566f5685518d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjOqhymdGUop5hh:vvQn4j+ZO5fKAlxDs3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678243811, "uuid": "ecd8eae5-280e-4ee4-814e-1d3b43bfaa27", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678243811, "uuid": "ee46d184-63a2-4468-9583-715f7b975700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678243811, "uuid": "70d27b39-2305-4b15-8ab8-6b08548b73c8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70573a44-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "ee27f203-e6e3-4632-9f34-91477957d4ed", "comment": "Malware payload (GandCrab)", "value": "bdd7cf2176798468a2d1618443abc182", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "74f5320d-398b-4a38-b2da-526554f50b72", "comment": "Malware payload (GandCrab)", "value": "b2ef5fdf5a9a9331dbb66fe1f18596864f2cb48ec6b05732cf6ed4e0d4984361", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "1363b7a4-6b34-4f00-948f-319d62f47105", "comment": "Malware payload (GandCrab)", "value": "b706d91f6b39bf1721cd59d2e10a448cb987724d", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "41781907-c7e1-4574-b547-7359e0ba3795", "comment": "Malware payload (GandCrab)", "value": "64cd2c4463c525bbbf0dcbb4e117148daff30edf9a1e20b1b6c6d23f85140481dea17f14dfad6b66facba36c460be7c3", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "4c714f5f-4624-4ac1-b4d4-e079193c96d4", "value": "T1C9636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "71708ee5-0a6c-4338-9578-c3cb5762de09", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "47bd787a-5e6a-4739-a285-05641375a1b2", "value": "1536:pZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Ad5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289979, "uuid": "ab9d88c5-141d-42db-92c7-eda8af68167a", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289979, "uuid": "e2180d6d-dd4b-4d30-9f50-ed36528d8603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "76b89e5c-17a1-445e-b5da-cbb85952cde4", "value": "2023-03-07_bdd7cf2176798468a2d1618443abc182_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d584c044-bdec-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678306041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306041, "uuid": "806e83bd-b5a8-4aec-bdb9-a34c944764d8", "comment": "Malware payload (njrat)", "value": "a8bc5b82316d55a0e44db73b5e51ed68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306041, "uuid": "5caf18db-4391-4b3e-afdf-0806456b2e09", "comment": "Malware payload (njrat)", "value": "b3bf0d040723a646920394e69b341d5f686bdbee4f5ac2c7e62b5e919b1c8bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306041, "uuid": "37c0be5d-667b-444c-8ee5-11095910c318", "comment": "Malware payload (njrat)", "value": "a474106fccef78b64efaf56dbf8761f652e8cf52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306041, "uuid": "fc8b2c1f-5fe6-4f66-bc24-271471831174", "comment": "Malware payload (njrat)", "value": "b43ca33d7b52b3af65199affe9af9d35d30f72e247dc4df30cd935a0f9d95ac83783869ff1f164a470985b538d5edea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306041, "uuid": "eced826b-872b-4826-b487-6ebe47e62d41", "value": "T10CE208067BE98215D6BC5AFC8CB313214772E3838532EB6F5CDC98CA4B676D00255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306041, "uuid": "0a359d30-12a2-4d5f-b30b-d4bd5b6f622a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306041, "uuid": "adfea4b9-d494-40ba-8019-cf0753a5894d", "value": "384:10bUe5XB4e0XuOhbw0Q0mS03AWTxtTUFQqzFkObb9:WT9ButC55deb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306041, "uuid": "ae0a1332-2730-46b2-937b-c0a91a332e21", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306041, "uuid": "bf7855b4-a878-40f5-a5f0-c85c76076280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306041, "uuid": "92f2aab8-15d1-41cf-8e48-040a63fd4abf", "value": "bKqF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45190baf-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268432, "uuid": "d0d54e7a-c242-439a-a04c-30d50ebb0288", "comment": "Malware payload (Heodo)", "value": "c0b4c0730e1ff08fae1182cc75f4ec83", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268432, "uuid": "44b0203d-ae08-493c-a279-b0b76b0508a9", "comment": "Malware payload (Heodo)", "value": "b3fd2051fc1b96c495d355db0d334436e1c6d4438cd0beab23a5b1cbca869fd2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268432, "uuid": "1e7d05dd-d5e7-48b7-bfc2-dd3b8a3acc8c", "comment": "Malware payload (Heodo)", "value": "062cfa554c67dc961a65b20aa4d7a49a3bc2430b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268432, "uuid": "9dab3bdc-ce11-472e-82f9-9e89b95ce285", "comment": "Malware payload (Heodo)", "value": "9f283f0b5824e9a0cddf686c2e4bcaceded4b916f8840d45ee01a30f354c15a5951ce1f5382b3c763b1a60ca9fb1c0fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268432, "uuid": "efd49895-d8c0-49b6-8904-98bd87f03177", "value": "T17415233C5F67790FF5997C362AF3847AFCF90858DC96A90A17471A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268432, "uuid": "ecf77ab6-2520-4b4a-8dfd-d304a87e5475", "value": "12288:54DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sa:mevtlkdJe4m19FgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268432, "uuid": "8aa52f8d-f81e-4a82-82e6-f11265fbac37", "value": 886922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268432, "uuid": "2c2c13f5-92d3-46dd-aff2-a88a51d436d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268432, "uuid": "eed19d4e-b079-462f-9791-d6f711dc27f6", "value": "w7ghXXkFAIdhkgsQ49p6SqkvPStgghL7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f3a40f-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284679, "uuid": "e3409ec4-6d0c-43f9-9196-0b2b3d8e78f5", "comment": "Malware payload (Heodo)", "value": "2027319f887e559fc011ce9e302f0e00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284679, "uuid": "f909077b-71ad-452d-86d6-21e3326a142d", "comment": "Malware payload (Heodo)", "value": "b4b37ff96644c5cc4e09cf4fe5607fb6bb44fb3165c3a68d12a2fd360501052c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284679, "uuid": "c8ad21b1-5d8d-4b0d-a7c9-ec84a3d51f1c", "comment": "Malware payload (Heodo)", "value": "64c4b10daaae5b867b696320d7934732e21019ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284679, "uuid": "f9edeb0b-2b38-435f-928c-64800560e0d6", "comment": "Malware payload (Heodo)", "value": "97deca903685e2d3899f89dcee1fc3ea84759860e1493f1d31261c641718fb2ed0887630a3f0c0be9e06ac20906dee78", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284679, "uuid": "237bb405-886c-47ba-90bb-ece3a96ffced", "value": "T14F05233C5F67790FF5997C362AF3847AFCF90858DC96E90A17472A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284679, "uuid": "1b147d76-aaef-457d-8857-c8cbba212392", "value": "12288:D4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sS:MevtlkdJe4m19FgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284679, "uuid": "97a50a70-9fc1-4fac-a5a2-5f3faebb6e90", "value": 869612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284679, "uuid": "f392cc9f-0207-4cc4-bb51-71ed20fdeb75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284679, "uuid": "f3e98890-e81b-4fe4-ab30-ff5828050898", "value": "7FRrbJbDXizucp(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c4a108-bdf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1678310636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310636, "uuid": "035e9ae8-6895-4f2d-8d7c-afcc098b9ab6", "comment": "Malware payload (Adware.Generic)", "value": "f0f04e4cd6756911a6fca7643f439604", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310636, "uuid": "53146107-b894-4b4c-b6c7-93d31387a6df", "comment": "Malware payload (Adware.Generic)", "value": "b56cc0d0dafea37add08e3d5053e6827353a7c9b75ca4d9b1aff8ed1f1b340bf", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310636, "uuid": "33c700d4-6739-4dcd-ad4d-8a866c8fb080", "comment": "Malware payload (Adware.Generic)", "value": "0be3d6abdb849b8f8d7bd18398c726b2fd9e0755", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310636, "uuid": "3e4b6fca-153a-42a9-b829-c1203c57b513", "comment": "Malware payload (Adware.Generic)", "value": "6c4d216a39dd1e5b743aa6a30abb2e856027dfdd991be07fa7b0962203479a951271cba21fcf4ffb97b503cbb43fa1a6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310636, "uuid": "fa45e782-2f64-4eae-9408-c55a10309aea", "value": "T1E5D533A376A18C7CC083D07B7605FB10AB1ED8386A31CA577975F98A9BF51425323B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310636, "uuid": "5e365f4d-a702-4237-8b73-e0625fa7afa4", "value": "a0c012e2da92ad42555210cc958fa405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310636, "uuid": "f8928078-e740-47cb-8496-3743141b7845", "value": "49152:6mDnJjOXJJZZT2dh3ODVHcxFVa+jUalhMQWd508AxGLOGQORIUrIy8Lj7Ir:XD1OXBAmHcxF1UaLT8CxG6yRIUs/fsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310636, "uuid": "4d831c2a-5c62-4460-bc26-20a4301ffb5a", "value": 2865016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310636, "uuid": "646b3f13-f9dc-443e-8457-5a8f68ae134b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310636, "uuid": "6d894308-ca56-4d0d-a662-15c9672125d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef15ba6-bd98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678269737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269737, "uuid": "6a4b783f-86c2-4cb6-b559-2e3bf792b79f", "comment": "Malware payload (Gozi)", "value": "c9e18364321b63d9c82bbfe1140b3a14", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "meg", "colour": "#7760E7", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269737, "uuid": "c7b006b5-4c29-4343-bbcb-7a200398197a", "comment": "Malware payload (Gozi)", "value": "b57e90f3f5326920735a5ebc884b4ad1b28e97b48bba4615ab6e7092ea386bd2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "meg", "colour": "#7760E7", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269737, "uuid": "2ab8f315-9e56-4de1-9bf2-3d74011701ff", "comment": "Malware payload (Gozi)", "value": "c2cfb5493a7028c86f2586be202f30677217ed8d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "meg", "colour": "#7760E7", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269737, "uuid": "33078b0e-ad53-42ef-bc8d-de384837b9f5", "comment": "Malware payload (Gozi)", "value": "3881c0f9d721ee0549ea80c5eba32a45010b2dad77e562b600b92ac665480ff3763c47e546fa3f2de70853d7cb3d7345", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "meg", "colour": "#7760E7", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269737, "uuid": "8db69ff7-af38-4192-98a2-e10161250ffc", "value": "T1C9F0ABF88C181609C2DF3BF6C1BE1626E07571CC27B0808323A7E2004500BF04B82754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269737, "uuid": "0bd0ad98-0bce-4f8c-b082-e4ad8c061c22", "value": "6:5jCIu/3kbur+T4SLSVX1BMKLyneqMne+t8FG5qtAu/WRhHEGG8JX:5jpu/UI+TrLml/zqMeEu/yrJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269737, "uuid": "982bd777-9830-4e84-b860-07120ef09503", "value": 466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269737, "uuid": "149b713a-15ff-4405-aa4c-030c54f179fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269737, "uuid": "067e51b6-39f0-4863-a520-004a85e984d6", "value": "azienda.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1715af33-bdc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678287682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287682, "uuid": "f0b87213-6142-48e1-950f-3b8c3a3d0050", "comment": "Malware payload (GCleaner)", "value": "07288e5e03cd70d0ac2cc306bc45083c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287682, "uuid": "517776f3-41a4-4c9c-ad7e-02fc908ebdce", "comment": "Malware payload (GCleaner)", "value": "b58e7960e34921d61b87169ed3465b816145d06f04ab42723688bf12e3201faa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287682, "uuid": "3d482ae9-f1db-4da3-8794-670ff0e35664", "comment": "Malware payload (GCleaner)", "value": "610dd36a7ac135f6a7b130bbe5a8a0f65dfb3475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287682, "uuid": "8dbaf7d8-3fc5-4839-8b9d-cdbba53a1290", "comment": "Malware payload (GCleaner)", "value": "c9ab73a829870c03ccae6c40ac8dd3f3a58f47b9a5881fca65f06c087f962f504eea6678124718acf95ee63c35b63fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287682, "uuid": "36c09a4b-0fee-4168-b46b-fe39f6848bf3", "value": "T10C44CF1193A06C20F6669B318E3DF3E5663FFD619E6BE7C922642B1F09B11E1C162713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287682, "uuid": "a9e08f69-74ff-4d00-9404-5bdd7d13793e", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287682, "uuid": "e1011073-7f0e-400f-a707-967e78b1645d", "value": "3072:J2CMdPt9W8LTxXLJBOf8wm2xxDOmRkgx8NYg+5DkD+IqgUJX07GAC0G4rVwx6C+F:0dl99LTxXTe8wtxkSkYgFvqryPfV+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678287682, "uuid": "5118f146-cfc1-48e4-9a9e-6b67717eb360", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678287682, "uuid": "608273a7-6015-473f-a32b-e9272748d7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287682, "uuid": "88678ad8-cfc8-4506-aaff-0b8037ce904e", "value": "07288e5e03cd70d0ac2cc306bc45083c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21178d5-bd64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678247596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247596, "uuid": "5e35d3c0-3670-4725-abe1-0aac8eba32d5", "comment": "Malware payload (Mirai)", "value": "ca1f557595a6fdb1d10aff65637ab519", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247596, "uuid": "fe0ce9cb-7e29-453f-b386-95202638eac1", "comment": "Malware payload (Mirai)", "value": "b69d314e1845ca1e8efd47acc86c4b8f987855c1da73af08ac896e4156f8b3fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247596, "uuid": "9c3ff2da-b259-4185-bee0-47f5b22e261d", "comment": "Malware payload (Mirai)", "value": "df5a914bed36d31af81fac19d4e7a31fd605019b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678247596, "uuid": "2c4f087b-b3a2-4eac-bc3f-07601a44f546", "comment": "Malware payload (Mirai)", "value": "2204d95613ccc4231e93b9b3994f8c0cbfcd7d80633f3c7cefb9425aa0d27f5c826675371174d23001f4af06c857c5e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247596, "uuid": "91675eab-3bc2-45b4-b825-b921703fbc81", "value": "T101A2D029D345AEF4DFEF9D9457C2C2C277E543C6268AC8F240EEAF01350A056B789C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247596, "uuid": "d063e78e-6d81-4927-b6ac-5059638ac272", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5yM4uVcqgw05VxJe:9RxsSVsMD6xiJJE5zRWNz4uVcqgw09Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678247596, "uuid": "a243ecb1-f877-4351-91db-0f60394d6ee9", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678247596, "uuid": "767b632e-58c0-4ae1-b77c-8e6a30e8bc58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678247596, "uuid": "346a4ca7-ecb2-4f5e-97d1-12f8506104ef", "value": "ca1f557595a6fdb1d10aff65637ab519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa186055-bdee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1678306827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306827, "uuid": "e36e0b99-7ad6-4d61-bbea-5e60ca0df492", "comment": "Malware payload (AuroraStealer)", "value": "4a39e396ddbd9c7116858b6f96a06eb2", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306827, "uuid": "984a1638-0f2a-4c34-8f4a-2c01c9d094e7", "comment": "Malware payload (AuroraStealer)", "value": "b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306827, "uuid": "8f560e86-32ef-4d9d-89c4-8e04a5a4e569", "comment": "Malware payload (AuroraStealer)", "value": "53d51d7c43f6af46f720025eafbf346586bfae09", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306827, "uuid": "eba69d99-9558-4a5a-a729-356b2f0b56e1", "comment": "Malware payload (AuroraStealer)", "value": "b91a295e8c68d6151f34c752c6f27a01408d7838ab6112145fe418cccd1596a3d115b4d85955b30c21e213ed0fa54b1c", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306827, "uuid": "5ecc3b39-4e79-4732-b10e-8b9fd70a65a4", "value": "T11365231076B5D333C40FE53E5AA4DBD21A777520BBFC9E63326A20672A206D2C17A35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306827, "uuid": "4750a3c0-bd72-420b-a702-c9fbee2074dd", "value": "5a95fc1207ce8743cd9161ce41436aa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306827, "uuid": "8c395c87-f196-475e-8170-b2b5541ecdac", "value": "24576:mFsLW3eGfYYrd+z9tEdnJkQ8D9rgf2UhxVgnj20E+3b+sC5E2B7K1X42tdYyTr6i:BLWuMrpP8D98XYqY36sCFK1I2tqu2T47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306827, "uuid": "a2a77ad6-35d4-4b03-9f3c-55c17169dc55", "value": 1487606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306827, "uuid": "79c68f91-01cb-4b8b-abee-4a125954368f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306827, "uuid": "892177e4-b2f9-499e-aafd-bdcbdb003292", "value": "4a39e396ddbd9c7116858b6f96a06eb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36596e6d-bda9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678276997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276997, "uuid": "4ea492fd-1584-48f2-a07e-b8590308d74e", "comment": "Malware payload (Smoke Loader)", "value": "f5e4f6e86f8c5cbd492e36ae2aa9f72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276997, "uuid": "16a4da8e-d57f-4035-aa84-950af06f7efe", "comment": "Malware payload (Smoke Loader)", "value": "b76b84ca83697613fb8d2a8bc116961c8aadab57ca385f8a3032d9399aeff01f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276997, "uuid": "8e7ec19a-41f4-4f69-bc96-784589030428", "comment": "Malware payload (Smoke Loader)", "value": "3d5be475174f64cb83886ea3109767686fe0bd0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276997, "uuid": "55b2b070-4769-4f7b-b698-902b91b3cc3f", "comment": "Malware payload (Smoke Loader)", "value": "33ca185d9b27731c4a08f12480f5097e7e1406d093cc93a544ded6819e851c323287c200cd1fc6aadc709feb9aa54c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276997, "uuid": "d9682b7a-7d8e-4f9b-a1be-c9382f6cf74d", "value": "T110F3D011B7E0C032D0A31A316878D2A26FBA7C725DB8898F37A41B3E0F706D19979757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276997, "uuid": "faf423aa-d452-4381-9b06-e2c73085dd20", "value": "1c8b36d5b484aff1ec9ec4a50bf16f99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276997, "uuid": "c1926038-639d-4b74-8d72-f5196df488ff", "value": "3072:4IiV3N1ncO8WEmQSkDMeAUhL1zkeM5sOeVbfZgH:4FV9xn8WEmjkIebhJQeROtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276997, "uuid": "453ce3bb-9018-4561-b29a-cf5c5d9613e5", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276997, "uuid": "6ccfa46e-d903-4689-abe3-abc929fc94af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276997, "uuid": "4177e19f-ff6d-48df-9e3d-09f6209bdbb5", "value": "b76b84ca83697613fb8d2a8bc116961c8aadab57ca385f8a3032d9399aeff01f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b93262-bdcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678293429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293429, "uuid": "11a5e62e-3a63-461b-bad6-c3d43fedd617", "comment": "Malware payload (AgentTesla)", "value": "1ded1cdd72e54c2f3cc59118804d41c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293429, "uuid": "1e87f8a0-4f18-418c-94ff-37f5c4ed19fe", "comment": "Malware payload (AgentTesla)", "value": "b7cdc5d7eee046fb090cee2dc703e8b68e84927dbf5b49e787c97e2dcf61777b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293429, "uuid": "c8516feb-717d-4434-84f2-c53906aebc76", "comment": "Malware payload (AgentTesla)", "value": "5800259deac2b78977da5e36e175386f0a8f89e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293429, "uuid": "3b0738d0-1632-4ef2-957b-016eb0cd0d74", "comment": "Malware payload (AgentTesla)", "value": "2125f4756f70241c2c06db5fbe4854fa03df13001f8574177ef2f10746f6fcd8d157652bf7b57964b8590f8150d7262c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293429, "uuid": "437b320d-462f-4f76-86d8-18941236b620", "value": "T1BA958CF08E52FE91DBAB0D8480DC19C06C4C1BAB87AD9948FCC82556E2E1A64FFDD571", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293429, "uuid": "e7a36d0e-b426-4d3d-8600-08586436289c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293429, "uuid": "c29ca49e-6bf1-49e8-8551-0304311b8606", "value": "24576:td7WycQ5Q4l6zSnRn0X8tME0zoYUS6JvODX8XIriy9hdAa9lA:5/l5GPx7SIrdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293429, "uuid": "a8118f92-98fd-4889-8832-491071c152f5", "value": 1934848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293429, "uuid": "a00894b9-a541-4bdf-bff4-daa82f0be9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293429, "uuid": "5a48383e-58dd-42db-92b0-ea55f6e84f6c", "value": "ISF Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1219925b-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309578, "uuid": "44e13509-b003-4e37-bc68-bac83083fd61", "comment": "Malware payload (AgentTesla)", "value": "4d3c5aab4e610c19740f387b9952ef54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309578, "uuid": "6cd83757-d4e5-4270-95f0-13980db01684", "comment": "Malware payload (AgentTesla)", "value": "b8240784dc76e0d06183f6e4518b2a4aa24a7cbe28f275e13ffa35b26d7df343", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309578, "uuid": "97f6fea8-ed93-4d70-a4c9-b7f25ea67a18", "comment": "Malware payload (AgentTesla)", "value": "e4f9adb7a2991753474984a583aa94a960688a69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309578, "uuid": "72c78f31-a9e8-4d17-b7e3-2ca259da8269", "comment": "Malware payload (AgentTesla)", "value": "78111dd2b891347d06e6dd6059cbf4ee3b6a185b3e35e57537028194d499639d54271514ceca1b823faeff13a98f3c35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309578, "uuid": "b0a10303-a5d3-4d4b-90f0-b7cc96f1492a", "value": "T17884D0D1D98CACC2E96312F07EB5EBA5719FBC9E41A14A0836577911B0332533A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309578, "uuid": "e34cdb65-7de8-4c8e-bc5a-d35428a392a3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309578, "uuid": "0d93d5d3-a673-4a61-ae41-f875eda5917d", "value": "6144:yYa6rM/p5HwVEBb7UH+ok/MhReuIP7LLFzh/U6UG6nY1anau:yY1M8uaGMjk3FZUpoan9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309578, "uuid": "8a6e1e0c-fc6d-46a2-9565-01cb20610d29", "value": 398234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309578, "uuid": "85646438-c625-4129-9511-94f1e15e05c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309578, "uuid": "be6674c2-0b5b-4631-8f3d-d7827703b811", "value": "Fedex Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1314bd2c-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308721, "uuid": "c1deccd3-dece-47d2-9b91-23ba09c2ea00", "comment": "Malware payload", "value": "6fb6ac9d4da8860a11cfdd89d3a74b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308721, "uuid": "dd7b15a0-b1bf-4c8f-862b-0a668f17387f", "comment": "Malware payload", "value": "b87de1cb074a2895848db478ffbac9f6efbcde8365dbd0989bf1f3b3715bef75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308721, "uuid": "7ab384f4-8d07-48e3-9ee2-cbebc624dc1a", "comment": "Malware payload", "value": "386d3c040cba539fe7cf85c218780eb3b53b732c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308721, "uuid": "50bc7d76-dab3-41ee-b4ab-cbceb58db679", "comment": "Malware payload", "value": "60f0ce13a3c9e3bf3e3a371efbd06626439e6ee6b0236622311ba7abc79d3aaa95e06348ff267070196fdd9ca7193b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308721, "uuid": "96e22ebf-23e5-41a9-8e16-885af9c343a2", "value": "T13BF523A128A3BCC27177603677671F11F14D71AA2E215B0D972462DB213B38A632FDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308721, "uuid": "2d4be275-30ac-42a4-bfaa-01c136ad60d0", "value": "98304:M5L4ELL8rWiokdtDUifKbw3HHBe3uylFiy:6LbPxaVKbw3HHBepr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308721, "uuid": "73b233ca-e13d-4cb7-8520-640dd6b8d39e", "value": 3329217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308721, "uuid": "256ba8a8-7e3e-4071-8c51-5a6450d49c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308721, "uuid": "cddb1aae-f327-4ba6-91bd-2fa47389f5b3", "value": "6fb6ac9d4da8860a11cfdd89d3a74b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90788051-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261257, "uuid": "021f00c6-a58d-4318-9b8e-ab7abfc8e088", "comment": "Malware payload (Gozi)", "value": "6cb213ffca1cae480757990e6ec59b59", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261257, "uuid": "4ef3cfdc-672c-4b8d-a428-604f0d84b007", "comment": "Malware payload (Gozi)", "value": "b883d0faf8a9f2396a311b6005ab68073ff0e6a09cafbdc7b58a8439d52409a1", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261257, "uuid": "4dcadce8-defb-4d7e-9d6c-c5aa8937353f", "comment": "Malware payload (Gozi)", "value": "fc13c7741afeb9535031d2cd85c8fcccec990e6b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261257, "uuid": "39e252cd-005c-457f-a885-80c16ce6a859", "comment": "Malware payload (Gozi)", "value": "16a15d9c9c60b26845377bc0b7df73bfde54f55a2695d48cf52ee8736e5704fba57baf158f8f31594874b32c383ada35", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261257, "uuid": "8fedb19e-7da8-44aa-85b5-c7cac80c6771", "value": "T1E4F02BF444094799C59BC27854BB16B198F0BA9D01E6014F166C78B44D55AA12F4925C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261257, "uuid": "25892764-28b4-4ded-b334-0dcedb912fae", "value": "12:5joiwsWKrnW3xqaFbBzb/1gMxfTf3yZ6xWlRiU:9GsWKDW3oaFb1BgKTPyZaWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261257, "uuid": "14513826-d7f9-40bd-b514-238ff631acbc", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261257, "uuid": "9fea0b08-0734-41b9-843a-bca1ee832a20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261257, "uuid": "5a953a7f-d92f-4040-8550-b072a3d84987", "value": "impresa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4e9d75-bdbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678285438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285438, "uuid": "3270617c-7dcc-4ff4-a6d6-b542a2200ff2", "comment": "Malware payload (GuLoader)", "value": "1157c57ccf7acc41559cd5ed37b227ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285438, "uuid": "0e8a4e70-3011-440f-9d0b-24813770e8a7", "comment": "Malware payload (GuLoader)", "value": "b8b41e880e4996670f27683a769cee9b3dca506e8d878b7dbbb87eeb2ba9f66d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285438, "uuid": "b410fb46-4404-4ce7-90d3-418f08d4d383", "comment": "Malware payload (GuLoader)", "value": "8f31e9dadc2abd281af849881713c7c5660ee764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285438, "uuid": "f501ac34-c247-4769-9f72-71abf15b86af", "comment": "Malware payload (GuLoader)", "value": "e800368302bdc22bc91904d7d60907201ed6b89ecbdbd508edbdc099632a03abce3c34084821c0990070cd702e63ac8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285438, "uuid": "f0e2d635-0913-4a95-8181-1a5eed365b58", "value": "T1A7C402B1A2AAA453EDA040B1E31394F6C578F279AB7076D77283FF3FAC16402D50954E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285438, "uuid": "528cbdf8-a859-4218-8795-fdf07f43ad36", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285438, "uuid": "69ffda24-df49-4db2-9453-b6c53aedc3c7", "value": "12288:wEYwyEZGINxj3gywljw9QNYv/TJonkk+tBDOmFSzK7PWBY:wEdymGI3j38pI/v/TJokkSDOm0K7ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285438, "uuid": "6502be56-4616-405d-95b7-1a7c0b253122", "value": 580552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285438, "uuid": "ff037a2e-b3a1-4be1-b5b0-f6e0168d0081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285438, "uuid": "2d3a6fc7-8d3e-4f8c-85d0-0c336e74a9a6", "value": "GRUPO PROMOCIONES Y PROYECTOS, SL \u00a0OFERTA 2602200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2846ea5-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299083, "uuid": "8976f542-db38-4f06-b3db-c2c7ba380742", "comment": "Malware payload (Mirai)", "value": "a02de59f1a5de9ce2c618eeee7f5b33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299083, "uuid": "fafc1a7b-aa41-41e9-bb01-c5702b09f6a6", "comment": "Malware payload (Mirai)", "value": "b93143346b8e9af288bd95f79ca9714bdb70c3be663bc400a7f6f85bf411e591", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299083, "uuid": "110c21a9-338d-46d8-b921-4bfdfce7390e", "comment": "Malware payload (Mirai)", "value": "59c87842abd496e86ac8ddf6ea7dbc74a9eae3eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299083, "uuid": "63982706-2005-4bfa-9e82-7f825ad765d0", "comment": "Malware payload (Mirai)", "value": "c9a35edfaafa1814281340cb2da97ce0590766ddfe0b2d8daea777f320d0f95a3f6191273b3888271617101bcbf412ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299083, "uuid": "8b42b038-e0f6-49f0-a21f-71e04e0435c1", "value": "T18483C606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299083, "uuid": "83f26060-2660-41ac-b9ff-d5cddfc83b0d", "value": "1536:iVLy4OsRKa+0j752dCeguVm8UZlDwfkJ4ZYrW4:iVLy64qFezguMVDoy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299083, "uuid": "d0268ada-2660-4281-a48c-9d247984976a", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299083, "uuid": "dd0575a1-5309-46ec-858b-853f32c66de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299083, "uuid": "3049b786-799a-4764-8bf2-5219a0c67d05", "value": "a02de59f1a5de9ce2c618eeee7f5b33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bbbcc6-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678309510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "1a0fac76-8bf4-4a3a-8896-b449c6ad6173", "comment": "Malware payload (RedLineStealer)", "value": "26db14ad0b3f52784f53f5a9cde42d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "311d0f2b-a3bf-4cc8-bcdb-69672c27d7f5", "comment": "Malware payload (RedLineStealer)", "value": "ba0412f1b3344651077a3e0055cb60652040f070c28f1e7ac21212cce4b4955d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "e80cad8e-1d65-4039-9c12-80a4c64abd5f", "comment": "Malware payload (RedLineStealer)", "value": "683fd53fee7a0274af5b4bbc20a8c0ff27e28b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309510, "uuid": "e74ca9c6-5b95-428a-bc99-fdf56711356f", "comment": "Malware payload (RedLineStealer)", "value": "deb8bd1d2b65cf1c384dc4e37e76b3327594357091bc0ec1fc535160621670ee533666cdff7cab6d91eb39a61626d1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "ac0ae5d7-5125-4212-b38c-308458b8331a", "value": "T1CA540842F64460B9D261ADF552C48C29119D397313BF868E6B72C8DF6306EF4CE5A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "8ea49bb4-4939-4b88-b5e1-195328d241cd", "value": "ed6858564510f205377e4e4cfbf8ff0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "ceefaa78-e7d0-4b50-bd76-5bf8b2fed7c1", "value": "6144:vidBppzpduDIwlxMNweGTq/0mrORdWq+/:vEBppzpduDjkpV0pdV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309510, "uuid": "b1177c4b-807e-4166-a64b-877cebb38147", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309510, "uuid": "4ad57cd0-adc8-42da-be06-bbfcec774437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309510, "uuid": "da707236-3761-4646-8876-795f823968d6", "value": "26db14ad0b3f52784f53f5a9cde42d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b3217b-bdb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284110, "uuid": "15dc1544-c528-49dc-9b23-96516dba9473", "comment": "Malware payload (Heodo)", "value": "98f03fa652d8cadeb405688d6376f107", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284110, "uuid": "68914b90-1ab4-4b29-a054-b508ea73e8b2", "comment": "Malware payload (Heodo)", "value": "ba2e0ba92a47ccefe5bf39e95f4207e817fa1cadace95cb4c7b7102041bf3240", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284110, "uuid": "66ba221e-868b-4952-b5f6-cf565c6dec16", "comment": "Malware payload (Heodo)", "value": "f4936587ef65b4aa8a5893150eba24202999c4f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284110, "uuid": "e0c965d7-8069-4879-8fa6-f2a878042b81", "comment": "Malware payload (Heodo)", "value": "7266d40c35b2816105a879309fa452709fb5788b246bced28914b360e0044056137c96bb8efbfe03deb83e2ca1b04191", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284110, "uuid": "34bd1a64-51f1-490d-a838-a30db4e1f75a", "value": "T157F412095F083523D479807ECAACD8C108E5869DD283B8E935BD518E8265DFBE8D4F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284110, "uuid": "01f85f16-427d-4e98-9700-adab51886b7f", "value": "3072:gJPwOBqguhRok0EOsHYQLMTwyOy2w4OLWxKJ5SuNVWla3Z:YjTuh1OVQTy/LWq7Wlap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284110, "uuid": "bccbe00c-c923-4d00-b017-540717b69e1b", "value": 732549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284110, "uuid": "845a4373-e432-4825-bba6-3687c80eaca7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284110, "uuid": "d9070677-3325-43e2-b3c1-0936a6fe4a04", "value": "Scan 2023.08.03_1339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ebfd4b-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308732, "uuid": "92df5291-c844-42f0-8c49-04a6aa728cb6", "comment": "Malware payload", "value": "63b52dc8c2257b9eeef4957aaf041cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308732, "uuid": "113778a7-a55e-4957-acf4-2e6d7bd490f2", "comment": "Malware payload", "value": "ba5ff1d9734c549d5df671c2891b58228054bc7689b91cf0b7b02e6e1a598139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308732, "uuid": "c511db09-6933-4165-85e8-92f84a6dacfb", "comment": "Malware payload", "value": "37f2315507ee443ea3893776bded235b3776fcb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308732, "uuid": "b3886164-cc0c-429e-a0d5-58106a80ea0b", "comment": "Malware payload", "value": "ca24f46bea7caa4839a4e5ce9633e2afaf79f81d49c19ca1ade51b5da3ab8cc6a788dde67202929975ac9f5ca394d5b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308732, "uuid": "28cec1c5-20b5-4984-b496-aa5013729974", "value": "T15EC6339F3DC6B5F8F6C61534CA3AF7CB36F782814490C91DBAE34582E832E51A122957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308732, "uuid": "05a30124-9a5d-43ab-b071-f62cd3da9fab", "value": "46bb1f2f302a3eac0c1b165f1a89cbbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308732, "uuid": "4ec16aeb-0801-4fc9-86da-115b16db6d72", "value": "196608:kZXqP8ngnNj/Y3HJlCvIDlWFIgoGkNa6kGr4B1Ho/5EM5QRF9:8y1nNj/Y3HJs87AkNfkzohF5QRF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308732, "uuid": "f7300124-f3cc-474a-abf5-22b2709e2cdc", "value": 11695104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308732, "uuid": "125ef8f4-d5e8-4dba-b00c-d8db8b9a1806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308732, "uuid": "74cb5fe3-b2e0-4c64-88cc-c10aec310beb", "value": "63b52dc8c2257b9eeef4957aaf041cbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7643510-bde1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678301346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301346, "uuid": "84f4d5db-d235-4409-8e57-de3e63f70885", "comment": "Malware payload", "value": "d26e023d8917aee91e13e41ea1028fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301346, "uuid": "ebabf343-572e-4e68-a350-b03c6c49de61", "comment": "Malware payload", "value": "ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301346, "uuid": "27d425ec-8fae-47b8-b78e-3fa1a4efa668", "comment": "Malware payload", "value": "7cf1ef2c09c1961a921fa7fd7feadc2410e9b044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301346, "uuid": "dbeaac40-63d2-470e-8382-13044c907a58", "comment": "Malware payload", "value": "e6511208d7ad093c2f1eeddc115c2d6af8a8186146c445c8d211bbb05597628617010e86c4a1c810fd6739f0dca4f476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301346, "uuid": "5876cbb2-2d5c-4b02-9578-84c63404a126", "value": "T1BE96333EB5211BB7F3EA8B335B208DB5B5E9404A4611483FA410A77C1659FF0E95393E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301346, "uuid": "44274ab9-6248-4508-99c2-7497075f9648", "value": "196608:kVeacQyAVSR6y4toiyTq0GjA62O2QRcVC/ymgrjwPcJ7lwEj:kVYAgROs2Xm/WcVC/dEjwUJ7lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678301346, "uuid": "42925241-e159-4c89-b855-904369709a55", "value": 9454471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678301346, "uuid": "e5b609cc-67dc-426c-b18e-6331b48463b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301346, "uuid": "859a1cc5-8b49-4439-8583-acf9a8bc2560", "value": "ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5367f63-bdee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678306872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306872, "uuid": "304b79ea-a6d7-4c87-9c88-214cb4e47580", "comment": "Malware payload (Gozi)", "value": "8471983647373e0bbf28b42cbeef05cd", "object_relation": "md5", "Tag": [ { "name": "7711", "colour": "#4FBA9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306872, "uuid": "fda38f2f-244b-4e76-8f61-bb0b5c049804", "comment": "Malware payload (Gozi)", "value": "bb426461ef70ffd601cb64a687c62edda066b99a79e49d880918300da5eb6548", "object_relation": "sha256", "Tag": [ { "name": "7711", "colour": "#4FBA9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306872, "uuid": "c7c10ba3-cd7b-459a-868d-adedb0b85500", "comment": "Malware payload (Gozi)", "value": "b96e96b206aa49c958f1f72faa9c94836ba40ee8", "object_relation": "sha1", "Tag": [ { "name": "7711", "colour": "#4FBA9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306872, "uuid": "803eb012-b79a-4599-9299-b2e37f530ad1", "comment": "Malware payload (Gozi)", "value": "b136855f001e26f32d50153e1716cfc5cdad6e989993c2b69e3dfeebec9c4d6ad8f26be46cfb4c4b98a4446f0acb6a5e", "object_relation": "sha3-384", "Tag": [ { "name": "7711", "colour": "#4FBA9F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306872, "uuid": "728d135a-297b-45c6-81e5-16f4a82ebd0a", "value": "T192047D0253E06C35F667C7315E3EF2E67A7EF4614E3BE79922145A2B09B11E2C963312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306872, "uuid": "18940f7d-4056-49ea-a315-489ae8eb1529", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306872, "uuid": "82d2e503-d8dc-4f55-987d-bf4b4c9aeffb", "value": "3072:99TF8soKOiplAtOJy6xOAOwk+JpWV9I7C+vaaTqF:R7ojip5DOwk+JpWV9oCua7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306872, "uuid": "512edd9e-0467-410e-ba7b-6817832da487", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306872, "uuid": "b7a5947e-43a2-4b9b-b2f7-c1c5ebf274b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306872, "uuid": "9da71ee8-f0ad-4b9a-9995-e7df13b57144", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068e0cf9-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262744, "uuid": "a51ceceb-a438-4f84-a2eb-990b5271fe3d", "comment": "Malware payload (AgentTesla)", "value": "a7cd469181c657f1ab0e5a5863d51dc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262744, "uuid": "f801b970-9031-47b2-9367-cb06bc75a24a", "comment": "Malware payload (AgentTesla)", "value": "bb669acdca285f31a434c7621b319b3beea0806634cb35c3dc23a7dded59d864", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262744, "uuid": "b504d5b5-bef2-4526-b458-bc1c5519720b", "comment": "Malware payload (AgentTesla)", "value": "0d0588f2f48772ddf694badef8a1de4d27caa6fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262744, "uuid": "487d860d-8364-4f52-8c30-92e78653cb50", "comment": "Malware payload (AgentTesla)", "value": "c45d4840c6d5e80049f8fa2afa9009a56b3da44dd8b7384e33cbc8296ac3c759df3e790a0e7abd18049b433fa550ec30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262744, "uuid": "4626ae6e-a7b2-49f1-abb0-7a1f06c1ac25", "value": "T1A7529F612432100DE28A0738379B6794F786A90BB1FED344619FC76C175BC1D571EAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262744, "uuid": "e3fe2b83-549b-460f-ad82-96168ca050e0", "value": "96:MlfZfz7YxmbwDXaeWXzm3boEofPzOaQ3EEEnx+17lSYtTOlHjMB7l:MlfBgBXajmLoEoSb3ynQ172xMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262744, "uuid": "9a7c4469-a50d-40da-8c1e-f65ea277274b", "value": 13607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262744, "uuid": "663950ca-4a1f-4036-ac78-7e118f11ee7c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262744, "uuid": "77b4148c-e49f-4dd1-97c7-d7123bc8c6d6", "value": "Purchase order 2023-000011.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a06961-bdd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678294525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294525, "uuid": "75e76d91-9ed4-46e7-ae6c-96f041d2a2b3", "comment": "Malware payload (RedLineStealer)", "value": "b0ea2c24f02506398abaae01d66def14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294525, "uuid": "0791e5ef-1bfa-4030-a2a0-2080d46686e3", "comment": "Malware payload (RedLineStealer)", "value": "bbaadb0917566495a400596ca4d3b3803aa7f6f49f82071a4f146c831da9794a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294525, "uuid": "6eb901fe-fa1e-41ba-96e8-2bc06d3d48e6", "comment": "Malware payload (RedLineStealer)", "value": "68d8be92847434061877ecd6a6e2542895129a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294525, "uuid": "ecdbdb37-c88d-4d1f-9a4a-cac658fd438a", "comment": "Malware payload (RedLineStealer)", "value": "1ff4a15a142271e244efcd9754a4995048bd2ab2753195ea14c05c83888550c0dc80cea6c2c8043af112de51ddb3e4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294525, "uuid": "7b9d71d8-db60-4f03-9edc-7f7a1ea66a15", "value": "T1A464CF0252F1AC25E2735E725E3DB3E4663EF9529D6BE6CE2214AA1F09B11E1C523703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294525, "uuid": "fd70ae15-6dbb-41e5-83ec-1ca29c303958", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294525, "uuid": "84e5be3e-e68a-4a6e-913f-744302940237", "value": "6144:nt49U1VfAKxCgcjuPeKFxDxf9xIek9yvMWe6WoWREI7tcZ5D:nQKVfAKxCpyPdFhxX8yFejoWRE4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678294525, "uuid": "2501df63-d8f8-46d8-85de-c135cef8fbf7", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678294525, "uuid": "d979102a-d9f4-4afb-98d0-9a75fbefe7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294525, "uuid": "c8cc4db6-016b-47ae-ae1f-38f256b14ab1", "value": "b0ea2c24f02506398abaae01d66def14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede28593-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678261414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261414, "uuid": "80baf22c-6f22-45bf-ba72-5d269c280452", "comment": "Malware payload (AgentTesla)", "value": "26b641cd1ff1ad9ce9e50af2d7060b79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261414, "uuid": "8bf3741c-626c-4e17-aa74-0100000361c7", "comment": "Malware payload (AgentTesla)", "value": "bbe859e7bec46b9cb056716f0ce5d5c46c3b97423bc94e3a205920f79b0b4162", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261414, "uuid": "497ab8ab-d792-4929-9ea4-432af3d9fce9", "comment": "Malware payload (AgentTesla)", "value": "b4dcaece0a86aca597236a0efed47697e1cf3a2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261414, "uuid": "dabc28c6-a949-48e7-9a00-7e550c33f0fb", "comment": "Malware payload (AgentTesla)", "value": "b20c82da14a58186477fcfcc00d802581176d1f42ded642cc81d3b4b0a539dbf4b130c71c1f0492dbe3cb1331ef8ad65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261414, "uuid": "75f9cfc0-171d-4ae5-b874-d6216e47b7a7", "value": "T1BA159E9172B194B3F5CB016960287ACC2C3CB183F6D9E24B6B3779D096459FBF698E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261414, "uuid": "d5f3b896-1a1b-4e33-a96d-921463d24698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261414, "uuid": "44c4944b-b958-4a10-b0e7-97f70a9bb098", "value": "12288:Wgi38Mb3cOQ7fZLid8WD/SNLjtNg+st6ZKSEwdsWSX8e/uxkhwV4QTVZn9W+:i8E3cOQr9+SNoYZKSEwOP/VwK0c+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261414, "uuid": "8b9ef982-66d3-4203-8bde-530f65f844bf", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261414, "uuid": "fc2a8a4c-df61-44e2-8cf4-fc3b4948744d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261414, "uuid": "e9cb9c26-9193-47f6-9fa5-aeb75f2d32ac", "value": "Remittance advice DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7c8fe9-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678261301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261301, "uuid": "aa0ae0a1-cd59-4687-9810-640ef9a2f0c2", "comment": "Malware payload (NanoCore)", "value": "cbcf5a5d29d3f41b1094eeb246ba8689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261301, "uuid": "7d8575f3-e6d7-4dcc-834f-3b44063c5970", "comment": "Malware payload (NanoCore)", "value": "be3bcc033afe51eae928468db7d611907861ff588d4de158cc8ae04baa18a8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261301, "uuid": "ae5b7e60-2654-4d85-b876-f27ecdf54f72", "comment": "Malware payload (NanoCore)", "value": "f273fd52edb309df61516f48421e875fce27baa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261301, "uuid": "6660b248-24b9-4021-8992-58b5d8573284", "comment": "Malware payload (NanoCore)", "value": "ebf3ad9e362b96c159277384f3d5373e0af3ecab3e541702191d607d1f15a9c3d97b8d7ebb0eb4de337f254bdeedb30e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261301, "uuid": "ab1b6d16-5348-4c54-bc6b-605d54cf8bff", "value": "T1F515CF99B2714163EC9F81B90927C5DF2C50FD8B7611E23B633B7B82E2591BF7648212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261301, "uuid": "144c0471-1856-4e84-9da9-4f101037e709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261301, "uuid": "9619d9b3-6ba2-43c6-b2b5-c106fedf1a56", "value": "24576:5EP78/1wWai3L89KZTAHhvtQ27ZCeUOy6526M:ZOWaW/dABvtQ29Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261301, "uuid": "fefae343-e738-4730-a4a1-e86f5217c6fe", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261301, "uuid": "a8b92604-e1ee-4fee-8ff2-8a7d23f2c2fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261301, "uuid": "215b65b6-ae52-4d71-9d29-d3f6494ffa45", "value": "Zapytanie o zam\u00f3wienie - Inquiry-to-Order-001030823 xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794d7b4f-bdaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678279687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279687, "uuid": "e13a1ea2-9c6f-46a2-908a-ef5e38bdc77a", "comment": "Malware payload (SnakeKeylogger)", "value": "e432e42f9ad32ec6b6ac0baea2c2513a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279687, "uuid": "2c97b49f-ea89-4e23-83ba-5cb3171cdafc", "comment": "Malware payload (SnakeKeylogger)", "value": "be55cb1e227d740270f3b707b0fda3de22b3c547f57c2922ea11a5447112ad36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279687, "uuid": "a154f719-5617-4e24-9b09-48481924544a", "comment": "Malware payload (SnakeKeylogger)", "value": "74fa23d98d8772689a86ea3bf642cf09e82ef431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279687, "uuid": "66e47ec3-f32d-454b-88c6-aa8d7c026475", "comment": "Malware payload (SnakeKeylogger)", "value": "b594302ad91f55f6ce8fe3f928fd1126587924dd3b5e1a230f7f37adfa6f6315d034cd0517ed6ee4101f95513effe060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279687, "uuid": "059846e7-851e-4c74-b389-e47a008083e8", "value": "T12345C6203DFA902EF573AFB65FD475A2996EFE662606541E205133470633A02ECD293E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279687, "uuid": "a0ce7319-2416-4ca8-a8d4-7d2162bc7a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279687, "uuid": "b9a4d826-1674-45cb-8f37-53de97f0d94c", "value": "12288:9RT9qS1y9ezkbU5gqiqmbICf+N9251GJAMgi6H+8Y7M/zIwy6LBlBrbo+rk3Mvam:9RTd1y9ZlE0G1QLFJXyUiDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279687, "uuid": "5c991547-09a3-4774-9e6a-1e1e7fa0eac3", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279687, "uuid": "e87462e1-506f-4226-bf06-1afdd7536ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279687, "uuid": "ee9a9428-16f8-416d-9d53-75d4d52e7abb", "value": "be55cb1e227d740270f3b707b0fda3de22b3c547f57c2922ea11a5447112ad36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d73352-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289982, "uuid": "9a079f09-f5ce-4993-9bf7-f48d7b6e3feb", "comment": "Malware payload (GandCrab)", "value": "f8950e5c111c537bcb8bdefc53bb3644", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289982, "uuid": "80b19ed4-5f05-41fe-b0b9-57067c035098", "comment": "Malware payload (GandCrab)", "value": "beb84ee59cd2cb966c388c9bfac90889c2f2f094266593bdd2215c56ff2287b5", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289982, "uuid": "07f8ccd4-54ad-428b-b18b-3d9e549772f0", "comment": "Malware payload (GandCrab)", "value": "581c464410f233e6e3f6cf55ffb521d095e32a9f", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289982, "uuid": "edae0b13-d0f4-46ad-a6f0-d5268ab5495c", "comment": "Malware payload (GandCrab)", "value": "8ef526ce7c6c37849f27484532b40271048c74443f5ce6ffc6d8b176b87c85798263c97c588bd19d5a64fc39b83783ff", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289982, "uuid": "313143b2-405c-4f97-8f29-7018bffb2b73", "value": "T181636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289982, "uuid": "dd59b7db-1515-453a-a9d0-5967801e5df5", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289982, "uuid": "2d6fe204-cffb-477b-a8ba-6cc8585423b7", "value": "1536:LZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Kd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289982, "uuid": "8a24f079-5b43-4fe5-963e-8c47de39be83", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289982, "uuid": "acf992d5-8b7d-4688-8b2d-1b83bf76fd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289982, "uuid": "ba4f999d-d359-4702-baa5-b8c97e211559", "value": "2023-03-07_f8950e5c111c537bcb8bdefc53bb3644_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca6575-bd91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678266828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266828, "uuid": "db8072ca-5809-4c0c-a680-e4853a4415ec", "comment": "Malware payload (Mirai)", "value": "5f6ef0c7a01dc8b02b6dd032a1703ef2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266828, "uuid": "a4147b34-af2d-47ab-a35a-a797389ac249", "comment": "Malware payload (Mirai)", "value": "bee1bad9afff6831e7182d00ca692c98c53c5c1a9f6025818dd58d4c6113e11b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266828, "uuid": "8cd15867-b3f6-45fc-ab29-fdfab0950dd1", "comment": "Malware payload (Mirai)", "value": "f3d33775dda27897ef194e88408b0b151484b9ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678266828, "uuid": "7230ac8c-88a6-4edd-8044-3756efaefdc3", "comment": "Malware payload (Mirai)", "value": "14312570ed66cc5262f560bcde0e5055136b4a607902e3d7ed1bf1ab32c21223b98a8d370278e5a6f908ad7d05f977ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266828, "uuid": "468ccc22-44e8-45b1-a652-aa83c60bc8ac", "value": "T199732945BC819613C6C1237BFA6E46CD372227E8D2DE72179E215F2037CA95F0E27A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266828, "uuid": "a3dc1e3b-f64c-4440-8d66-8a44acbd4063", "value": "1536:CGPtTQ8gVk/mmB2hNkxQD/1uaNNnUlnnI7296c4vMGD:CGPBlcrHUlnnEqAMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678266828, "uuid": "9db1b76f-546c-495a-88df-0b9802eab891", "value": 79240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678266828, "uuid": "d5e7d322-9458-41e5-becd-d357758d2870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678266828, "uuid": "1dbb2fe1-70df-4826-a695-a974cc838a1f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8112ba4a-bdc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678289149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289149, "uuid": "b058d498-dc17-47f0-9a0a-f69420d0957a", "comment": "Malware payload (Formbook)", "value": "6b345cea35b215d9ec425e8e296d0a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289149, "uuid": "14b1a55f-1619-4eb1-8709-ce98d7f1249d", "comment": "Malware payload (Formbook)", "value": "bf71631457bec8633d10c816bfa914ef51bee4acda9a37c2613697976a21decb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289149, "uuid": "d51f55f1-7ca8-4c62-b71a-07787fc2a6f3", "comment": "Malware payload (Formbook)", "value": "feef635ed40ebe4433775162448093a4c9bd8ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289149, "uuid": "64e9c403-e0c8-4c1f-bd35-1d3f9f2087c8", "comment": "Malware payload (Formbook)", "value": "49e36406c0530de4db6b610afd11dbe99f4bc3f53982451b4e8ac12d17410e934b86295905e1df2d79dbfb8ab48f0410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289149, "uuid": "4fbe0468-0db7-421f-ac2e-b26c0ff8ad95", "value": "T15144124873C0C49BD47386712B3A4E7BDAD6A5256A8459071F306F5CBF21992EE0E3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289149, "uuid": "4e5630c8-16e8-4afb-8850-ee51be44da3b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289149, "uuid": "11be7a61-bec3-46fc-b43b-6b4cb387dba8", "value": "6144:vYa6ax8wmLesKidsPTAuYezNsrlHt0YW7oZD:vYcmwmLeFkzezNuttJWkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289149, "uuid": "a623a081-f3b7-4c53-b337-9a7af6369449", "value": 256457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289149, "uuid": "25ffd241-bf32-474c-8f9d-9fbc12ecb9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289149, "uuid": "f57e10a1-ebaa-47ac-b8af-eec293abcc08", "value": "Proof Of Payment & Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3294897-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678309822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309822, "uuid": "b951cade-5fa2-423f-87a7-8a9630b8d2d4", "comment": "Malware payload (RedLineStealer)", "value": "b425323c247536dbe4394ef4cdf879ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309822, "uuid": "a864f0c0-37b7-4031-9331-64782cb5aee7", "comment": "Malware payload (RedLineStealer)", "value": "c099c9842ba5a48b648a5d9251ad799c796a2e55b7e7b4aa9b978c74ef3a0e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309822, "uuid": "fb6d37d0-4cf2-4efe-9a3e-16b33c055583", "comment": "Malware payload (RedLineStealer)", "value": "2147ef486cd779c2ba1a492ae93a80b40cdade86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309822, "uuid": "0378bdf1-d71b-4f14-93ed-45f8af5ca9c0", "comment": "Malware payload (RedLineStealer)", "value": "e1fb5bc8a9ff722eea3ebf211bc2915767a35d8c459f7b085e35d0d090a35c75ddcf81d2b87a4368d7163870c2987a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309822, "uuid": "2c4b0cc8-7187-4d5c-b01b-de5bac01d99c", "value": "T10664D00253E0AC35F2638B77BE2EF2E4663EF4615E6BE79922145D2B09B01E1C563313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309822, "uuid": "f0e87e11-bba2-4053-9956-914f5198f1bf", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309822, "uuid": "b2aaa127-21d6-41c7-a5b2-9fec189f3920", "value": "6144:4og72Kf9TuhHu54WSl7/exW1Z0T/RJR7O/AgrjIU:XI2KfJulu+BXnuJZO/Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309822, "uuid": "7d7a6b5c-aab0-4e8c-bdb8-9955c4b29313", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309822, "uuid": "4af0b31d-f440-49af-98ec-489129ea693c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309822, "uuid": "7df20ae7-419d-4d64-b535-3cbc316a3eee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a58a5-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308355, "uuid": "d2462c11-afab-4004-a6ea-c556e34d9b68", "comment": "Malware payload (SnakeKeylogger)", "value": "81ef6c4017e395002f8da32493426398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBank", "colour": "#06B34B", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308355, "uuid": "074ca8c5-d6d1-4b50-b5c3-3d050a319ab9", "comment": "Malware payload (SnakeKeylogger)", "value": "c09e645a4d4be15d6002fec574468e1262d42769d2a3f1d0b17baf930449d47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBank", "colour": "#06B34B", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308355, "uuid": "e26b3160-dd87-4c7a-8216-38f73840523d", "comment": "Malware payload (SnakeKeylogger)", "value": "901b9520cfbd62175ac608a8c200b0b5a8a39e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBank", "colour": "#06B34B", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308355, "uuid": "7836d126-5783-443e-bed1-c9c05fe04292", "comment": "Malware payload (SnakeKeylogger)", "value": "86d75cd155f02337ceaf13f331db5cbe53a8357ee142f6d2a7fe3452fd4dca30aef1383d25984f0df6a0624666f26987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GarantiBank", "colour": "#06B34B", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308355, "uuid": "08d5705b-94dc-4b22-8f3f-60ded1792b8a", "value": "T14515CE99B2714177ECCF40790A17C5CF2D54FA8B7251E23B533B7A42E2991BF7A48222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308355, "uuid": "44248ca1-9af4-4734-b639-c0a942fb155c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308355, "uuid": "be6f624b-bcb8-4441-a8e6-6f66301d3181", "value": "24576:4EP78/1XGQ8qBwKKP6/H4xcDKaIu7D8dCTy:gEQpwHy/H4xcDKa7D8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308355, "uuid": "4caef0b3-1247-4997-af73-e9d2491a2577", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308355, "uuid": "52b4d867-fb18-43ec-b767-8ea9ff62897c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308355, "uuid": "e27864d3-8319-4a0b-9b5f-7d618cf54e22", "value": "Garanti Swift mesajiniz 08.03.2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408294d4-bdd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678294624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294624, "uuid": "f5d0a601-49b9-4486-a0e0-ec57c48bf6e8", "comment": "Malware payload (AgentTesla)", "value": "fcbd587b894d3d1508268b67c02d220f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294624, "uuid": "eb31b4c7-5d31-4ab7-9602-728ac3d00d4a", "comment": "Malware payload (AgentTesla)", "value": "c0cbab8b9504e2575456d0f902b264123362665031999a3f780c2a5c2f0b9512", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294624, "uuid": "d856c303-6320-45fa-a0e6-11780e08228a", "comment": "Malware payload (AgentTesla)", "value": "432a697f05de00a09d5d237dec6e0aa49cea03f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294624, "uuid": "1af98fe4-ff80-4922-a063-7b878506f0d4", "comment": "Malware payload (AgentTesla)", "value": "1b3f180ffe66eae56c8bc8a04b025bb3cb4bdc361ed5c11643cf445aae142ee49eee62528bb9c6ed62febdb296908be0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294624, "uuid": "24878bb0-11ce-43c8-a205-4a386565c03c", "value": "T11C15AD57F294A82EE8BBE770CD55BC14E830B0767212752775DBC09887ACAF18B142E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294624, "uuid": "cbe15102-a3c9-4039-b519-5b720a09797c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294624, "uuid": "b78c4790-4642-4671-a72e-27f08fd99fdd", "value": "12288:ke3ygxIyjPpBSqGiyol3PQJih+ZKdGUFRP0TVfXVZ67cNNBD9s9Etl0vjC44dBjj:ke3VTpBS3UZEs5sTRbBDsQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678294624, "uuid": "719393f7-6ae3-4b03-bf4b-e2decdb7e195", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678294624, "uuid": "2698c069-a8c6-4edc-a1f7-5e4f499b657e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294624, "uuid": "bf68eb93-26e1-46f0-83a1-c43076d62275", "value": "PO-3-07-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203703d8-bd95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268370, "uuid": "aeba6ea7-75cf-41be-8808-c76f5a61a6a9", "comment": "Malware payload (Heodo)", "value": "98f2c28db3044c0bb4f6532b4f63271a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268370, "uuid": "4d183a4b-d594-4bd2-a42d-0bdbfa6044c0", "comment": "Malware payload (Heodo)", "value": "c0cc58370e1c362fb98653d01a3b36018775602ef2f115ca2ece20257f0e9aa2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268370, "uuid": "3d9f4762-57c6-4ff3-891d-23fa401e7345", "comment": "Malware payload (Heodo)", "value": "c7e464ad78ddc97d00f6bd5a25c463c4c4a693a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268370, "uuid": "83ec49ac-3f70-42d7-b753-f6a68b45947f", "comment": "Malware payload (Heodo)", "value": "8062d5ec00bc61c2f2418cebb0c786306a4a1799d3f9e422516a71447ae150d7eec65f5c55c674a52af89718b6114dfb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268370, "uuid": "d061eeb2-dbec-4859-8c5c-a3a5d716f337", "value": "T1DF05233C5F67790FF5997C362AF3947AFCF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268370, "uuid": "bff04898-8276-4814-8dcd-04104aaf941a", "value": "12288:z4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s8:8evtlkdJe4m19FgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268370, "uuid": "64cf4dab-ff22-47d5-a56f-66e0dcc32a46", "value": 860448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268370, "uuid": "10a0a805-347e-4895-bd71-a820f00e0db0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268370, "uuid": "c189a5be-a857-4d2a-9fd4-2e2d65ce3397", "value": "3FoI8SH942.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1f6bd2-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308765, "uuid": "4471ac2d-cdab-4c89-9106-54327d2b7749", "comment": "Malware payload", "value": "8c88de3d340307ef3994e4d42b988b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308765, "uuid": "b65f8729-cb4d-4624-a48e-8917f6b71c93", "comment": "Malware payload", "value": "c0e65f9b50c5bcd97ced63cab1f3d3194473a6e81f26436c88af9d7c2622809f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308765, "uuid": "4f56e68d-cac5-463f-a247-e246adff854c", "comment": "Malware payload", "value": "1f0f18cbd17d8788c701bce21ad4962ed868c4f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308765, "uuid": "8b2a52c8-f340-4cf1-b52e-307411328d90", "comment": "Malware payload", "value": "8d3f867ad40cc82de4298c4be243bc79326afb7b307421d881edfda3bef4274cd1a85ebaa2ee2ecaa5b975aa9926c70e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308765, "uuid": "331008da-938c-42ce-9c44-0d0d9814b8cf", "value": "T1A624C02172E859F9D67A4130DA235737CBB3BC541928172F12A0CB9A1F3351ABE1EB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308765, "uuid": "8fab3ab7-1704-4c11-85cb-b2b9b8cd13eb", "value": "90292de38e2bd6803e8e5e27da945a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308765, "uuid": "b29ccec6-91b6-47cb-bc69-b7ccc8367e9e", "value": "3072:xVFE/ZYueQ6059PKEywh8QzEfae1NJLgf7nDVF6PUp1Yo3ICgC:MYue05FhyI8wEHN5gfzDVlVXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308765, "uuid": "19e9ad5e-30ae-4ed3-9f8f-1009350db319", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308765, "uuid": "75500283-0f72-461a-b6d6-c31a63bf3314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308765, "uuid": "c37a35de-7803-4081-b700-6d8e0ce59206", "value": "8c88de3d340307ef3994e4d42b988b27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4a1825-bdad-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1678278915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278915, "uuid": "89925b46-c88e-491c-abc6-f93a61c7e932", "comment": "Malware payload (ManusCrypt)", "value": "3b32570cfc08329e3bf2624f727ead3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278915, "uuid": "b1b59ab4-699a-4716-965b-7b164238668a", "comment": "Malware payload (ManusCrypt)", "value": "c14dfbc33876ec82c3705cc8cedad7dda10646b4fd9d12c468d786187422bee7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278915, "uuid": "ae873aec-90e7-4e28-98d9-8f0307232dfc", "comment": "Malware payload (ManusCrypt)", "value": "6f15ad55aab802e2c963c7d95d605cfd9e189ea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278915, "uuid": "dc37f500-4649-437e-b382-50dd255eda62", "comment": "Malware payload (ManusCrypt)", "value": "ad86264843f5c7b49dd2e90e757fe48ef3a11516953fafa801ec9f5fd55f79730a08a542f5fb00edd375e9599618ae30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278915, "uuid": "2a41949a-e027-441f-bb2e-cab0cf2d9474", "value": "T1F2648D1137E1C877D4B315734E52C3A972B6BE11AD32864B6BD03B0EAE70542CF29B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278915, "uuid": "c1d84737-d140-467f-be87-d15eec31252a", "value": "30536483726143b4d0afeee8884fc70b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278915, "uuid": "d117311f-3002-41c4-8da4-174657cfbbb3", "value": "6144:bOsY+HgEiTA14Xn0Ti8v1bbFgXIQdjrfzNt18EP3:i814Xn0Ti8tbJyIQdjrfzmEP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278915, "uuid": "a98081fd-3dd8-4e11-9073-64910e8750ab", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278915, "uuid": "f8f2e176-347e-4db4-85cd-4629344c26e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278915, "uuid": "f3b545ff-2320-4772-9092-0a03abfafea1", "value": "3b32570cfc08329e3bf2624f727ead3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be76a566-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678307720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307720, "uuid": "a21f36e6-eb5d-407d-a679-9b0b73a4e762", "comment": "Malware payload (Mirai)", "value": "bf982797f44c6128284357c8d4f8f884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307720, "uuid": "edaa49ee-fcd0-47cf-90b5-3f22234afd83", "comment": "Malware payload (Mirai)", "value": "c1c80da9e4b9c483dc1c9e782db4084397b6fcf8aac46a13e063a1383a3e897e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307720, "uuid": "c356ee3d-81a3-4980-829d-ddd04c4c367a", "comment": "Malware payload (Mirai)", "value": "fdf4574b9e229a67de4861a9bb38b9faeb2a8fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307720, "uuid": "6ed3f600-dfaf-4edf-aa84-65562d8a819b", "comment": "Malware payload (Mirai)", "value": "747f68018f8a06e47c48a887634720628cea9d29659e1f77a65a6a927e12014532c3026bb72c25a6157231bc990a03fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307720, "uuid": "23992bb8-4226-4328-9dca-91cd203fe644", "value": "T13503E1A5BDB86F86D02FFD38229E166147A544C0637EA7F807614449FA3804EB6CC7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307720, "uuid": "63c0372f-3019-4b55-bea0-27bfe6649c22", "value": "768:bbmMQ4zDObKiEK/VTk7oyxYAqYV46iRBT+GLW1iKIvwb/CORJ66fWp:WODO2nKtTk7oyoY4HTVi1iKI4/6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307720, "uuid": "09989e4d-429c-4df5-a4fc-b1fd9aa3b5b7", "value": 38684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307720, "uuid": "28543d53-22da-4ffa-8d22-39406b391592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307720, "uuid": "8246d83e-a556-49df-a85d-7024c19f57ea", "value": "bf982797f44c6128284357c8d4f8f884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d107713b-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678267808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267808, "uuid": "a32ddbb0-fbc1-405a-b53d-713c58fe6ebb", "comment": "Malware payload (AgentTesla)", "value": "14600c25f5fd7be8a2d3663a6231a11a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267808, "uuid": "6b91ee62-80c2-4e0f-bc35-8ddbbd7e1890", "comment": "Malware payload (AgentTesla)", "value": "c2ce9f281ae3948198e6e178b758432fc35090a89c2d27783bf2316d78bc3790", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267808, "uuid": "f6d9375a-8de8-442b-8742-a0b26b249c33", "comment": "Malware payload (AgentTesla)", "value": "6fc2eb0d362393b905481e5a5f2ef5fa757a9407", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267808, "uuid": "0e0ae3b8-5194-47ec-88fc-0ac5fcfad517", "comment": "Malware payload (AgentTesla)", "value": "cc33b762a9ac89de4cd506c3e40c0c16c75038ea45c0d016b1651615cac70241c9991bc29bc887dab058534872ca1ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267808, "uuid": "eb8d7356-a167-4f31-abbd-975efbd47bc7", "value": "T1964412497A62CCEBF9A605700DBE261B77F2681910E0DB571354AFAE7D23543C62F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267808, "uuid": "c3ca9881-3c7a-43ea-815e-4efe8899d6c1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267808, "uuid": "833b5622-83bf-405a-877d-a2ce508a522e", "value": "6144:/Ya6W1wgO7lGjILOR85zAmX4+2TVsu5DniwpgQDWIK:/YgIlG0Gi8mo/TVsKDiOgQlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267808, "uuid": "ee75bcba-76b8-4e55-8886-5cd7d7996631", "value": 274031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267808, "uuid": "5624d07e-3b98-4420-aa32-a5ec4c8b469f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267808, "uuid": "beb0ad36-958e-4c5c-a3cb-13f7800a7b96", "value": "RFQ.IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54250c15-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678259438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259438, "uuid": "fbc1611a-b7cb-4fa4-b7ee-4eb07cefaa55", "comment": "Malware payload (Loki)", "value": "787bfab5688a0c94733e8cdab9cec350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259438, "uuid": "84502689-2593-44b6-9156-f639f6188a7e", "comment": "Malware payload (Loki)", "value": "c434dec5efd7676781a49416db58e4bc4e257e0d8f5c27ac1d9c61ca9693b648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259438, "uuid": "ffcfb393-78b4-407b-8c1f-4662d02d730b", "comment": "Malware payload (Loki)", "value": "546f4849a0c809e26814a52c989f5c07fc64d1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259438, "uuid": "2ca93d94-be13-401f-9b3e-48087adbad09", "comment": "Malware payload (Loki)", "value": "a74d61681ea1ce53f06b27c9420c6a3d18a9a78ee847f60fcbb41767d6185d669f1d91e8cde796b8d079a61f2e83a021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259438, "uuid": "5b4a2601-7116-46b8-a888-81e3e1719714", "value": "T10805BF9572B19463ECCF41BA192BF19C2DB171433355E23B5B7B3AE1D2119BFB288602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259438, "uuid": "12a1163f-f218-41c0-b758-ca365ab917f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259438, "uuid": "b6abd69a-4500-4e03-b818-42256b2a0e92", "value": "12288:Ua/5u62iNDp1QIPLElVTxEzY4f/3fTW8TBCIL5RtgkQXhe:Ua/5u61y0LElmYkW8TBCW5R6k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259438, "uuid": "5bc5d6be-5fa9-44e4-9af2-3b14dd5cdce1", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259438, "uuid": "e0778992-e124-4dc2-9ded-6b9a1467e358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259438, "uuid": "6998249d-650a-4291-ba99-15a3310f271d", "value": "AdA9Zkm0pnNK3tE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5021cbc-bdee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678306845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306845, "uuid": "f2ccee25-1edd-4ce9-a3fe-995b1f469c69", "comment": "Malware payload (RedLineStealer)", "value": "e708d707d501cbe44f35c93978b13872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306845, "uuid": "ceaf6176-c43e-42a0-b413-9cac359ee1d7", "comment": "Malware payload (RedLineStealer)", "value": "c4a84f2d399775dfc0620a96cdf135ca5dd259b6691b052b49c3117d135e2666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306845, "uuid": "3fc7ed74-5de4-4e75-ab95-65d19bda4198", "comment": "Malware payload (RedLineStealer)", "value": "4e71562ac3eb1912ef8fb728aab23520b618f543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306845, "uuid": "07d0fbae-582d-43b9-84b6-6356cecc7e8a", "comment": "Malware payload (RedLineStealer)", "value": "e0a944fa63b97a3caab3228b9d15a0a0190122189b93d1cbbb6939f37b76dbe755932306baae11cd622bc0e17d59d172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306845, "uuid": "c2b94384-bdc2-4c24-9bdb-de05c969a685", "value": "T1B974012177E0C432E6A7467028B09BE59F7FB87105398A4F3B690B686F307D196B6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306845, "uuid": "0e5e219c-5543-4404-ac07-79fbf4566c16", "value": "318b75056fe1945612232cd0eae11bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306845, "uuid": "f2ccba1e-6ac2-4bab-b1cc-a2c6fbcf3d50", "value": "6144:Yt1LlAnIwmJqyLRZ9Lw+AcZAnjbo2F4SqXAhd4eZu:Yt1ZAIBJqCZtpwjM2aXAhZZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306845, "uuid": "6fef11b2-7c8e-4011-8aa3-eb8c688fde68", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306845, "uuid": "988d6624-001f-4931-9933-eff5183bb37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306845, "uuid": "248f6927-120b-4808-8e57-4439ab02284c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65dc70a-bdf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1678310310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310310, "uuid": "16c658cd-171f-4b9c-bcfc-8fb3b834ed25", "comment": "Malware payload (Adware.Neoreklami)", "value": "0ab70b9969587ee79d8403b7d59a5c44", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310310, "uuid": "31072101-b867-44b1-80fd-97f1967e5609", "comment": "Malware payload (Adware.Neoreklami)", "value": "c531cb36c90f83bbb04ebbe74b23feea18ec1f62378b37d6d27e82fb8283aa21", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310310, "uuid": "d65bee28-1feb-4237-ab38-35a5d6399f40", "comment": "Malware payload (Adware.Neoreklami)", "value": "ac18a89070c380640db48a7acae2f6bba0c6c95a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678310310, "uuid": "8641b715-101c-4528-981c-24f42471c80a", "comment": "Malware payload (Adware.Neoreklami)", "value": "5baf52b4d146a0feed94dea6fc3d90160e6bbcc546dee3264d71a96ae7335c6b716c22606a842f670dd82af2963e6973", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310310, "uuid": "c49b2140-708d-4c84-b44e-d997ee819b55", "value": "T1647633A07197CCBDE9A899328E8C2E9177AAE15149540DCF934C21242BFCFB1C979FC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310310, "uuid": "9d0db744-570e-4700-926a-8f376b7ba5d0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310310, "uuid": "139ea5eb-a83d-471b-a250-fcea88724a4c", "value": "196608:91Ov5LNazYlTll5CKaP1ns4tqMNMrUJ1oPOWRuVo:3ODaoCKGsOJnJ1xVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678310310, "uuid": "4b51cb92-9d0a-45cd-86d1-65e76be72098", "value": 7643833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678310310, "uuid": "e1b45618-b896-4fd4-b6e4-d6f39e0303dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678310310, "uuid": "1a750c9a-5e33-47f5-b8ce-ecb8f23e0ee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1cef3a-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678275983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275983, "uuid": "d5f74781-af63-432a-940f-ded77d969db6", "comment": "Malware payload (Heodo)", "value": "a709632e79a088be46176d9ed9ff7be7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275983, "uuid": "f15f9187-c5cc-4a01-8c1c-1f7e7c6bace5", "comment": "Malware payload (Heodo)", "value": "c5b6f4c7d9435ae02eec40ceb8c2d5436eaca0395d5c9bad864d758815385e39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275983, "uuid": "21519b5e-8045-467b-9522-cc06ecbb2427", "comment": "Malware payload (Heodo)", "value": "c2b7a9260e2a7f3838e40514a90143ee82bbe5c7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275983, "uuid": "e04abb5e-3645-49b7-95a6-25c98594b643", "comment": "Malware payload (Heodo)", "value": "3882a8b5e611b75e6bfad330112601e2e3944c702e98ce90da31923f68ec9ce5d8abeabe5ea91074650448181fb4398a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275983, "uuid": "8420a8d7-3d49-482a-9a66-d00d0469e7e9", "value": "T13205233C5F67790FF6997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275983, "uuid": "3eda0172-0452-49ce-8edc-99a5fb812c17", "value": "12288:f4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sq:gevtlkdJe4m19Fgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275983, "uuid": "c42475b5-04e0-414f-93f9-f9f82e0d002a", "value": 858399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275983, "uuid": "6e477014-4a5f-451c-abbd-d07cb6945518", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275983, "uuid": "47c4bfcc-c8f0-4f3e-ba90-57d52e8dac14", "value": "qkWTFPKySzXB1Na.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e860bc5b-bd71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678253244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253244, "uuid": "8e81f8a6-dd88-4d54-8740-74e79baa7f95", "comment": "Malware payload (Mirai)", "value": "d606f6c391762788cc16f133c7e4856f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253244, "uuid": "a4d88de0-b38d-48d0-b1e6-8ea2a89a17e7", "comment": "Malware payload (Mirai)", "value": "c715a816785507ec31b29ab47ce14a1b0c0af3c6dc69a5046a959fa78973aa2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253244, "uuid": "2b912373-3c58-418c-8d33-1ee68a4a5fb4", "comment": "Malware payload (Mirai)", "value": "dd4628a7114821818dcc45e0864886a5754c6736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678253244, "uuid": "e7347b98-984e-43a9-8747-4e4d71985b76", "comment": "Malware payload (Mirai)", "value": "a0750d25a12fba21960f521082cd1b585a8d62d6b585c1a87b9ab715ea0ab2e829a69783b5ab4ef7c9ac97fe89fc176c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253244, "uuid": "6436659c-523a-481e-996c-2eca03c5700f", "value": "T138E2E19070E6B142DDE72672C4E4C8344BB1895D7E64E99A9BF2E8C0CB47B63D38E009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253244, "uuid": "347dfee9-29e6-4fb9-bbfa-251fae614de8", "value": "768:AlP3M/aXjyqDGP4Yb2/lrK1z9hYoNKFt5Q3GHnz:W6aXdGP4rr+RRm5Q3Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678253244, "uuid": "5888552d-61f1-4581-810c-f3f9b3008e10", "value": 31680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678253244, "uuid": "1b97a805-99c6-4eac-853b-b0cdd8b59d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678253244, "uuid": "8aa7d3a3-7003-49e9-9be5-238e2b84b50d", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.7502.25837.21097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5aaeba-bd93-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678267771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267771, "uuid": "17f41a55-9764-48ff-b6ec-dc50ef8f7319", "comment": "Malware payload", "value": "d72651c03003506748a33a5a91ee7e6c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CALDERA", "colour": "#AD7E89", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Manx", "colour": "#83C2D8", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267771, "uuid": "630e1723-2b47-4386-a008-5abc39796f5f", "comment": "Malware payload", "value": "c9f35465471abf25b273a4a0b5ba244004efb5659ab7b5f9439ee7f04507edb0", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CALDERA", "colour": "#AD7E89", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Manx", "colour": "#83C2D8", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267771, "uuid": "b843c952-09aa-4642-8841-1732b4279106", "comment": "Malware payload", "value": "31e32ef51e2cf4270189f356358abd293266fa3b", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CALDERA", "colour": "#AD7E89", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Manx", "colour": "#83C2D8", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267771, "uuid": "246f8699-401b-4f6e-8409-82523fb99c3e", "comment": "Malware payload", "value": "01ddae478a895a45eebdd2593466977d514af937bde3d23f0fbff6f83e7e8db275b693369af0af1abf30bd05a04cdeea", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CALDERA", "colour": "#AD7E89", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Manx", "colour": "#83C2D8", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267771, "uuid": "3ec09719-a360-4270-acae-e87ca6464489", "value": "T1D7264B03F8815CE9C1AFD130CAA59262BB70F898473423E32B61B7B52B76BD45E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267771, "uuid": "17cfbf4e-6d50-4422-950e-bf738627ac54", "value": "49152:oZm4Acrb/T5vO90dL3BmAFd4A64nsfJwdMkalwkvll7jRCN7GsibSF7yx9unEzrG:oZBR4wkvbtsDkZAQHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267771, "uuid": "bbf47183-3669-4421-9d3a-c0e4eb877a5c", "value": 4669440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267771, "uuid": "bc41afa8-9bfd-4e80-a7ed-821cfc29c2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267771, "uuid": "dac9db31-6790-499d-a401-e022fd16fbd0", "value": "xinit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525b129e-bdd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678294224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294224, "uuid": "79f9a31f-1298-4e22-912c-7a0c2d9c091e", "comment": "Malware payload (RedLineStealer)", "value": "7fb9217f2d4056f5d597eb126f92f780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294224, "uuid": "b1a73af4-392a-41f0-8dda-eda572e5b996", "comment": "Malware payload (RedLineStealer)", "value": "ca2e28ee7e793e7748701bb3875d0e11fe24a1aacb9b3cdc1865c890423f51ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294224, "uuid": "ba237c9c-6e44-46d7-8aab-b66cba620e7f", "comment": "Malware payload (RedLineStealer)", "value": "1123de12fdc1ee71328412d7660984c11d13aaf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678294224, "uuid": "8233115e-4005-4259-a174-bda85c14371c", "comment": "Malware payload (RedLineStealer)", "value": "5ede6e825052744a9ff2784e3fd682cf0487e1d006225d1df69ff74b433f1fbe0d56a232ca919856829ef8e60c8059b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294224, "uuid": "f868dc9b-cd35-44bc-97e6-82613a2e16d9", "value": "T16754D05293E06C39E66787304F2DF2F46A3EF9615E7BE6D922141A1B09B01E1C5FB312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294224, "uuid": "d1c5af55-b55c-46ee-bf10-6aa20a1bb718", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294224, "uuid": "21d2a703-5ce0-4f7a-aa76-c97b97983e59", "value": "6144:EooMDtndBMrcj/cbQcSVsbKPEIowF1okpi1X0Lz6g:octndBZ/cblGWKPEIDpi1X0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678294224, "uuid": "ea7503be-ea8d-4a96-8be8-75826f794de6", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678294224, "uuid": "a2169326-b96c-4197-9efd-db81fa17e3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678294224, "uuid": "d0402e51-d1c9-4ff4-b33f-b363bee60479", "value": "7fb9217f2d4056f5d597eb126f92f780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d97971-bd98-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678269997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269997, "uuid": "fbcf8d8e-220d-4485-9365-48d61f34cce8", "comment": "Malware payload (AgentTesla)", "value": "53b7ecf8450a8d221651aafd0a799b05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269997, "uuid": "41d2778b-4ad3-430e-81dd-0ce78a5954d4", "comment": "Malware payload (AgentTesla)", "value": "caa7719f6020d911cc3e6ad542331508e22180445d7fa9206bf60193cb69d5e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269997, "uuid": "1b99f81f-f2e9-4381-a411-8e01b1494828", "comment": "Malware payload (AgentTesla)", "value": "cb563241140c9f2dc9842fa777bfe3affcab639a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269997, "uuid": "12538887-f3ec-4580-8ff3-7247258967e4", "comment": "Malware payload (AgentTesla)", "value": "28b84cb0d5ef93151d637562d6af88abb9f92ea656b02feed643db1cb52e5986b5cc8e7f6f28e9c6f7db8e6a9be47d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269997, "uuid": "91e7eaba-ceef-476c-b29a-e3619400f4ce", "value": "T1DF42E6510B8CA8F1E3A9E1334124940E09BDF56734D71AE8B9CCE1A137BD60D5AFA1F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269997, "uuid": "508461d0-4784-480a-8024-4ce75a3b2381", "value": "192:T6MxsUwPCHideSqQ+Yj3pNKswRCVYjpUts4eMxgofGT55dwN9xcmUuN1IFOQ5tK7:mMSJqseSqQb3pNERCcUre2goeTHdwN9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269997, "uuid": "f2a6f465-a800-4985-bef7-b5f84ec0ea3e", "value": 12031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269997, "uuid": "0d518197-d57b-4e8c-ab59-a551aa052d4d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269997, "uuid": "2d60bab6-f662-4390-a950-00652cac8f37", "value": "53b7ecf8450a8d221651aafd0a799b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c5ed62-bd84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1678261234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261234, "uuid": "a6f22a3d-6473-4a91-afb2-d0f16287b04e", "comment": "Malware payload (Gozi)", "value": "6819542f5ba2af5646bd5b5dda64daa4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261234, "uuid": "88fdc2a4-49dc-4825-98fe-6c84cabb005b", "comment": "Malware payload (Gozi)", "value": "cac82566e9167dc82b09308d05194bfc1ce6441a27b51756024c8b6477d75401", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261234, "uuid": "cfb57ca7-cfb9-4f04-ad9d-147f98a4ff7a", "comment": "Malware payload (Gozi)", "value": "d52e092cf7c92d257dc0553321b322931b582ac2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261234, "uuid": "f2fbcc53-c77e-4e2c-a07f-29f1211e0659", "comment": "Malware payload (Gozi)", "value": "2709dbafef3626ddc24cecc0825ed056e0ab7b344f0cb9b550c05856a815b99f0cefb35d6636b876a4205c4506a2de39", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261234, "uuid": "82593590-83b5-49bc-9918-b588562e6e06", "value": "T167F0ABF0C8CC0218CA0B46F0F0F196A0EA30B5097B12E6C3C0AEE0C14D82FD40A5423D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261234, "uuid": "7936eba9-cc19-4644-9c64-480a7f043222", "value": "6:5jkdLvLu/myLyp8yT4SLSVX1BMKLyneqMne+tmLj1VhS8ytTu/SMdLypjPaHTJOt:5jiu/mzHTrLml/zqMebhsu/SMUlyVOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261234, "uuid": "5b2717e4-781e-4bed-963e-b806edb11361", "value": 478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261234, "uuid": "9fc82619-15f7-4e4f-9062-cc05e1ceb4c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261234, "uuid": "49c32668-e7b5-47f1-9792-94b7313dfc86", "value": "documenti.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf317b-bd6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678250611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250611, "uuid": "4926daa3-0b40-4dd5-99c4-84f25731cce9", "comment": "Malware payload (Mirai)", "value": "f9292bf17ee62554fe840ce8f03017a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250611, "uuid": "75345eb8-3cc5-4e4b-a620-d9d683769b76", "comment": "Malware payload (Mirai)", "value": "cb8e13e0d8282e7c75fe5c46a6e23f32d9afddda178cd5ca135e7c7d6da576ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250611, "uuid": "f8ec6c30-3c7a-4796-940a-c490d40e2230", "comment": "Malware payload (Mirai)", "value": "94bd9819028d360007121066fc48eb6f0335bbd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678250611, "uuid": "cacc5cd9-7a33-41f6-a9d8-ee56d73ff12e", "comment": "Malware payload (Mirai)", "value": "c86731d1031975dd199cb7dcab47b101f7fa3ffb4cdbc312a625c4884266ae5b4cc9b349d1e83fbd1ce346544331c9bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250611, "uuid": "3e7911c3-14cb-4bad-a0ef-20946c0ced96", "value": "T100633921BA761E1BC0C1947661F75B25B2F143CE26E8CA0A3DB10E9EFF71A446543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250611, "uuid": "93de9ca1-0f69-4d65-a3ac-d9c751dbf62f", "value": "1536:J7mByLQeo9nhGIAsA39kAJQAAf758Xstat0B:J7SyDhi2AfVi6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678250611, "uuid": "ba0012a7-d584-4a21-8f13-c32f2c847d40", "value": 67296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678250611, "uuid": "422e6001-72aa-4ad3-b8a8-6c3175c1ab1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678250611, "uuid": "20750c46-67a9-4da4-afd2-ef7a1aba8dbe", "value": "f9292bf17ee62554fe840ce8f03017a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b87e57-bd86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262073, "uuid": "26b70d8e-3444-4715-936d-f0f7decfdc08", "comment": "Malware payload (AgentTesla)", "value": "dc7e0c7f171a18a4d69d6a7010ec87bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262073, "uuid": "f0e5b307-2fd9-4faa-8926-9f162c14c636", "comment": "Malware payload (AgentTesla)", "value": "ccd096e4295b46b4e78c218f35d192beb7102dd314c5f721cd52b1d812e178fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262073, "uuid": "e38f0215-01d4-47a2-b05e-d5e51eb43f77", "comment": "Malware payload (AgentTesla)", "value": "51a64910bf59a75eb226fa82e47d7b5b1a34ee74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262073, "uuid": "74d69180-9f82-4e73-9a96-2b05cefa6525", "comment": "Malware payload (AgentTesla)", "value": "a8fc8869b4e54d51b1c7951ee274f4af7b4c3aa8886952962861c4fbabd529462dd79f1abde7d8043ce19f09959b0347", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262073, "uuid": "1bff841c-487a-46cc-8b24-6124f965ff0d", "value": "T1CDC423CD02D38340E371BBE46974116ADC03972C525AE2C7CA0D88F3A8B7EE67557DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262073, "uuid": "183ebbea-0cf4-4a69-a347-bf9150a27e21", "value": "12288:0+1M0dGRvTQzFzBskMtLTmYZHb8mZrbLLVK:0+DgRGFzmp5TmqHb8mpLLVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262073, "uuid": "ec7ec098-1329-4738-9e24-a1c15ce48b28", "value": 565827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262073, "uuid": "91087699-891c-4b58-8da0-a8c134c00178", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262073, "uuid": "7b8f4821-347d-466e-a446-a4ce62521573", "value": "Scan_0013882982_SKMBT Remittance Docs.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5994ceb-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299115, "uuid": "503b8afd-9d55-47c3-8e16-0e70a6100563", "comment": "Malware payload (Mirai)", "value": "3b98d5fdf6208cccde1201833f936fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299115, "uuid": "2fc1c8bf-147e-4b0e-a4b5-d9acc5f9f52f", "comment": "Malware payload (Mirai)", "value": "ccec7105b669a571ab2fba8881d3356f9ab98556a0191b6fab4007e4f22c7ed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299115, "uuid": "0450b9d6-7f17-40f6-b02a-254749ca8aa9", "comment": "Malware payload (Mirai)", "value": "e17e2cfdd976bc02e41e437b39327e83dab57a56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299115, "uuid": "5b8e7190-f707-441f-9486-e9f30409baa3", "comment": "Malware payload (Mirai)", "value": "03cf54252a2ee9293df86e535166685ba3a6393c3a33ca5acc4bed9db1516b2b62cfbe0c7df0191f9f169e9c7f9e5ea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299115, "uuid": "a9c11785-1f95-4e09-8ce3-0481faff027c", "value": "T1C3633951B8819613C6D0127BFA6E02CD3B2613E8E2DE73079D225F203BC696F0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299115, "uuid": "ea9d289b-070b-4e18-b45f-19af9ef46394", "value": "1536:iVZYOt70M/6RRXs4plKSVIVXLz2HMXbZ3wjqvmWE:iV0RQ4YXLz2HMLtfmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299115, "uuid": "8729905e-765e-4fcd-a5b7-5153a5a8508a", "value": 66876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299115, "uuid": "d03bdd36-864c-4609-82d2-e7e185d3b3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299115, "uuid": "169198bf-032b-4e90-ab43-fcc5a87c73f8", "value": "3b98d5fdf6208cccde1201833f936fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c638a2-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678267921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267921, "uuid": "6283c3c0-ca2f-4c1d-a7d9-13d8942b6abe", "comment": "Malware payload (SnakeKeylogger)", "value": "0990e6f19a7730450834c60104b5d7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267921, "uuid": "17089515-488c-4ccd-a23f-b4b00b81d73d", "comment": "Malware payload (SnakeKeylogger)", "value": "cd8f48ff53a64677eead33cd179d5215e63e59d5e5bcd9cdddf2c3876f638027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267921, "uuid": "5af5ba0b-f69e-4671-8cb1-eebc552d33c0", "comment": "Malware payload (SnakeKeylogger)", "value": "4ecb78bd2f233c626e26971109c9da937709ebb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267921, "uuid": "94494677-c2b5-483a-9c33-e5f2633ff592", "comment": "Malware payload (SnakeKeylogger)", "value": "98efac5915c5b53b1324619d2b312648529cc6ea29154db12f498fa15a9d21ce7e82af71c5ffb1d4a1a37b66eca311e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267921, "uuid": "50355113-4ba3-496c-95cf-cea97480c049", "value": "T1A734020835A2D4E7C8F20672293BA976BEF9ED1210AC571F5B503BCE3E61052DA1DB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267921, "uuid": "9b278272-ccc1-462a-9859-a0cc182a5647", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267921, "uuid": "a2d3ca6f-7e71-4ad7-b9db-6d51e1ba0a19", "value": "6144:vYa6HEKEDAX0vPUNsMFgs7DuINfVi5RaCY+RHP:vY9MnUNsMFj7DHkVjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267921, "uuid": "b97cd6ea-e2c3-480a-827f-eda0476a85ad", "value": 237718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267921, "uuid": "d9d829d2-6244-4045-97a2-a142c172e1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267921, "uuid": "07b9a8dd-06fd-4278-80b2-eb511f5e27ad", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529171ab-bd85-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678261583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261583, "uuid": "eaa76440-0933-44b9-b5a9-a2f174f78ba8", "comment": "Malware payload", "value": "33f34598612942cf2cfc0ba2804e0cb5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261583, "uuid": "c7c2d7b4-6058-4c7f-847c-5ff2d9a63ad0", "comment": "Malware payload", "value": "cdda25e04fe115e6096cda6bcd6c8d9176ef5e6b6a7a52019aa58e938493413e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261583, "uuid": "c42bb9bd-2b7a-46cd-acb6-a21e56b0d644", "comment": "Malware payload", "value": "91c66b6a65dd882eeaf375e186004b766f1b7d1f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261583, "uuid": "f8918784-3d16-4e37-8711-76bb81a565b6", "comment": "Malware payload", "value": "748048197ea98fce40b9fe9f96262cd4b35421c30eea709df7e7247160f1a59ce0822df5887f047bc0bbd6e9ba1cea5c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261583, "uuid": "53963234-ebfd-4505-a6c1-466047f03052", "value": "T189617A1457EA0608F3F2AB3AA9BE52594E3B3956ED32C74E0059414F52F1A40DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261583, "uuid": "18d96dd0-7f6c-4b9f-8a2c-cabe15395bda", "value": "48:8wHaOU9Dmel0iglZ+N+slpQfYj1sAT1rTRRSJxodgImcC:8wHIB0+N+86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261583, "uuid": "89defb8b-8f45-4284-a1ff-f5a32ca4997f", "value": 3460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261583, "uuid": "dec9a705-2589-4319-b2da-888b06253e2a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261583, "uuid": "baf6ed86-2e4e-4578-8c67-53768e710029", "value": "PHOTO-SBI-EERC-uSDXACCOUNTXDETAILS.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a8c4b9-bd4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678237206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237206, "uuid": "d1b43cf5-9290-4765-b70a-9ba902640173", "comment": "Malware payload (Mirai)", "value": "4b6328b9437867ae4a79206f22e0ac05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237206, "uuid": "f1df83a4-dd57-45f6-82c5-f5a140ed14f0", "comment": "Malware payload (Mirai)", "value": "cde7997e26b1abe4f07565a7f5694a4218c4928fc0ad6a08991b8d6893b1679e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237206, "uuid": "6f5f764c-50ab-4d31-93ea-8d4d6332dd7b", "comment": "Malware payload (Mirai)", "value": "fd5b86fbaad601269534cea8242df723572181ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237206, "uuid": "b150e525-dbb2-433c-aabd-3def4b47b2b8", "comment": "Malware payload (Mirai)", "value": "c9c964cec21f81bb0c1654b9bdaeb7b6787c2f2a27d09011bc1fcce0e54e24d1881d6c8fd2373006007e1eb8e870efbc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237206, "uuid": "991356a3-12d2-4016-8c09-64e6eeeca604", "value": "T124F24B88D911C4F1E913027125EED7A2AA3AE47E70A7E807E3981D34FC66681F2177CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237206, "uuid": "409231bd-780e-4f59-a79e-869ba8c99621", "value": "768:uquc/mzZKBfgNnYj8DZzcVyp4Wflla8sgULbuVx0GTRJ:KYkQJaYjgzoyp4ulla80LbufZ1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678237206, "uuid": "c8ef4d20-b1bb-4abf-8391-0a0e7c3c64ef", "value": 37500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678237206, "uuid": "372802df-d42b-4555-bd5f-435f610221d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237206, "uuid": "e947e450-476c-4760-a827-78dd39bcb05f", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0611303-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678303911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303911, "uuid": "116c1aaf-89b7-4685-aefe-5dafb0d0791e", "comment": "Malware payload (SnakeKeylogger)", "value": "f4124d7e481c6b6c6118370bd8479f99", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303911, "uuid": "63d6b75f-2acd-40f6-9188-ced1e1e8d237", "comment": "Malware payload (SnakeKeylogger)", "value": "ce408d975896e3d6d6d65d3aaa1bacbd8a7c0521774b6d99217eaa536017954a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303911, "uuid": "3a6b4330-bedd-420d-9375-7dd445db8f1d", "comment": "Malware payload (SnakeKeylogger)", "value": "de440f2973c7f6db83eea6deab71f3410fd75ce3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303911, "uuid": "93487d65-181d-4c8f-9b76-3c36d220246f", "comment": "Malware payload (SnakeKeylogger)", "value": "e460a24310c7fc3e43b35dd81eef8ed0a9485d9a3f721438166e205ea0565bb3f5c284b2d710f05cb9ca244e1e892a71", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303911, "uuid": "f77dab36-f25c-4daf-afd3-9ab6ff449261", "value": "T191E4338E4F5F6CD9D36013230263C78092A43E5CFF4459D0699CE66A4A36F29AF325DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303911, "uuid": "25484839-2e1d-465d-9fc8-18d8491bbd16", "value": "12288:/v+iGcmdx34hvJ1svL/y2+u4usiATUil9uEnqhrKZ5uQYZVU9r8wA2vzp1aZvzP:/vZGc04RjwjyHu4EhiDNqhGZT0U9rdby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303911, "uuid": "8ac8e8c2-6f13-449a-ad6f-b55a294b0671", "value": 697905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303911, "uuid": "58fc9bc8-2b26-4054-9e0b-babaffcf9828", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303911, "uuid": "a9d44622-5c70-46fa-a71e-6d024f92faef", "value": "ARRIVAL NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03ac15e-bdb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678281550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281550, "uuid": "f884d1cb-54ef-4d04-ba09-055c5a07d2b9", "comment": "Malware payload (AgentTesla)", "value": "69748bfa7f475b60543953131ed1e9c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281550, "uuid": "3af42d3c-9c87-4f1c-9aaa-7d515a635a86", "comment": "Malware payload (AgentTesla)", "value": "ce60cc8b263f33d73519175c0304b3df182806ed4a8b7574ed036986c0cedebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281550, "uuid": "a15006f5-af7e-4941-acb5-14e0d28bec94", "comment": "Malware payload (AgentTesla)", "value": "9645c0967e5668f80c8a21167d887c82daf39e64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281550, "uuid": "5f44847b-8be7-4932-ac56-19d2877fe808", "comment": "Malware payload (AgentTesla)", "value": "d2850666cfc56e8f7b950f6fa7870a9c98e1c4ff27bea6f92bd89daa874a5978dca8ae55d9686a996a09e0639f4dba8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281550, "uuid": "7324333a-21c2-4e18-9e0b-31d19bb8740d", "value": "T11A64121996E8C877E6625B711FB2F7AEAAB0D7154410464F4BE06F8CBD1E381EE0E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281550, "uuid": "8e127558-0ee8-4673-9a35-3be0e4148999", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281550, "uuid": "97342a3c-29df-4714-bd03-e4d590a3e4c9", "value": "6144:vYa6YuP8moji/s/GFqMtxKFcBBOb49c7N4pIX1jAcZf6IR:vYOjmgi/ASO6BsF3RfZft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281550, "uuid": "d039f62d-d4d8-4966-b9f5-306625dbf278", "value": 306894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281550, "uuid": "009e7cc2-c2e7-4844-ad36-7ec02ef05d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281550, "uuid": "de9c66b0-2a51-4f62-bb89-555d10d8776e", "value": "ce60cc8b263f33d73519175c0304b3df182806ed4a8b7574ed036986c0cedebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12371975-bdcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678291539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291539, "uuid": "637c9d66-075b-4912-9197-0d059ebabaca", "comment": "Malware payload (RedLineStealer)", "value": "b7ad185d57e4be8ce24346790ede5f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291539, "uuid": "d224ac06-9b9b-458e-9f85-e2664ff5739d", "comment": "Malware payload (RedLineStealer)", "value": "cecaa5c6af9506927a29ec08ee59d12213f1396711b1a839f4bec5eb25dd6c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291539, "uuid": "85c5a146-d103-450d-8d86-81b124011c5b", "comment": "Malware payload (RedLineStealer)", "value": "e32a7afa41049e7364b56d224b578917293b6ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678291539, "uuid": "37c33251-1383-4595-b303-8cf6fad2091b", "comment": "Malware payload (RedLineStealer)", "value": "4ffb7cd3375b4e41555b7ec327fb30451cbfb8a40b893e31c2e8eb17b0c32ab051622aede5fc3871421cf4b15c5cae31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291539, "uuid": "4b2e1eed-bec2-4659-838f-151a7b14affd", "value": "T121E4063CFCA59BD6E13AF7738553E210F3F590F2B311C9166EE2888502A5A71A2DE50D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291539, "uuid": "3ddb83ef-54f8-4219-bb25-dc96732f08be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291539, "uuid": "23f46f6d-133d-4617-9b01-53fe016746a3", "value": "12288:yermr6MuPGDKRjbudJW+hMo3BxXcCE+tM5arg:lmr6Mu9ROzuWBmGlrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678291539, "uuid": "96b54a0b-e665-4681-b220-c034b01b24ba", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678291539, "uuid": "99168dfb-217d-4fe6-92e5-d5c23c6f5479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678291539, "uuid": "a407f88d-68c2-4329-ab00-8885de4349ab", "value": "cecaa5c6af9506927a29ec08ee59d12213f1396711b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690e8c9c-bd85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678261620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261620, "uuid": "287ebfde-c5e2-4aa5-a3db-28193195e074", "comment": "Malware payload (SnakeKeylogger)", "value": "a821a25681c60e86da32934803c0ca4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261620, "uuid": "52fa7bfd-8931-4e37-b7d2-d0e50d0c0d34", "comment": "Malware payload (SnakeKeylogger)", "value": "cf13df594c6d63c04b8252028daa722e3b31b6538b578b90539b4d7be900f0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261620, "uuid": "c95fff05-bce4-4968-85d3-75accfa5bb20", "comment": "Malware payload (SnakeKeylogger)", "value": "2754bd59336077cae5cdf9f01704398aa653160b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261620, "uuid": "e3e12e74-dadc-48b5-a572-c9bd84d5368d", "comment": "Malware payload (SnakeKeylogger)", "value": "1eb41a6dca313e21cb2e68db75f889ac8e5c2391e38e84c61e8821e5705285b44ff41e281a9f5aec96b68f78df1d5bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261620, "uuid": "e66479ac-e1b9-48a5-93ed-8ae19be67969", "value": "T1D1259DA56F196253E7C2A1F31804EBB6EBACBD4D2426C0843EE13D8FB1B9D6C1111E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261620, "uuid": "4e2c9d94-cc2b-4d21-8e88-55a8a230a3dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261620, "uuid": "705765e9-b00c-4fcd-b2b4-1bb58cc83c96", "value": "12288:1gX35BVmNUhTweVXU9lE6DipxndA0IuIb63deqBe4s/:83YNUhk44lE6DgndA02e3deqBps/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261620, "uuid": "69de44f3-2b86-4ba1-bc47-5995872f9fde", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261620, "uuid": "e3a387a3-3cae-4126-9ef7-c35cddad2f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261620, "uuid": "2f03c76c-fe03-449e-a0e7-cb8d77341057", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df9ef42-bdfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678313437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313437, "uuid": "619c0be9-8d5c-474c-86bd-bf85a3adef06", "comment": "Malware payload (RemcosRAT)", "value": "ece373b3964de43caf73e842e38703ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313437, "uuid": "8d0e4e1a-174d-4d3a-907a-f89b315df1c2", "comment": "Malware payload (RemcosRAT)", "value": "cf6de5f333dea0ffbc94ef944a23c99db28e66e7d51757d01a9a017a21fb8837", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313437, "uuid": "0f99a675-bdc3-46cb-98e1-2d8c44dd9f6f", "comment": "Malware payload (RemcosRAT)", "value": "0237651643b1b1ae9e76c27093a9ab43fe8e1a51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678313437, "uuid": "0d168ce3-4b28-42ac-83c9-82b3f5967dfa", "comment": "Malware payload (RemcosRAT)", "value": "3e407345353a7f04d872687ad7fa908afdd063fae8e687d1e812154edab443532f2eed988825a289673fca46d86d3636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313437, "uuid": "a7e47947-1078-428d-b4c5-95893f376ec0", "value": "T1C8A59EF09E93FE8097AB2C8490CC2AD09C4C1B9B829D9548FCDC2556E2E5694FFDD5B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313437, "uuid": "db4e5e46-8ce3-4b0f-826a-c9e27b84a41a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313437, "uuid": "c0b350d8-b5f2-45cb-bac7-4bb8274583da", "value": "24576:9kGLeyv8GLHgD9s6Hi6zstYuzdtiCxFKtW33HTwHojrNsGeKWjO1sli+Q:9jeu/6uz+8FKoqjY+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678313437, "uuid": "0ea035e8-e3f9-41c6-8240-0a2a93e27d91", "value": 2192384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678313437, "uuid": "c36889d5-f184-4125-83c8-a0a0d7a070ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678313437, "uuid": "16b87b27-5377-443b-8c45-d40a7c352922", "value": "ece373b3964de43caf73e842e38703ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37fe67a-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678307728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "478c6010-9db5-48bc-b067-475d3874037a", "comment": "Malware payload (Mirai)", "value": "d8f0a6b73adf8ba2737d4035998f8fab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "20402139-979e-41a1-8b26-85ccb2964d26", "comment": "Malware payload (Mirai)", "value": "cfbd5af383e5d4e6088c08a86ad9f783947547d0240c269ab9401bbe75a734f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "a898733d-04f0-45dc-9145-109c76070a58", "comment": "Malware payload (Mirai)", "value": "4be4ab1bd30f9f04d0d1e25ad9db42e9b2e4a8e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307728, "uuid": "88dd24d0-0afe-45ef-b317-c6ffd8037a64", "comment": "Malware payload (Mirai)", "value": "9b540cb27b9858152d4bf8a8f1894c612fddb396ec4d2f1ddd3975ef3e642886fb957a57ea6ff323e2cc8cc2fad4845b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "b21979ef-3984-4bcc-bdc4-badb394a74b7", "value": "T1FCA3E81B7E558F7CF7AEC63447B74E25465933A227E0C085E19CDA002E2134EA85FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "53f95188-5a6f-486a-aa54-5199c9ac3d5f", "value": "1536:isovB6r+6PSzqm9SB5Dyzdt5rMOlaikZhYvJP2KCNaDvn1fdjEC:irvMr+qSeHyzdt5rMRiWYxfCK/11jEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307728, "uuid": "9c7f64cc-2675-4400-a55e-0a22b42392d1", "value": 104912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307728, "uuid": "259e478a-7a9c-4c3a-bc3e-a6836e405da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307728, "uuid": "fdedc978-ec5a-49bf-83c6-bf0e0f5193f9", "value": "d8f0a6b73adf8ba2737d4035998f8fab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed03c493-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276015, "uuid": "731794ac-d37e-46d8-ae1e-62c48678fecc", "comment": "Malware payload (AgentTesla)", "value": "5c174a8c932844428c54877686885bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276015, "uuid": "de2e1389-d5a1-41bc-b831-8dcb32adadba", "comment": "Malware payload (AgentTesla)", "value": "cfc9ec5acebd081c1f16545360fcf4ec7067337ac0215f5c1097d5b7a42aaee0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276015, "uuid": "8f2738ba-17e9-43a9-8daa-3984018c6445", "comment": "Malware payload (AgentTesla)", "value": "63b24045a70890373f79850c8e75e58642ff01e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276015, "uuid": "4a3b16b7-da57-47db-affd-9257de75f642", "comment": "Malware payload (AgentTesla)", "value": "20b4be02c2ab6e20910d4469d999ae0c1ca7a3bb5b928ec246a0fa916311c7d537a310e44e9f924d8ced706afe765c77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276015, "uuid": "2aab8b3f-571f-4521-a699-728096ba61c9", "value": "T10F145F51EBA46C3BF5540779AAB291931A93AD33B911CD1622C7730F5B73FA06C32E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276015, "uuid": "d9dcfec5-8d62-41f2-8976-87145d1d05c5", "value": "3072:IkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA/QvqpN2TwqHI9:lZ+RwPONXoRjDhIcp0fDlavx+W26nA4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276015, "uuid": "1f9e683a-61eb-4048-8773-f1b7a3521ca4", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276015, "uuid": "4eecd170-e855-4e60-9108-7fa18e61fb74", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276015, "uuid": "5d6ba3fd-a166-49a2-b98d-b8c963321fdb", "value": "2023X03X02.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d16023-bd46-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1678234718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234718, "uuid": "e9ead345-316c-44cd-8692-9dc152611a45", "comment": "Malware payload (IcedID)", "value": "fc55f67e162226b3a95a8dd1aac2e710", "object_relation": "md5", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234718, "uuid": "687ccaa9-1082-47ae-b030-1dc0e68ad389", "comment": "Malware payload (IcedID)", "value": "d0869ecff3322c6bc1c1d7cdbafa4425ed30f06ffa405f2a813d1231b0a86c60", "object_relation": "sha256", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234718, "uuid": "c43daf0d-049e-4a66-ab41-7fb9b63bb931", "comment": "Malware payload (IcedID)", "value": "aa3a9a40c5dcfbac8a89ff2b466d09439d78b9f1", "object_relation": "sha1", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234718, "uuid": "659298d2-9555-4fa7-aeaf-7204b6554c28", "comment": "Malware payload (IcedID)", "value": "c4d82fb061e69fbb3a1536c890d5d2f10a018a9f838cfd90478e1de7f4ab1cd0020fbfce09b91d2852665cd22012f0c8", "object_relation": "sha3-384", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234718, "uuid": "aaa483dc-9eeb-47fb-bbfc-525d91a807ae", "value": "T12B35BF86F3A405A8D977C1388617472AE3727C0513209BDF17A47B6A6F33BE1673A325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234718, "uuid": "da8bda37-d404-43fc-97c2-dccccf124791", "value": "24576:QHL0e3k4usYYqbczfGtm4fSpHZ4LHpt0:Qr0e3kFzczfKmUSpgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678234718, "uuid": "908ef54a-3e81-4d6a-ba93-a384590231a8", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678234718, "uuid": "795f60fe-87d8-4250-bde4-3db302ac445f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234718, "uuid": "b20ee340-2c0c-4577-9897-5600999024ab", "value": "bill_WE-33987779.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ff4901-bdac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678278317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278317, "uuid": "4712e2ab-6ea9-4bc1-b162-abec19c48f41", "comment": "Malware payload (GuLoader)", "value": "d2022b2ba1d346996f86293d1ee6d4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278317, "uuid": "61ac7e40-aec5-4654-92f8-3808baddae15", "comment": "Malware payload (GuLoader)", "value": "d17b2411ba64559c44f69e57fc5a56f48a8520088a4fb6ea9a641e100054f136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278317, "uuid": "bf08505a-5c10-4699-bdf5-8d5e4b7ef88b", "comment": "Malware payload (GuLoader)", "value": "1c9d71ae0706c2fd85699809620299ded08243ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678278317, "uuid": "13a84a7b-aa54-4520-bcb6-977ae6c67375", "comment": "Malware payload (GuLoader)", "value": "7211b3f8a052eb764098713ebf3e5ee0acdfb727e71438f8620e9343408cc88c1ec3c8af491f9d6dfa82352c634baabd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278317, "uuid": "c15ef651-e896-40a8-9f70-f50e19edbf2c", "value": "T155C4235071F4C073E0D1B530A8B636B53F26DF90241166172B89676EAEB31C2B76D3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278317, "uuid": "5005eab1-a703-41b1-8e53-2947495edac4", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278317, "uuid": "c34c9eff-ac48-4e6f-a492-6f6387f6bd6b", "value": "12288:+BwvXPG7TYgwzezl/ijrpsWJrZqcOmpmw1951JpYEQlCD:hvXPGQqaiWlOmFel0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678278317, "uuid": "60c1bd54-eb72-4a7c-a9e4-07cb6ff5c4a0", "value": 561319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678278317, "uuid": "05794bc1-9857-4991-a93c-159362f10cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678278317, "uuid": "1783d14c-f9f1-44cc-8077-226591544345", "value": "d17b2411ba64559c44f69e57fc5a56f48a8520088a4fb6ea9a641e100054f136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a74262-bda9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678277318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277318, "uuid": "bd8ed627-55f3-430f-9f47-c85cee2dfd96", "comment": "Malware payload (AgentTesla)", "value": "b15f30c9d09a948a3054c392e96d29a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277318, "uuid": "2a5662ce-5b9a-416d-a229-a995c4a560a5", "comment": "Malware payload (AgentTesla)", "value": "d22da11ada3a0083f2c4ef5d6c3bf5c20b5eb62b2138d77dfc01ddd74f4e8f11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277318, "uuid": "7cc33bc2-2617-4c3f-bfe2-6e6a717ecc38", "comment": "Malware payload (AgentTesla)", "value": "af30e9cb0649c03d19e2694e79a67b877af1bf17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277318, "uuid": "ecae757e-573a-427d-9fb7-b61c62314cf5", "comment": "Malware payload (AgentTesla)", "value": "c65cb8b0482ea307c4ee9a888ad39e28262c0d1507ed8c6529c5c5536e98b6e43d05abe70ff87c6384f58da4b0d03ad6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277318, "uuid": "a25eff0f-a1b0-4da3-af68-e34ca54cd9a8", "value": "T14325F163F222F5CEDCBE1FF4247B916413989F1F128C04653278BFAA317A6D42615E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277318, "uuid": "84752ad0-aa79-4d2a-b4c9-052eb8e93847", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277318, "uuid": "01190281-1c58-40e7-8717-8a88c42ae72e", "value": "24576:CYXYiNQKSNYNc2U8A/RpOnTcguH0pSEEhFTDSK:/XYiNFSNYGxREnTcguUQ/tWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277318, "uuid": "2c7f2e40-7198-4e41-bfad-d6568f7e3936", "value": 963497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277318, "uuid": "824e9fa9-4e0c-4f75-9656-af78eccf2a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277318, "uuid": "64d1d2b2-05dd-4705-b8f1-8e68f0784d94", "value": "d22da11ada3a0083f2c4ef5d6c3bf5c20b5eb62b2138d77dfc01ddd74f4e8f11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4f1a1b-bde7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678303668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303668, "uuid": "36766ae0-64af-4271-9325-8c9986b88557", "comment": "Malware payload", "value": "8c5e9f19643b87b2116932f943ceca6d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303668, "uuid": "24c3dd94-5186-48d4-a52d-29eb1347dcd9", "comment": "Malware payload", "value": "d28f8d5335c9676b1af65c61283b1a1babd8f076f1dfc2e918b2af9ea97b0919", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303668, "uuid": "6479e1ae-3c7c-487b-862c-44b011e7876a", "comment": "Malware payload", "value": "78ae29756563abf16c3f1201cf99db77df43ee57", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303668, "uuid": "7bbfedc3-6203-489f-b065-e70ff6351f3c", "comment": "Malware payload", "value": "6d54c6511c2532728bafda3e114988119a40741508a04fcae2121d2ecb8628230a21affa53358b7262ecab16a586bcbf", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303668, "uuid": "d734554b-416c-40b8-8c30-aa38488a3b83", "value": "T1D3145141E7A56C3BFA540779AAB681931993AD33B911CD1622C7734F5B73FA06C32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303668, "uuid": "3ab97fad-f7da-4957-8e49-2be0cc5024d2", "value": "3072:gckZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA+uqHIBnN2gQv4qi:gJZ+RwPONXoRjDhIcp0fDlavx+W26nAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303668, "uuid": "1e93d070-1225-4964-86e4-1fa728fb93ba", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303668, "uuid": "a2eb9e8b-49da-4298-b4e3-daf080454d6f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303668, "uuid": "c25f440f-f45c-423a-a750-16781fdd2b29", "value": "SecuriteInfo.com.Exploit.CVE-2018-0802.Gen.31481.25647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23941cb-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678285043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "afccd1f2-eaca-4be4-a7ea-90b128a9d04d", "comment": "Malware payload (RedLineStealer)", "value": "dfce25f516c6e9d9f167f231491ceef7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "077d37cc-a89c-4279-be46-01ddbcd25b2e", "comment": "Malware payload (RedLineStealer)", "value": "d2e4fa4a6c7bdd33830347689119280de15ce7a62882abb669f1fab51a7786d8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "395a6dad-6851-4865-9083-f18962ea84b9", "comment": "Malware payload (RedLineStealer)", "value": "7dccb349a90b44d3959fa8060966394b3459f2cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285043, "uuid": "131db7a1-9352-45b1-874c-12cb103b4e85", "comment": "Malware payload (RedLineStealer)", "value": "e3a9aa5e77f5fb1026f6c6a92d27521e61caea43591c1fb717ab152de550f6a87626215c3d7f792c4717a32c5aebd03c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "9a8423c7-796f-40f7-bac1-312be21d566c", "value": "T14A43D76EE70F0925DF5597BB434B4A4909BCB23DB38540B139AC973837ADC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "890b75ff-1148-4a69-8468-fe8aeba48b6d", "value": "1536:5wAlUc1Z7SnzJG8h89emo4MMQt4RVemDR13oTLaWt6cO/okZ7NCU4QAAoHzk8Hl1:5wAlUcDSnzA8Yemo4MMQt4RVemDR13oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285043, "uuid": "867c0649-f033-4ee2-8dda-36a9c0bdb027", "value": 60375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285043, "uuid": "9a862627-fbe3-460d-8278-1abb8d22d12e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285043, "uuid": "4f360eeb-add9-41a3-aab2-801e60d49192", "value": "payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591c98f2-bd99-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678270184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270184, "uuid": "0a51fb9c-e9a6-4010-acde-8b3175b280cd", "comment": "Malware payload (RedLineStealer)", "value": "1b1b7303d84d7476338a36be315cf17d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270184, "uuid": "5de12f2c-1358-4250-ab50-1076c98dc5f7", "comment": "Malware payload (RedLineStealer)", "value": "d3f8b9ca52931ea88524319a7d1acaa2e261f4303c66baa32ea3a3f02c370cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270184, "uuid": "6de92287-6c25-4021-8160-61507b61b00f", "comment": "Malware payload (RedLineStealer)", "value": "cf0860478e62fc7ae6ba3c677a666b5102380245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270184, "uuid": "60d773ff-e5e2-4f23-ba20-2ec8a213f129", "comment": "Malware payload (RedLineStealer)", "value": "6171d7aa7c162c1f605d4d3b9159f62924d212d8ec7cd244243073199f01e34a3485188468035fb3a749d301f4d6416a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270184, "uuid": "36b39e17-9593-4bc2-9eaa-14186937b060", "value": "T18764D01263EC6821E5721B715F3EC2E43A3EF9635D786E9B23146F1F18712D28972722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270184, "uuid": "16b9ff13-032a-4115-b3fc-2b6aabe015cb", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270184, "uuid": "3a34bc1c-534c-4584-b2f7-41491d8dedb5", "value": "6144:DjXAh+GmvLZ2D1p56Wf9b27wLJAMs8/mAaTaw0:DLa+Gmvt2D1KWFb2GAMs8/mb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270184, "uuid": "fc558a00-387b-44b4-b8ea-fc1b8e6609f3", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270184, "uuid": "8654f9cc-5d11-44ac-aa12-5b6dd3dd9885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270184, "uuid": "d63febd8-71ee-47f6-b657-c3dbf6614e14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71cdf9e-bde6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678303413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303413, "uuid": "fba8141a-4240-4879-9bf0-fdb745348f1d", "comment": "Malware payload (Amadey)", "value": "97849c89912e56c2f1eef99fea81dc78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303413, "uuid": "efeedafe-e5f6-4487-83b1-fe8edaee41bd", "comment": "Malware payload (Amadey)", "value": "d479fbc3b01161bcdbfa1a314df42b29947ba1c115139aa93cb03997f4deb864", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303413, "uuid": "0b634948-fae7-4d97-af64-3bb911c2cc89", "comment": "Malware payload (Amadey)", "value": "92a0759aea41f58152db8ac01dbecf428a0e4e2b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678303413, "uuid": "6a8702d2-bab2-4c34-a64e-91833745b871", "comment": "Malware payload (Amadey)", "value": "f520882d1803a7b7b968637f6172ecfe2b20b3ef9bb629f7cb8bb439c5737839eae84e4f56e95073f4db6fc9ef557921", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303413, "uuid": "3c91865f-7018-4160-9ecf-b6eff67175ca", "value": "T157E4121252E16D30F63656725E3EF1E4672DF4604E7BDBAE1218AA0B0DB11E0D9B3732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303413, "uuid": "2d689393-97cb-4c6a-8cfb-13f6e1a52442", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303413, "uuid": "0c77b2bd-1406-401c-a828-f26503fe7384", "value": "12288:9TsxrPyFxTSBu9li8hAerTfnWnP7haV+f2UGSsTv:9iPvufbvfWnPVaVwGfTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678303413, "uuid": "1115b440-6a8f-4fdf-9853-19f8c72f586f", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678303413, "uuid": "15feb138-b1f0-4a79-96c6-eea790a52473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678303413, "uuid": "bf790671-8ff6-4c85-aea2-16acdf576084", "value": "93cb03997f4deb864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c12aa4-bd46-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1678234671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234671, "uuid": "e5645fcc-6467-45a3-a74e-ed3445d2fc5a", "comment": "Malware payload (IcedID)", "value": "63ebfa87e21085c4484bf20d3262de26", "object_relation": "md5", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-1310", "colour": "#CDF775", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234671, "uuid": "86462587-08d0-45cb-9f84-df411e556d33", "comment": "Malware payload (IcedID)", "value": "d486e9362d4fc3ab2112eaf78c2ec3ea399e137c122741ee49428746333c6617", "object_relation": "sha256", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-1310", "colour": "#CDF775", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234671, "uuid": "33730ec0-1442-4bb4-b22c-848efda0d986", "comment": "Malware payload (IcedID)", "value": "63aded4400a236116e67c806f5acde0b6457a492", "object_relation": "sha1", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-1310", "colour": "#CDF775", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234671, "uuid": "749a160a-29c9-4ff1-882a-ef1fcc0e6b17", "comment": "Malware payload (IcedID)", "value": "6ead097d059fb492a37988c4d7694dfceda5d0000cd27c979bc18b6aa376cf5df25577ed4af378d1b75ecf3fdec84ce4", "object_relation": "sha3-384", "Tag": [ { "name": "2564808981", "colour": "#FB6682", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-1310", "colour": "#CDF775", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234671, "uuid": "13fbed59-f375-4130-a002-28d7da80ea02", "value": "T14EE423295BDEB4204A650A3F152FE8FECAFEBCB4B0106AB3A854937356C16770C513D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234671, "uuid": "86b2649c-a8ee-4748-b8b4-916f95ebe948", "value": "12288:2NOsLYe4M6tioF5mG8zzIj2yCa1U/67AvgK24RAm7OiO8+TMV:1sEe4M2FrcIjFCaW/IAoKDAeOiO7IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678234671, "uuid": "1b640999-acfd-4112-b465-327a57229b27", "value": 664911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678234671, "uuid": "bca46052-9105-4238-9762-950bf5462f35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234671, "uuid": "3d7a1c54-dd32-4384-8771-14224d574184", "value": "bill_WE-33987779.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca9f88a-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309515, "uuid": "8b615f8d-780b-43a0-a016-89b2d800c9dc", "comment": "Malware payload", "value": "29f098472bd24f605b93a5e4d5ca92fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309515, "uuid": "bc8098ff-6fb2-43de-8738-fbed65670f76", "comment": "Malware payload", "value": "d4c994d13b35c5ab9e3ebfbc56b0b6fc8212df948037e06b91287250801be32f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309515, "uuid": "a67fa0c3-7473-42d2-a196-71dff428e163", "comment": "Malware payload", "value": "f443146d18e48445aaa29cc87c68cf3558f25c64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309515, "uuid": "8b599842-ffe1-4ac0-9816-457b473ea5d7", "comment": "Malware payload", "value": "171ac992b51fcfa06b06e3b99e31647b6081fda644922ece1b1c18c9218c5d75cb508bb3876ba20ab08674b3f4718882", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309515, "uuid": "d08c16a4-4faf-47ef-9240-fc6fd1985e1c", "value": "T19EA1B6CDBBF5405722EB3AF4AFE017536D75D8D1B1B55285C82F027B806A21A78BA0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309515, "uuid": "22d95812-16bf-4c23-b1c8-90d7e93e41ba", "value": "96:wLqrSJPSeqrSJPSi6qrSJPS1qrSJPSkqrSJPSH:CVXQgXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309515, "uuid": "2e4685d1-26a9-4239-9c50-0a1bc86d4b52", "value": 4851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309515, "uuid": "a5371db5-0f9e-4144-b8af-19a2454dd3b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309515, "uuid": "21e4e2a7-0ed4-4f56-9460-0bed49572adc", "value": "harmless-popup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52efae5-bdbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1678285451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285451, "uuid": "39a5ab2e-4bc9-4cc6-9992-65b4db3ad243", "comment": "Malware payload (a310Logger)", "value": "888a18230e69a8ba0c420042bcb6e758", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285451, "uuid": "dabe7ebb-c1d2-4bbc-8ef6-9546cfa5d6d8", "comment": "Malware payload (a310Logger)", "value": "d50e53128afae84f81f41fce22e7ce3f13442485d7c7ce3bb1417afaba6c9c05", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285451, "uuid": "939343b3-2738-410e-90f5-02e0f85d7c9a", "comment": "Malware payload (a310Logger)", "value": "0b0dcb23577efc327acdd2ff052bb3d54693d715", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285451, "uuid": "b831d1ba-c85d-443c-af46-0d2ba124903e", "comment": "Malware payload (a310Logger)", "value": "a44487d53dd5e2a78176b2f5a09193f3bfa4888b41ffe01c233e98172d95eddc731749db654af76c1c01c03309071821", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285451, "uuid": "fabe4950-9a36-4abe-bb61-a59122a0ecfe", "value": "T117B5AEF18E52FD91D7AB1DA490DC2AC04C4C1F9B82A98548FCD83516E2F66A4EFCD5B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285451, "uuid": "faae4895-641b-405c-88a2-b40db7c49bca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285451, "uuid": "0ae1b288-e2fc-48b2-8f4b-30a7ca4c8380", "value": "24576:sE9iqdFA3SA2PWRLxlTP0q0prBMsOZORHJd5SbyBRJ4y4c2TsdZh8FzxZ+hLAwKu:79vgIWRbb0RtYQBXhcOatvd4oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285451, "uuid": "1ff6aa7e-be3b-4186-93f2-4b909aef157c", "value": 2492928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285451, "uuid": "7b9ea883-1ece-44bf-9114-3efb4ac0f503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285451, "uuid": "7c644f61-bc10-4592-a5fe-8bb30562fe09", "value": "DETAILS AND INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b679dab-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274778, "uuid": "3a26a822-acbc-4830-beee-785b2cda7555", "comment": "Malware payload (AgentTesla)", "value": "7a90e2f9835582f82726c1cc3da67d76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274778, "uuid": "5f2f3922-661e-4c55-9f87-48e031fd8364", "comment": "Malware payload (AgentTesla)", "value": "d52025cb02059f4781b0029206e7b60996c869f4d92fca9fbd30a270b184c5da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274778, "uuid": "2b93001b-78d1-4923-a9e8-7775cc8c6531", "comment": "Malware payload (AgentTesla)", "value": "8bb296148d77acbae6800999e50a505b8ddd046b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274778, "uuid": "bb2c6d6e-f14e-4cf1-93ec-be8fe6318bda", "comment": "Malware payload (AgentTesla)", "value": "d9db02f908f8b943c7d6897d78256cb3674774f1f063341b556b2d59e4837b6b91ba4288539aefbc915e8f908f8724a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274778, "uuid": "ff25158a-188c-433a-abb0-35d4307b45c1", "value": "T19CF32928BEC99DD2D32C4174D4A03158CBB291465697E69D0EA1ACF63F4E7C3322F963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274778, "uuid": "20b71426-2759-4cae-85fe-c1cf57c79eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274778, "uuid": "ae36745e-c07b-4dae-b086-d4809651771e", "value": "3072:u7piyjr1E7pqhSImbGezDQI4iKUKBQldNJDu:RCE7pqgpMINw0dTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274778, "uuid": "2624feea-5ddc-448d-b166-843b6ee52ec9", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274778, "uuid": "304323c7-2fd8-459b-bd22-dd26cf1ab759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274778, "uuid": "e682ed71-f74f-419e-8689-6d85b85243fe", "value": "d52025cb02059f4781b0029206e7b60996c869f4d92fca9fbd30a270b184c5da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7945ba14-bdaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678277539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277539, "uuid": "ef5b0e20-28fb-47b8-88b2-7ce79f2154a5", "comment": "Malware payload (AgentTesla)", "value": "d41c36a11c31ee70e3507425e2c7c1fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277539, "uuid": "c4bd8c4b-e488-4c77-a3e8-ccd5d6e7d99f", "comment": "Malware payload (AgentTesla)", "value": "d53638db97e77b35a337a0e369094cd82f4a8a5f0d0a8b649e2681ae3a44778c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277539, "uuid": "6705bd92-e76c-4cb0-8363-6aa2213023cc", "comment": "Malware payload (AgentTesla)", "value": "a83b38a4d9f20023f4189f162efabc808b573e0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277539, "uuid": "a5f1a5ad-bbbe-4194-a2f5-8727ff2daf07", "comment": "Malware payload (AgentTesla)", "value": "6df0055d3f9380d4d22075df5158cac3d642ea4b8f86d23e5ad696a3330be2b39c35fa07a56b8c017d391f4255828a62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277539, "uuid": "a1d00342-b0b7-4808-82b3-9f520ae15a99", "value": "T1EB55C084F130A0ADC75A0B74C8B772C847F876177F539D3A6B5E7A40E638136A35DA82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277539, "uuid": "48060d50-f20c-48f2-b318-4536dd64cc41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277539, "uuid": "b652a0a9-926b-481d-b63c-ce88f3cd2da3", "value": "24576:T5PVM+yvPwd4q9JxwYArQ5rjuWRG9tlP3MO:T5PVAAOq9zdhzc9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277539, "uuid": "94823bca-8ee0-4a95-884b-69436b9d257f", "value": 1341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277539, "uuid": "b9ccd6c8-1f51-4c63-ba6b-ea0ca82a96a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277539, "uuid": "0b458d09-5555-4e00-953b-26f31c80ba58", "value": "d53638db97e77b35a337a0e369094cd82f4a8a5f0d0a8b649e2681ae3a44778c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2898535-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678309525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309525, "uuid": "45c2a01f-424c-47e9-96e0-a91ff92b8d0e", "comment": "Malware payload (RedLineStealer)", "value": "b38442ac9576002c1a86151bb7ff6314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309525, "uuid": "942b7d71-5241-4992-adff-f3456e3a12c5", "comment": "Malware payload (RedLineStealer)", "value": "d5388c7c2b3d1d1f78bf05fa921d08da77dbd95bda870dd6586ef454f1baf057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309525, "uuid": "a832aa06-313f-4b21-9031-914b0b2eb819", "comment": "Malware payload (RedLineStealer)", "value": "c23eb6fd9e5ad95b0617e47636e4cccf1d50c199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309525, "uuid": "ba34d2a4-037a-4880-84e0-db5794cec99e", "comment": "Malware payload (RedLineStealer)", "value": "2841e2c29f2edf0de2970953b3915db6792f09fa711122bba31a64c0df30b0c6f1582e387423d62af9d34c2bb37597b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309525, "uuid": "d7dda871-3def-4813-a842-7a33e09fd107", "value": "T19E64D01293E37C60E27687714F3DF2F4262EFB515E6BEB9923145A1F08B11E18A63712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309525, "uuid": "32eec9bd-46f6-47c5-be28-eee353ce5027", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309525, "uuid": "05e72936-31f9-4e64-a5e5-8ddde067bc7b", "value": "6144:VoEoGkMU+A8zJ6PqyJ4F5frUIj5nPuxE11RlK:6vGk9+A8zJA7J4Fp3jpj1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309525, "uuid": "4d56a0aa-d4a1-4469-aa17-1f2b75ed2e86", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309525, "uuid": "506cb7a9-23c9-494d-bb0b-33c1e05847cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309525, "uuid": "b36f1ebb-bbfc-4d33-bd25-266366af23ea", "value": "b38442ac9576002c1a86151bb7ff6314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee2f7a6-bda3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274730, "uuid": "d3987901-7558-40d0-8c88-70e3a134472c", "comment": "Malware payload (AgentTesla)", "value": "4b4efbbb0e061f3e65ae99d798bf79b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274730, "uuid": "8812eb98-0f09-41bd-b203-5eab34575248", "comment": "Malware payload (AgentTesla)", "value": "d53dbe75a5f24c92bf54fa24fb1f354cadf3369134d6adc6670d669bdb65a519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274730, "uuid": "8c80cd80-0e33-4fea-b6c2-601fd2bb6156", "comment": "Malware payload (AgentTesla)", "value": "7d8f2970b7843b21316c54c80c1fc3fd3ff44912", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274730, "uuid": "a60cb1be-08ca-482d-8a88-92c7e38b70bc", "comment": "Malware payload (AgentTesla)", "value": "76e51d2fb4ee3c5bbfd6c85d6d3f1aacc9a345f6c6c276019ae40bd8b2d5a78800586c5698ecdbbdb4668c4595d3699e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274730, "uuid": "9a5a56f1-fe18-4ce0-b81d-0219e403d5d1", "value": "T10EF3292892859DD2D72CA074D8E1111CCBB299469207E75ECEB0ACF63F467C7362F963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274730, "uuid": "f9339d52-c52a-42ed-8c85-d90debab31ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274730, "uuid": "c142d2cf-1f28-4f58-8496-87119acb0c6e", "value": "3072:bBxW8XpZYzOuE1e7WelumAbMx+ZYcEHimZpKRX/etf2tLPl:lL0ye7W+ZxMEHimCZ/a2VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274730, "uuid": "963fb638-29ae-4bf9-912a-633f20fe1113", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274730, "uuid": "a9f38451-dfd2-4e8b-9c17-6414fba940d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274730, "uuid": "e69ed846-92c7-441a-82b6-ea249da3cfe5", "value": "d53dbe75a5f24c92bf54fa24fb1f354cadf3369134d6adc6670d669bdb65a519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7361c74-bda6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678275979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275979, "uuid": "6fdfa9a0-ba66-4d71-9393-bb9a9f7b5bf4", "comment": "Malware payload (Heodo)", "value": "5d12944fef04e459a41fba14fa633415", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275979, "uuid": "1a226c92-d676-4259-858d-d2572ead5ec4", "comment": "Malware payload (Heodo)", "value": "d67363b988c9e5f53e6bd642a1308845a94b3283620b5ee9c36f8ce20f59d464", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275979, "uuid": "16f5d01c-fdfb-4356-b471-0d6ad951b9f0", "comment": "Malware payload (Heodo)", "value": "490458340f17c6d3b2d61b2f02613f7d6943ddf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678275979, "uuid": "4e97d907-0782-44ce-ad59-eeb79ac97557", "comment": "Malware payload (Heodo)", "value": "b43461e0424f644191e55b0d63047b554967d1b9e87398450a3855dd8949ae9aabbfa2bd4582621521083117729d57ec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275979, "uuid": "f76fb64d-700d-42b7-8a0e-22ed44994af7", "value": "T1C915233C5F67790FF5997C362AF3847AFDF9085CDC96E90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275979, "uuid": "09e76bc3-69fd-4b55-b3ce-89392b8fa63b", "value": "12288:z4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sj:8evtlkdJe4m19FgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678275979, "uuid": "573e9114-5ebc-49f3-8fca-5bc78dc8bc9c", "value": 882846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678275979, "uuid": "3fe2b1d5-9d0c-4e29-a22f-46d3a1ec8044", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678275979, "uuid": "26c3b054-68f3-442f-852b-d2049b6e1073", "value": "jGzjJTU4WT3Cp8SdqkGPPB18EBqJqw8Xq8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b971887-bda7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678276147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276147, "uuid": "bc80b9a5-c629-4440-ac09-e3db4361a89d", "comment": "Malware payload (Formbook)", "value": "89638fe1a25c80932d9e4cb30238e194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276147, "uuid": "8d420b99-baea-44e1-b2b6-b55fb0fbe7d8", "comment": "Malware payload (Formbook)", "value": "d67bc9de761645c9aa4b5669cd355f2fecde8b4e9b22f64f327f282754742031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276147, "uuid": "ab80a08d-deb0-49f5-9da6-0bd3b6f0c382", "comment": "Malware payload (Formbook)", "value": "39e2ba0f53784ba65b1c5c33c7629447944390d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276147, "uuid": "e683c4ec-4df1-4e3f-92b4-06c080202a60", "comment": "Malware payload (Formbook)", "value": "3d5df7a581685287da53c1b2db21bc41646c91d14431f57d5774225cb7bf4c821232c991d58dbf75ee22f4e395aaaed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276147, "uuid": "eb6928c3-33fc-4765-8308-99d45f0dd52d", "value": "T1667413805BA5DAB7D4E397324E3B2467EAB1E81009794B1723609F2C741B3915F2E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276147, "uuid": "f0a8f5ca-d3cc-42f3-878c-260924d3a372", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276147, "uuid": "48a790bf-b6b5-4ddd-949c-d9cb4fca49e8", "value": "6144:/Ya6QPTmatecxGcFxZci7zQiJtMCnTiyaaMvJZEFST/WxHNQow:/YePTmat2cFcivxTvktvUS8eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276147, "uuid": "78910370-62de-44ad-a75d-084a04070367", "value": 365521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276147, "uuid": "ca16166f-0f98-43f5-9e67-eec7ce3b9555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276147, "uuid": "3cfa3153-3b40-49b7-b74d-6701e75a247f", "value": "d67bc9de761645c9aa4b5669cd355f2fecde8b4e9b22f64f327f282754742031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a949cc1f-bdc5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678289216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289216, "uuid": "85ae8109-e410-4d51-ad64-f3437f14a9e1", "comment": "Malware payload", "value": "bd630c5c849885af14ad07254d2b97ac", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289216, "uuid": "8d63bd81-1800-4f38-b2da-8e9b27f40ce1", "comment": "Malware payload", "value": "d6abd45f79810924042dcc996e75412aeef9e399693d1cd85f4e7ffc5813d474", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289216, "uuid": "83e320ee-d932-4b90-8336-d8b105528abd", "comment": "Malware payload", "value": "73f12abf504a943513e187919e5190025e90468c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289216, "uuid": "28287357-1596-43fa-82c4-4a4ed075f846", "comment": "Malware payload", "value": "6c9c0f8bd84aa60b6b19d1e6b6083ae91ba3cf9f877097cc2522ee41e9c3afe0ba663d50d4b2b34885cbbc69c4982931", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289216, "uuid": "c59280d7-5975-4425-ad43-58b22b701168", "value": "T1A09423A274C2F367E90B4A3AF9C6E0D71221FD05EFA5C207B154FB8ECC3A254A911B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289216, "uuid": "7ab1a364-c148-4ad2-9970-df73cc92fcb4", "value": "12288:NO9zFvoH/NB56A1drs0EjZCQkydy+w514XhthsrI/l/qQNC:NO9zFvo/NBEA1IVf9yF4XH4I/FpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289216, "uuid": "125cc388-a507-4336-86e2-dfcf61bb518c", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289216, "uuid": "02ac7fa8-e548-4360-9ca3-d9be6fe92a3b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289216, "uuid": "67f10e9c-3d2a-444a-a46d-1ff4424b7e24", "value": "Shipping Documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d36c88-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248296, "uuid": "66716948-478a-4429-ba90-2bf4eae1e203", "comment": "Malware payload (Mirai)", "value": "8091bef4bea1b3ef111a59dd9238b9d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248296, "uuid": "687a9d2d-ec50-43c5-bcc1-4a962723ec34", "comment": "Malware payload (Mirai)", "value": "d6b653db16f33dca311fc975a42592b25407b28dacd5e5a23f4bd9e0cedd358d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248296, "uuid": "3c8a428b-5175-474f-a89a-10596e305ba1", "comment": "Malware payload (Mirai)", "value": "8c4408a6789a5f6118efadc1dce8d0b80be1e40a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248296, "uuid": "9bf5f4f0-0834-4316-b465-fe4ecc38e05a", "comment": "Malware payload (Mirai)", "value": "8468407fa4ffadb05e6faae47df4bb635237737247f3dd50ab409cfe48445d25d1edb42fcaeccdbfce0ee61d3a26d4d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248296, "uuid": "a0ba39b6-5c2f-492f-9d1f-829dfb6c2d12", "value": "T1F4435BC4FA43D8F5DC9715702077FB379B72F1E922A8D643D3B49932AC52612E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248296, "uuid": "151157be-b970-4686-8563-4e508aa35f13", "value": "1536:FEytfbaM12r8ZBG6CANZmTJTwSoaEDrkMUL:FEytfbaM1zAGNwT5T3Es3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248296, "uuid": "10616072-5ba0-400b-87f0-2e59bdb6d24b", "value": 55600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248296, "uuid": "c35687f9-61d9-4d49-aece-5deba6750102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248296, "uuid": "7140dcd0-9e07-4363-9d93-ee85967cae36", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174ec0c6-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678309587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309587, "uuid": "b0c75ad5-0db3-4c62-8422-c8eb93516173", "comment": "Malware payload (AgentTesla)", "value": "00b67ddff4f7421d55165eff61012cc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309587, "uuid": "d473becb-bf4a-44ff-b6d7-e240f460e9aa", "comment": "Malware payload (AgentTesla)", "value": "d6c81069f8763d1bb3ee317188270f97b60271b52ab35bd92080dde6913ad2e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309587, "uuid": "f6254481-911d-41ca-ab52-8ac65d8edd2a", "comment": "Malware payload (AgentTesla)", "value": "8300a46dfed9c430f80a4be46c23460d5e328544", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309587, "uuid": "0bfb0b00-631a-4786-8ecb-74a94d046023", "comment": "Malware payload (AgentTesla)", "value": "581b9d5e2410d081f7023641516bc63c1f08fcae7d9c3bd664b57005d47872477537ca9c795b8913cf9c346df9de22de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309587, "uuid": "36aef37f-516c-4ec5-92c2-b850866b266d", "value": "T12815BE5BF254A86ED8BBE770DD46BC54E831B0727212B11B75DBC09847ADAF28B001E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309587, "uuid": "e43b8f8c-4081-4f1a-8890-e904e60f06ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309587, "uuid": "39c10e70-e232-4777-aa0c-cc4c76f6133a", "value": "12288:Qe3yguQ3qyTdKxdVQaBFI9PkOYwbvfbOHS2NajIpFum/AQFSKeqb4Gu1ddrYGS1S:Qe3UqxTIxUbR9bvyyIYIpFP/AMSfqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309587, "uuid": "e1c08acd-9198-4ee8-8c0b-0c62f4283a27", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309587, "uuid": "e291754e-8008-4d21-969b-547b3ce3bfdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309587, "uuid": "b6f094cf-20e1-427f-ad60-2bd00272e0be", "value": "Dhl despacho 7348255142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe3dd78-bd66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678248291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248291, "uuid": "bee665ff-17af-4853-870d-5c30ca82b516", "comment": "Malware payload (Mirai)", "value": "0a6bd381ed7618a105f9f4c8a910a3e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248291, "uuid": "9452de1a-9987-49b7-a11c-074b9f667100", "comment": "Malware payload (Mirai)", "value": "d7eb49843dc0216c3fc73b6544d88ab6d75ffc34126a0f0d2480c6eccff09577", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248291, "uuid": "47dc07da-90db-4c95-bcf5-e57ac610674d", "comment": "Malware payload (Mirai)", "value": "5c85de70126f23e311b22227c9bb3066fc0a52f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678248291, "uuid": "192c953c-ba2a-40b0-8a0b-2950baf717e9", "comment": "Malware payload (Mirai)", "value": "546b58b76f570e4b4debe6051daa502b93c8fe8a2200fb5101f6febfc18060b8a9c02016c956801d1da62396c14fea56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248291, "uuid": "4d864819-d5ef-4ae0-af92-0caa19f441bb", "value": "T16C83C606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248291, "uuid": "4829f47e-56da-474d-a7ae-6d86ee1efaac", "value": "1536:iVLyudpKLMkj752dCuouFf8EZlDgfkJ40YPWw:iVLyMwxFejouJFDdOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678248291, "uuid": "e35ac969-72f9-4d1c-a90f-d45f36699ba7", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678248291, "uuid": "93b6180b-296e-4f3d-acaa-0d2d71685b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678248291, "uuid": "7473ddfb-1a82-40f0-b9a9-0035af54b1ea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e021c3b-bdb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678282540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282540, "uuid": "18e817c1-a0a4-47ad-8d73-f7e0601b4bfb", "comment": "Malware payload (Fabookie)", "value": "0f1f4ce03d9bacf600abf05b4c1d6817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282540, "uuid": "deceac74-9d2e-4fe8-9b87-6c6c6e784d52", "comment": "Malware payload (Fabookie)", "value": "d82f2c9c923a145c7d4608be1f9ba982ea4ff937b145634fe4f8c338211cdb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282540, "uuid": "98c327b4-6e1b-44d0-b9bf-d6d1098ffb7d", "comment": "Malware payload (Fabookie)", "value": "a4ac2d7e45de6795aac322354278acc855489fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678282540, "uuid": "69227a50-f606-4da5-a7bb-c03ebe3ef91a", "comment": "Malware payload (Fabookie)", "value": "16e9be3f71575720022defd41d48f20cf3ca8314ffa4e0c99ae698a06bb62977a4ecb61051739756526b351e7c659071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282540, "uuid": "d553759a-788c-4580-970b-7fc6e646970b", "value": "T1F6A41819FBB448E0C196C635CDBE827BE272BD830A15930B4255FF9E3FF351069A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282540, "uuid": "a595adff-f0af-49d0-b4f0-9b26ad16b400", "value": "7bae02ef14998d8530ddf0278301170f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282540, "uuid": "86f9048b-c449-454f-b476-529492d7411e", "value": "6144:C8aMyDtA083XIMxEZ/mRfhTp+e5t5kkUgRGerEhgVIXFML:C5GIuEZ/mce5ZaerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678282540, "uuid": "677b53eb-f08c-4a37-8027-c346501246c0", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678282540, "uuid": "23967b76-b6a8-4597-a1d6-9d0304a887d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678282540, "uuid": "997c8bae-e6d0-4f94-83e7-d738bebde84e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a43de3-bd5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678244440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244440, "uuid": "250efdf6-ffbe-4a6f-bf4b-5cf9b0520784", "comment": "Malware payload (Amadey)", "value": "935ec4f614b803c6a7e3b5679c47fbf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244440, "uuid": "5cf6f028-2e16-4346-947c-6de43092041e", "comment": "Malware payload (Amadey)", "value": "d84eb267d5e3ea8ba6376602099f45112134bc0d4cca96c0ea2d89c5e84f71ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244440, "uuid": "251ca0b3-70cc-410e-b728-0b9759c070fa", "comment": "Malware payload (Amadey)", "value": "13934ca172f9621a7e33efe43dbf6444e7a6e74f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678244440, "uuid": "d13c16f7-5da2-47d6-adce-e8736aa4cdb1", "comment": "Malware payload (Amadey)", "value": "379e5a50830695e7338ceb5fa4ffb5fd232cea3ea9d03a65f79c5d2c17bcfb0df1dbb13f0e37b337bc90f27c3ec4c0b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244440, "uuid": "0974bc40-c609-4fa5-8830-f1aa36549454", "value": "T1DF74E12A35F0C0B2D44B14344928DAF49E7EB8319A64B2D733941ABE5E303D19F7B766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244440, "uuid": "ec0f5eba-3bb7-43b0-ae79-17e0b4cefea2", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244440, "uuid": "51240109-9982-40d8-a9e9-2761ae492e34", "value": "6144:mO/djLXieoWqsvemVN2rTluKnRFD5WP8HOgJ/:zDieXq2pGrTUKnRFD5WPkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678244440, "uuid": "50383710-e7c1-4027-9eaf-e48e0deec563", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678244440, "uuid": "48101906-81c2-4e5e-a34a-ada264ecb9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678244440, "uuid": "b5651d3d-e17b-4491-8c82-65741e355e12", "value": "935ec4f614b803c6a7e3b5679c47fbf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d71323f-bd87-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678262406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262406, "uuid": "34166f5c-1f54-47ac-8612-743c9127fb86", "comment": "Malware payload (GuLoader)", "value": "9f5281ee89c4b97b98c6407043cded58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262406, "uuid": "cceb4b76-6557-409d-bbea-fcc613c223f0", "comment": "Malware payload (GuLoader)", "value": "d860bf7396b8df9d0860745da807dc1c8bfc30ff2ee171585d43c764bddd8a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262406, "uuid": "2de8348d-ecac-4581-b527-5b3294ed93b6", "comment": "Malware payload (GuLoader)", "value": "cca153d52d4881dde89bed3bcd3601af6a74c3fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262406, "uuid": "77fc6093-117f-45f4-a2da-5d99795c651b", "comment": "Malware payload (GuLoader)", "value": "5463fe352b9805e8f0123a9f7d7fc7177d6bde5bfb2bad6ed99e1f20c252a7762dd85b8453d735d06c07dc2c19110cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262406, "uuid": "1c782f22-7cf1-44c4-a93a-f9d64139454c", "value": "T1DD94F103E401C021D15E46B2E6470EF6837AAFF9A1604D5637D8BF05BD78781A89EE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262406, "uuid": "5c2de2f6-60a4-461c-bee3-93a905eb3dc8", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262406, "uuid": "3dc8b5d7-f06f-4725-8fd9-c9f0fcd2a1e2", "value": "6144:7bUTp15lOVWR4vFSf0002ZOsWPiEiX/gmAfW8pzCLv3oNXtgWiNukM+xI:7IJlsW8200kPKIxW0+jTWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262406, "uuid": "2c40f96a-3c1f-4a3a-9fef-1d7dd5e90186", "value": 438760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262406, "uuid": "820887b5-4556-4a96-956c-71dc77bff69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262406, "uuid": "3477f235-f8d9-4f2f-a107-5d7ecc60713c", "value": "NP_0000033753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde3430d-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678259723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259723, "uuid": "5ced5fbb-511d-4f77-875b-550bad5ed572", "comment": "Malware payload (RedLineStealer)", "value": "0881c81ce62cc3b0c5cfd05f6575cfac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259723, "uuid": "5bc72abe-04b4-47c5-8c47-4af3c232a4ff", "comment": "Malware payload (RedLineStealer)", "value": "da67b579a79711316bea01386826c26dd956ce8cf31695d7391a243a7588143a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259723, "uuid": "ac4428db-fa9c-44a9-a233-15b0ebfe173e", "comment": "Malware payload (RedLineStealer)", "value": "ec064400af5eff282d8d4e0c6194483824ce40dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259723, "uuid": "941c646d-30a2-426a-be73-8d992ce73c06", "comment": "Malware payload (RedLineStealer)", "value": "f835d1f38f3032cfa8916ff2f5657412f33014e5328710003bb51d7af6c6cfe5ac0243177308c936c44f23d67bc1561e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259723, "uuid": "c7816330-97f0-4908-bc6c-5ccfdef151cd", "value": "T1A7F402136290ECE1E76A4B713E2ED6E4676DF0F04E5AEB6622384B1F09701E2C237315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259723, "uuid": "5e17f1be-79e4-40fc-a317-e4c60c73cce7", "value": "8f598b287bab54810f24d54c0484bbc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259723, "uuid": "8bb1e6dd-2956-43df-b97d-6ea1a18cae58", "value": "12288:YIaZfXo1M0sA4Txr3Y/rRBnpskUtw7z1iDyvvqSz8+0iRbGMWaSXOCQIPMN/P4Fw:uoMMWruBpB8w7zL3J8oh0yIPMlsAjmru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259723, "uuid": "917d63e8-bde2-46b4-a55e-2481cf8bb722", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259723, "uuid": "65e824a4-9b11-4e76-820d-bd7799cd5ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259723, "uuid": "838dcece-a998-4533-8171-1cf3a5707d55", "value": "0881c81ce62cc3b0c5cfd05f6575cfac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d207924-bd98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678269815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269815, "uuid": "aa77e086-7361-4202-868e-ea684b8a9323", "comment": "Malware payload", "value": "64d5a984c5d0fd74b729be5b52c00389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269815, "uuid": "7c2693d4-eb3a-4220-83c9-2a7d5c754679", "comment": "Malware payload", "value": "daba6aa332fac84534abce432c65388b1be0b2eb5cb19ac9220d519136a343d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269815, "uuid": "6ac7fa3e-15f8-4f63-bf04-4fad6063f28e", "comment": "Malware payload", "value": "4c5478bd5fd7b58b9c89cbf375ef0005f6807e2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269815, "uuid": "30a32ccd-76b1-49d2-ae2a-1470553ef17e", "comment": "Malware payload", "value": "c798ca61b099fc2c2291cd79eb23a9ad4323e016efcdb38a25ea7cb4e472ace6541fd53e14c93f2622da518cb1d8d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269815, "uuid": "79e6aac7-4730-4f19-8e68-a59a04da4043", "value": "T1F9E39210B0DB8231D5621C328DFA7A58B738A6200F774BDB378C25796E2429CF5F9997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269815, "uuid": "c2d7350a-a14b-40e6-9c7b-8c5257bcd3b7", "value": "33e645581b5122535b79c7155fc4d138", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269815, "uuid": "85642ecb-438c-4929-b426-86b5e06d82af", "value": "3072:JeNBJK/n4QA8UTemqn0MrWGeogELKibPKZ9zW2dWFMh0khBYGCw92jqsFM8At6:JeOYZw2dBkk9sa8A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269815, "uuid": "f6d1c1bf-ff08-4d24-b50c-07531aa25150", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269815, "uuid": "4c67b2f3-13f9-4234-9456-f5cdce88d185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269815, "uuid": "209f8ef2-2b41-4328-a94d-b56750786469", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a845e2d-bdc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678287661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287661, "uuid": "318a8c0c-e868-4501-866b-a420a9e0a7f5", "comment": "Malware payload (GCleaner)", "value": "0b58b97488ac17f7aa80c4581966782d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287661, "uuid": "1a4a7bd6-837d-43aa-aacf-dd6c0c94fbde", "comment": "Malware payload (GCleaner)", "value": "dac1de6b2503baa1e80b0c90555aa87b663cd6a8e57651c97aae775defbe8f29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287661, "uuid": "546042e5-af48-461d-a8dc-dcc66ab9365b", "comment": "Malware payload (GCleaner)", "value": "d8fc50d1115b21fb3c02311c08ef651cd2808a2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678287661, "uuid": "45217596-ec05-4ac7-b645-b315f4032d60", "comment": "Malware payload (GCleaner)", "value": "619421fe048a5fc0ae02270d35f3cda0a2eb72fff0dfc7cf8757ee0b8c416bc3d173e3bf1464d21ff680bcc67846771f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287661, "uuid": "441e8cad-ddac-4c42-bde3-4aa0c97d270d", "value": "T19744C01197E0BC25E6625A315E3EF2E42A2FFC915D2BEADA23283A1F0D711D1C563713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287661, "uuid": "83a6643b-6387-4eaa-b5fc-04434227f633", "value": "4f4daab76687771b70451dd07468ed63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287661, "uuid": "f0a15225-eeb7-497e-a26c-7011f10f649b", "value": "6144:ZSpkt9lfdyRqKoFrWvzpjhLY/qM8Q50/OP3Xp6Z/ofA:ZWkbpdyRqKvvzhhLkqM8lO5Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678287661, "uuid": "31c00d51-3e22-4af9-a60b-ff86da180660", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678287661, "uuid": "53d57c34-a97b-46cd-a032-ee881c258377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678287661, "uuid": "6c3f66dd-8945-4507-aaad-52b6d0268a4d", "value": "0b58b97488ac17f7aa80c4581966782d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7bae39-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678285948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285948, "uuid": "c3c4a258-843a-4b08-bbc7-d9e9d890b1bf", "comment": "Malware payload", "value": "e1dec890508c89a8f468db0cff684f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285948, "uuid": "94291299-d947-4ee8-8941-8ab7e51b7860", "comment": "Malware payload", "value": "dad4e4cbfbe903daee025826a3816a4fb74bddd50d5e0038f928c16b2e99502f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285948, "uuid": "7fea5573-01f6-4f64-9f97-0a824febb950", "comment": "Malware payload", "value": "7a0f9d861eaa55a8c1f5c7c0fffe421ef89ff652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285948, "uuid": "6a7fd421-d0d0-4b9a-9a89-30dfd6caf3cf", "comment": "Malware payload", "value": "a14269dc775b40c7c29ceb89d4543725c5c35a023f638e5bffd23e07ebe64f843c33ca24a8d889696d9d23ce0aad0840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285948, "uuid": "614ccc1b-8588-4709-8689-058a0d6a79f0", "value": "T14544010235A1C563E86209711DB9DAFB2EE1BE058E024A4B37D0BF5FB5721C1E81F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285948, "uuid": "2190300b-86fa-4238-8f5a-b2cfe341bed9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285948, "uuid": "304c0c71-4cf4-4322-9ec2-a9e05dcb48eb", "value": "6144:gYa6+YxKBm16Bj9lWAbkKXVa9S02ZVh2Qs/cEpeXzhdGZbghHrOSm:gYI7maj9tk9Svu/cW0zhsKhFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285948, "uuid": "28caa2f7-cfc8-4623-93b3-6c6c8cdd834d", "value": 269593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285948, "uuid": "c461b36b-1043-4bed-aea1-7b9764bead93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285948, "uuid": "28f23472-6692-499d-b5e5-18120a1caa1b", "value": "hansborja2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009631c0-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cerber)", "timestamp": 1678289792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289792, "uuid": "db2951ab-f1ea-428b-9b88-d14c8578b892", "comment": "Malware payload (Cerber)", "value": "73edf11e61fcd4446cd6c9dc3dab1a76", "object_relation": "md5", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289792, "uuid": "a450b01d-8c61-4033-9c5c-920d932b0316", "comment": "Malware payload (Cerber)", "value": "db47addc5d20966badd482543d67e70a1ef5e719a2c907e80bc1d3a9080c22d4", "object_relation": "sha256", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289792, "uuid": "82a91dc9-4ec1-4de9-ab96-6d0cb029a586", "comment": "Malware payload (Cerber)", "value": "93c73a193fd8940eb194c8c2eb31d37f7abc5812", "object_relation": "sha1", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289792, "uuid": "e0ef4b12-5212-4b17-b2d5-8febe1154a01", "comment": "Malware payload (Cerber)", "value": "afae0777fea8ba3efc7e71137d594dc2b24900690bbba0e3f76723f2b66733b9a61c8e62a75db2d3e489ac37035b7b1b", "object_relation": "sha3-384", "Tag": [ { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289792, "uuid": "bfc82060-a99a-486d-9305-2f80eec542ce", "value": "T15545BF53BAE16033D5E61DB1A3759DB2C7BBFC351D76811B935806090EB0A82E93B387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289792, "uuid": "c926509d-8f80-482c-accf-37c0d5f0ceb9", "value": "ae80b4ecb14ba8e602aaba0e2180c87d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289792, "uuid": "75dbd855-4a3f-45b9-8b00-61d4a1503582", "value": "3072:p+PkbTWYtBzNgnbRh6JuB/ffDkjjdqxEIeeD91+UB77:As2cBCbRdB/ffDkjXIjRx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289792, "uuid": "bb8938f7-1144-4bab-ba59-c43af3190a8f", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289792, "uuid": "0a9cce97-78b3-4164-b9c4-c04c02425dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289792, "uuid": "760f5766-43c7-4e5a-91dc-b32cf412e73b", "value": "2023-03-07_73edf11e61fcd4446cd6c9dc3dab1a76_cerber", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287abd6f-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678307468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307468, "uuid": "a2095b7c-75da-4baf-bdbe-91014d656c47", "comment": "Malware payload (RedLineStealer)", "value": "04470d4da868648287ebb3669b0cf749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307468, "uuid": "1e7ee657-a7c5-4242-93b9-144f3a466315", "comment": "Malware payload (RedLineStealer)", "value": "dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307468, "uuid": "b2106026-cc7e-46ea-983d-5ff8b6ca14cf", "comment": "Malware payload (RedLineStealer)", "value": "769a18362f774c73b7b28b94befeb8fb202fc6c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307468, "uuid": "a21757ee-5f24-4a26-9a32-c997819eea47", "comment": "Malware payload (RedLineStealer)", "value": "2a428d4fee5d3b42114adf9beda8ccfcb8b2479fb54ab928f673a4e33d1fb9f78b18a0b4e02ba2a8b67668c73b81e0d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307468, "uuid": "9bf9170f-ad81-4884-a6a0-39a970ddf269", "value": "T1EF65E0045976D938C1B60C34DE2B5BEB234A29FA15A88D727395DABC3DB1E23045BD3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307468, "uuid": "30cdb35e-a1ce-4521-8032-41716e385d21", "value": "caf9bf1d191236de3d7b150ac6f71de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307468, "uuid": "6be0909a-ccfa-4907-bc80-afb44e1d46c8", "value": "24576:W9qjb+9R49lDm0g+JO82Zj+fugNGKu8qpuGA2zxeqp7V3VU6rpUUlUI+NY5L12+0:Webwy9NdI82Zj+f7kKpuW2VRZ+Qw+1VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307468, "uuid": "079301fb-ca5b-4eb6-8d06-be063ad13ec4", "value": 1486752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307468, "uuid": "d13a8e05-2dc9-4f41-a3ce-f3b14039c219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307468, "uuid": "6f5d3e97-bfcf-4980-968c-b3e6699f1b81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7146881e-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289981, "uuid": "ef8fa35b-8d0b-4a53-814a-2e93531f0723", "comment": "Malware payload (GandCrab)", "value": "43279d555fe16a3801ed11ea12c69d03", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289981, "uuid": "361bd099-8d36-4a72-b29e-744ef6c56c11", "comment": "Malware payload (GandCrab)", "value": "dbfcb422012cb79f704a4d74430c2af0324ac63ea881b6e710a5a4228e7bd4a1", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289981, "uuid": "0aa3c976-5a28-491c-be21-a86d20546229", "comment": "Malware payload (GandCrab)", "value": "f369326ecc84e5208e933a3d8ff553f7db76edbf", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289981, "uuid": "9ebab208-062a-4ac5-939f-90a408049b60", "comment": "Malware payload (GandCrab)", "value": "2822338cb867b861ab30708f9cbd3d3d22c60836449bf2cb432be50d00bcc61887e868fc86026794a7e110343cb09a52", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289981, "uuid": "cacf64d8-20ea-492d-99e9-b009563fd73d", "value": "T1DA636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289981, "uuid": "496176b1-5db4-4127-8dd8-8dd9e0ebbbc1", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289981, "uuid": "f207170e-acc1-48ff-87d1-39b2afd803a4", "value": "1536:sZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:zd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289981, "uuid": "418e1cfc-fe0c-459c-85df-61eb2cf271f3", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289981, "uuid": "2744b83d-e854-46db-a14b-410354c6d8fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289981, "uuid": "35c241d1-9b97-4785-937f-56ea50137d88", "value": "2023-03-07_43279d555fe16a3801ed11ea12c69d03_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a69a68-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678309077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309077, "uuid": "b64a56b5-d803-4374-a8b2-b2481f9ecb4e", "comment": "Malware payload (RemcosRAT)", "value": "1acf4aad8f394d00a6ef18b3eeb22fb3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309077, "uuid": "34e61696-6856-4e07-93e3-503a8590828e", "comment": "Malware payload (RemcosRAT)", "value": "dbff2962edf7cd5f9ba3da91225a6c7b9db536afbeef348e87e7afc1669b4861", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309077, "uuid": "a41e6f3e-a6c9-4cb5-9633-9aa30846face", "comment": "Malware payload (RemcosRAT)", "value": "1d6ce0835726310a3b90da55123c89d9ae30b7db", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309077, "uuid": "c155ebd5-4e6f-49c0-b31a-988f5ab7365c", "comment": "Malware payload (RemcosRAT)", "value": "be4b17d246111e1ec857d27067c9cfc707c180bef8fe8dba1ef2f9eb54522dcd081b06dd0ecba722cab425e3b3414f47", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309077, "uuid": "18c6f775-3561-4525-9e9b-8df1b66f7f2d", "value": "T17255F10392389D4AD112C7BCBA6F755A010E7C3671C1A4CA364DB74B5733FAA5ABF218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309077, "uuid": "267ca062-7812-4944-aaf9-c794e9d52f7b", "value": "24576:lLKsjBxtHlx4WQmmav30x8BFmtHlxnWQmmav30xh6WeaDP0J4rG:lLKsjF7NQmmQ30GnE7WQmmQ30/6YS4rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309077, "uuid": "c8f314ba-9ae0-41f7-80ec-19e4ba162840", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309077, "uuid": "ce350514-df3b-4d8d-8c07-e42c742b4350", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309077, "uuid": "f7590b59-7d1a-46e1-b12f-2d31ffdfd8ad", "value": "New Order Match 2023SI33490 .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c188d04-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678309139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309139, "uuid": "e97c7e83-8086-495e-85d5-8eddb82b1f72", "comment": "Malware payload (DCRat)", "value": "083a6aec584ba687a307c97bb7acb24e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309139, "uuid": "ccbe9380-7ff1-45da-b293-b6a408f14a23", "comment": "Malware payload (DCRat)", "value": "dc1cbc2ecf71eaecc8488f11a01ace7e24bfbaca1ca060be5ec5cb1d3544a094", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309139, "uuid": "17c3632a-508c-4e1a-b125-77e8b53143d3", "comment": "Malware payload (DCRat)", "value": "01d4da6b7f9b3482756ffd9d53624eb2c08afffd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309139, "uuid": "85ed5ebd-a4b6-455e-b690-5acfd0f24ba6", "comment": "Malware payload (DCRat)", "value": "a87f96358027155b99510dc4b1f38f3e0d26dd5501ce07721e707502e2553fa67cc8628ecf854d439adc0fb5af46602e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309139, "uuid": "49e61af9-c310-4216-874a-8d6a1f7e8d5c", "value": "T19A540A2439FB501DF3B3EEA65FE8B9AF9A1EF673270B64A9106003464712941DDC2739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309139, "uuid": "64f77f8c-b10e-4dff-a2e0-7d2e78843253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309139, "uuid": "69868f38-cc50-4804-9259-c4ff8fbc6e50", "value": "6144:6ogs498Ny2jMmk9pLYXIebRcmqiMO/Bt6ohQsZR/9ZBO6ep0I0pN:6ogs498Ny2jMmkzLYvbRcuMO/BtHep0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309139, "uuid": "7faf1181-3f40-430f-a8e7-85e8384b58ac", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309139, "uuid": "763837ff-af27-443e-aea1-cb09b3e54bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309139, "uuid": "40fb20a9-e4ef-4591-9835-2e1e23765263", "value": "083a6aec584ba687a307c97bb7acb24e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0afdd2-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309086, "uuid": "9decaeda-21be-426b-b9c6-42c69f18786c", "comment": "Malware payload", "value": "de5e36fbe8c1c159d7bb294233de2ca9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309086, "uuid": "0eb67cf8-710a-46ee-a24f-9022254289b7", "comment": "Malware payload", "value": "dc7cc79ffff2276f35bfb22d6c90a3a5ff5084f1f223e067a931a4a2c04b5363", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309086, "uuid": "41c38f48-8b13-4cb5-8b45-cff5f3e918d9", "comment": "Malware payload", "value": "9a64841182b71373665713b5a70b6856ecaa2828", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309086, "uuid": "a61962b4-fd5f-4087-b05c-82d078afd063", "comment": "Malware payload", "value": "3f2a30e7d5f5c735a1c641d036fed2692cbcc866f60c7418ffc010bc4c8df4319e0e35b19e0b148c7175c4c0edb77fd2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309086, "uuid": "9a4c81cb-e9d6-4631-b2eb-21ef711aaca5", "value": "T18CB4120536D1DF0BC20318B90CD5E6A78776FC456F22D24B32B6BB5F29B5B990072B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309086, "uuid": "0e65d8ed-a362-4c2b-82e4-24992a952e7a", "value": "12288:2IH7Zonp36rHXHBWXHSLOO+j6AgVgEx86X/vBlUs:2Ib6n16r3BA3RjOnD/Jes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309086, "uuid": "50c70ff5-1d44-4977-bc33-ec0f156a2995", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309086, "uuid": "5892e497-23b8-4eb6-9b57-a04ae6c576cf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309086, "uuid": "4ced5c5f-a799-4c61-b0c8-33ddb755f0ea", "value": "REQUEST FOR QUOTE - AJAX Quote for tende.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4cda48-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299099, "uuid": "6c23995f-e700-411a-92d8-9316f3a05e38", "comment": "Malware payload (Mirai)", "value": "04ab14ce8b7eb3adbbed412ab81632a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299099, "uuid": "e52071b9-d41d-4084-8801-a52854b14a62", "comment": "Malware payload (Mirai)", "value": "dc9a87642d6c9efb792b3a7e08ff30527b460b97b53096a16087d5ef729751ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299099, "uuid": "f58f0656-6e8a-4e44-ae52-430c4c1b0eda", "comment": "Malware payload (Mirai)", "value": "0a1383d3192ee9e34ad23d95222c97b1c5855002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299099, "uuid": "0daa5d68-5561-4dc3-851e-151583fc9090", "comment": "Malware payload (Mirai)", "value": "b53bc3faf6a5497eb9bb397b6608dac5742eef37730cb1aa6bd3d20871d37a55addcd9089c6372e1f2a24e38f1e6eec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299099, "uuid": "5ff19cbd-f6ce-4034-b009-100ef5e12e59", "value": "T10E632931BA761E17C0D1947621E75B25B2F143CA26ECCA0A3DB20E9EFF71A406547AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299099, "uuid": "2a17a298-8f9c-4b43-8ece-8b48c4515ee8", "value": "1536:iYvqsVRaNq4rgepRwXgOeNL6QCb375ci9vtFtM5B:iCqh4x3ggb3VcuiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299099, "uuid": "86b41332-c61b-48e8-b9f4-6d832747fe76", "value": 67272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299099, "uuid": "77b0b299-f39f-4116-bc7f-fb73bbdf3c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299099, "uuid": "00888e4e-5687-488e-9c73-c3c5a46cc934", "value": "04ab14ce8b7eb3adbbed412ab81632a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5192f1cd-bdb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678280479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280479, "uuid": "9ea11fd1-92cb-499b-9f19-fe8aa50b4075", "comment": "Malware payload (SnakeKeylogger)", "value": "e0e497c2b1f8cfa0805de272f2f7d162", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280479, "uuid": "a272ac5f-d67f-4448-aec9-95e0b4185fe2", "comment": "Malware payload (SnakeKeylogger)", "value": "dd4622f9700567fdf92c4710ac0bd4bb44edab73aec5f40339c6160b6bff1de5", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280479, "uuid": "0b17b05b-91bf-4b1d-a91d-418d3993f5cb", "comment": "Malware payload (SnakeKeylogger)", "value": "4bcaf067b3fab4e2212e5f078081276cf2d5f7fa", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280479, "uuid": "59305887-058e-452a-b01a-c82161acc054", "comment": "Malware payload (SnakeKeylogger)", "value": "8df75b5076d7ddaf94204ff5c07101ed388902b79936b9044e7c936fafe784c8f760091abfa09cb265d85801ead91cfb", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280479, "uuid": "c98971e5-e680-43a9-b6fe-af21ba13f606", "value": "T152E423019BAEFA7F73E49B311555676C18D3A94A6AA3778B7B40A1FC00B34D43F32164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280479, "uuid": "2f323976-38ba-4ef5-b525-9a83045c811d", "value": "12288:raM/+8NXD1hkNfyJFslSWPL5XwJ4Q2U+jWMW39q0ybYqpgt/31ZHvETo8nPia8Rg:JTyK8hFAJZ2/WMqqRMqpgt31doAjPJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678280479, "uuid": "10ffbef4-0735-4ecb-b2b2-913b057ec959", "value": 668356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678280479, "uuid": "626a1aad-239a-4ba7-bd71-894e0e0fef36", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280479, "uuid": "d6e140fb-74a5-4eac-9199-30be548e1b78", "value": "Original Shipping documents.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb3a406-bdcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678293574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293574, "uuid": "40ca0e42-003f-4091-9d34-f020463b74dc", "comment": "Malware payload", "value": "538dab51e58b7dd3809664982f4d0746", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293574, "uuid": "e666ebbf-1fb8-4220-a889-26e891287dee", "comment": "Malware payload", "value": "dd49948e0b3393a8b53084075ec2f2a8c36813d1ba1ca538697eb62ec4b4deae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293574, "uuid": "3b185965-8cee-4b17-ad25-5ee34f0ff39e", "comment": "Malware payload", "value": "4e7f9615f1d96b087c453a72217662f867e0520d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293574, "uuid": "6db37c83-d775-4450-8a13-8275ac8b4748", "comment": "Malware payload", "value": "103e88f120c48bbf5704d71f9dfa43dbbf89aab2a41ac6d4a26c3748c8d3c7628b0ad08331c67698bf72110231800d6b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293574, "uuid": "0becd433-60be-48ac-a9b3-d96fbe850652", "value": "T14A339E192F9BC13FC6AE09795491220812B5D39EB623E74F2CDC417DA7177E30AD19A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293574, "uuid": "b3bba3ae-815f-41ae-abf8-fc06008884cb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293574, "uuid": "113dcaf1-dc97-4332-99cf-9f8264d023da", "value": "768:w5xITN+zx5l0s0VTO6QMm2TzdaGzNQBIKko8H4F9XZGT1B+PKg0gu7Scxqlc3TQE:wMh+W1O6QsNQBIKKSJGyPeqlcjQy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293574, "uuid": "5486b9fd-4ad4-42f0-b630-1b928565b2e2", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293574, "uuid": "c3b40313-7d69-4281-80c6-4781bac00a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293574, "uuid": "9052d64b-6544-4585-986d-69592d960ff9", "value": "C2200.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44645e19-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308374, "uuid": "0675ef4b-a0a9-49ef-af41-2c45ffa862b4", "comment": "Malware payload (SnakeKeylogger)", "value": "8d9f3f454adc853be7723be13ea2af58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308374, "uuid": "230af299-9fc0-4f98-8759-3078d50022d6", "comment": "Malware payload (SnakeKeylogger)", "value": "de2db4ad2a134f1a53cb3e969c84c84e9b9558db5509f632e917a959a0656d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308374, "uuid": "7d31c125-1afa-417d-905f-b18d59392f7e", "comment": "Malware payload (SnakeKeylogger)", "value": "33ed703cbbb88a3fb2db924691e3263b4dd0514a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308374, "uuid": "bd34172f-99c4-455c-a4cf-c9c7ab853fb8", "comment": "Malware payload (SnakeKeylogger)", "value": "0673d1ff18ed8f0fdbee2b9b4c16b11af5bc2dd8e792f156f0d824ec118d8ff665731f813620c29aab5ace8c1ad7f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308374, "uuid": "8bd609bd-8943-4714-9dbb-95039cca1443", "value": "T1B105CF9573B19423FD8F41BA192BE29D2D7171037355E23B5B7B3AE1D2016BFB288602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308374, "uuid": "f34dc03b-27a5-4d25-a0e0-539203bb2a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308374, "uuid": "092831e3-8b26-46d2-960c-4d6b961b6480", "value": "24576:Da/5u61t2AVWPOdD4MgTkZ3SiiTOoV7t:soORPgoxSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308374, "uuid": "2236b2a5-39c5-49df-9fd4-90a03f165e2c", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308374, "uuid": "e79274d4-40c6-48fb-bfbc-a83e03d5261b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308374, "uuid": "01bb62dd-7b11-4957-b4ef-902c01f481d9", "value": "8d9f3f454adc853be7723be13ea2af58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3bb7ab-bdb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678281919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281919, "uuid": "a127d09a-f542-440b-aaff-221ebdbb4b57", "comment": "Malware payload (RedLineStealer)", "value": "84c0c84b5085b751bf950f3cab6e4d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281919, "uuid": "572e67da-2a7d-4634-819b-b460f45db24e", "comment": "Malware payload (RedLineStealer)", "value": "e056797b8ff24bc2be4c785c55d0e40a9e4c235ef1424741f9f29b0c28a81344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281919, "uuid": "65218649-764b-421a-b783-4f8be5fcfff0", "comment": "Malware payload (RedLineStealer)", "value": "c734b54b6a8c6c08dad200819effe01ff0c90805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678281919, "uuid": "518a6ef1-d84f-47e6-bf98-b85dc61d59ae", "comment": "Malware payload (RedLineStealer)", "value": "a5938fe10a7fb6fca3cfb01dd91dce066899a76a1ec372f0fe00d130816ad197a9ec4b644aa73ab461718b5d048b1869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281919, "uuid": "8599a77b-a3cc-43e2-93d3-9defd6f844be", "value": "T1F065D012B9432F71FCA354B89DAAF34B09CDBBB197E10E490C5D8866DB67700E60785E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281919, "uuid": "94dc710e-057d-4bd0-97c3-2c4b97483abd", "value": "db00bc6cb1460fee2c49d106d7b852bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281919, "uuid": "422b5c21-d771-4aef-ae3d-c1c077652333", "value": "24576:+iNoZXZR84LGY+gSwCxeIrSwVkvXLFP8hX/LkzaXKrK0bU2TPjAzwzbqZATU5Rwn:4Xf84q1wmeI7VyXZikHHPLjaZAg5+xX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678281919, "uuid": "7c3fc7b6-5181-489d-8a3f-658521e804eb", "value": 1451928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678281919, "uuid": "fd414f6f-f11e-4e21-8dc5-d1fc617da833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678281919, "uuid": "9fce730c-9ca4-42a3-bfa0-451653536419", "value": "e056797b8ff24bc2be4c785c55d0e40a9e4c235ef1424741f9f29b0c28a81344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff325bf-bde1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678301334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301334, "uuid": "4ea03b59-9bee-449b-8e9a-6b3b5a35557a", "comment": "Malware payload", "value": "5578e52fc0e79378aa388d2bec416dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301334, "uuid": "70217576-f30d-4b3c-a7bf-20e7135756bd", "comment": "Malware payload", "value": "e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301334, "uuid": "67593f2c-0f12-445b-89fb-5054850a46a1", "comment": "Malware payload", "value": "3b2d671aefbc0bfc1dda68859f898ee4fd88c53f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301334, "uuid": "cc4d7904-9250-4cca-bcdd-c48e000ea446", "comment": "Malware payload", "value": "bde0bc2bcfd03fb70508922d878fc4a8002b111925654531f1e80eecdb4aae6f37708cf6827a283b07559d937e274722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301334, "uuid": "0fdf9ac5-04cc-41e7-a886-1015c29efa01", "value": "T19096333FB11216BFF3EA8B336B704AB9B6F8001A9521453F5410AF741695EF0D992A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301334, "uuid": "5c2cd3f8-0b8a-42d0-9201-8d36e589a061", "value": "196608:kVeacQyAVmTTrJm4R6y4toiyTq0GjA62O2QRcVC/ymgrjwPcJ:kVYAOTNtROs2Xm/WcVC/dEjwUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678301334, "uuid": "ffc7e0c3-91c4-4b8c-a928-5be70de08f88", "value": 9454469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678301334, "uuid": "05ba61d6-1da2-4daa-a425-fdcb7b2db1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301334, "uuid": "5f5d0fd8-7c75-498d-b5e6-a7195214cbc4", "value": "e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9b977e-bd4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678236935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236935, "uuid": "0e6585d8-32db-4423-9870-0a173f7e23a2", "comment": "Malware payload (RedLineStealer)", "value": "7ac1b120b61a0c34124b16bb21bf0c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236935, "uuid": "19e43163-e574-469c-a923-b558c6f903fc", "comment": "Malware payload (RedLineStealer)", "value": "e25693ec59119c37fd4ba4ac1f4e2d31d8b6fb6e8d52e3bd66961aa77753bfca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236935, "uuid": "b28cf6d1-017c-4064-a336-4624ebc6e174", "comment": "Malware payload (RedLineStealer)", "value": "de5994dd1ca8163c9e2e6644d45fbafcc186ac02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236935, "uuid": "97efe97b-8fdb-46f0-abf0-6df85b97732d", "comment": "Malware payload (RedLineStealer)", "value": "52a1ae7a716e9e0718e056f0a9951065c601645faf9af91d8cdbad11a86d4a8302f82046407572252d63ba4d1fc2eacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236935, "uuid": "d49336f5-71e3-4c6b-8d55-58b0e84502a2", "value": "T1F6749310B6CC1C7BF987D5782871AFB5DC8167AA0F0F548056F4A2CDABF0A7066A5387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236935, "uuid": "2ed94fb7-45c7-4b3e-8b0f-92b07d733d96", "value": "41a04f6766430316d963ac644ea1367e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236935, "uuid": "05d9d85b-4664-4cc5-9576-7dcfe2f9f0a1", "value": "6144:ot6GRIxHp8j7pip/Ygu38CLW+e6jARj+pR+:ocGRIVp8/pi5YgMrLWOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236935, "uuid": "793d264f-f525-47a0-9aef-f0dc1791c515", "value": 359032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236935, "uuid": "f0ead2a8-bef5-4b16-b6af-4ee0d22340b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236935, "uuid": "a2186949-8d11-4bcf-a297-51213c6ebf77", "value": "7ac1b120b61a0c34124b16bb21bf0c1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70f2f6e-bda2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678274314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274314, "uuid": "ee6cc4b8-f337-4afd-90ca-1ace8764cb62", "comment": "Malware payload (AgentTesla)", "value": "f18f393f95db091c7c6f1af6ad305c69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274314, "uuid": "5337c5f2-2d1c-49ff-b9cb-77c98cff5f78", "comment": "Malware payload (AgentTesla)", "value": "e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274314, "uuid": "f96f9f71-57c1-4acb-99f0-c59c153295b9", "comment": "Malware payload (AgentTesla)", "value": "7dc2471813dadf27d04dcd9155476f0a28ce0c06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274314, "uuid": "d65e9d95-d539-44a3-b229-8a3bf2097912", "comment": "Malware payload (AgentTesla)", "value": "9d005fe3bc1067439bac07057911571317a35e45691bb0e63f753e35f2047e3d5335d7f34d40251f11aeff71bf35e060", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274314, "uuid": "986e3ba6-bcce-4453-b7fc-7191beac8be7", "value": "T130F34968D6D59EC2D32C4074E4A01158CBB2D1069217EB9D1EA1ACF63F86BC7362FC67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274314, "uuid": "42bcd5e3-f377-4c4a-9992-836b87e99f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274314, "uuid": "fbce5c98-a73d-4e34-bcab-e08671bdf132", "value": "3072:s86DfuBqnpr1B+H8n2YbJlsznBmmxOOek2z1CFzygANpnA:AuBGvB48nPb/knB8R1gO5Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274314, "uuid": "082ba228-6972-40ce-813a-d3db63cf525c", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274314, "uuid": "176c340f-d373-4d6a-b077-c241333d1d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274314, "uuid": "42b2a96c-aa71-455e-93cc-f04dfb7b0b2b", "value": "e2e68b7e99d8253a02362747671cd1a55293166b771043a7bdb689f56331abc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf01f30-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678285035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285035, "uuid": "3004bd08-086b-45c3-a22a-9bc64579283c", "comment": "Malware payload (Mirai)", "value": "db51f6ee1c295cd0f5531e190dac3e28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285035, "uuid": "02d921e2-179d-432b-b021-d97a8c88ed87", "comment": "Malware payload (Mirai)", "value": "e4b54cedbe98b29516d1f1bad0e8e0a8d10357e9694c52d3ba7648e39d9f3a4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285035, "uuid": "f68a2e99-effb-46cb-b511-e03c8f924b00", "comment": "Malware payload (Mirai)", "value": "d3bb97c0621ccec35b50512e4cc3cbb6e5bf49da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285035, "uuid": "bc389876-8066-4857-ad67-7381d1d13581", "comment": "Malware payload (Mirai)", "value": "c6b405392011aa3f6e7a047fbb6b50f4b28028004047559fc682a27be3fae16ec5fc58bbda5aedee5953706aca294a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285035, "uuid": "5a901c5f-acc1-4957-871e-4d38064d5e62", "value": "T1C0B2CFADD4983884CE8D5C7E259E4B220E99A190BACF9F6EC3118DDD777EB4A3449070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285035, "uuid": "6b386c84-a341-4de9-9ca7-67cb73e6a77a", "value": "768:chrQlS07dEv0UXqUhvQE+CX7IaIgZz7kscZqaWvF:KQlS07FUXqIYSX7Io6qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285035, "uuid": "6e932a6a-b495-413e-a990-b8fb6fdc7fd2", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285035, "uuid": "6996622b-cfac-4e07-abbe-0adb595bb683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285035, "uuid": "1d1255d4-8c2b-46dc-b747-d7bf00191cd1", "value": "db51f6ee1c295cd0f5531e190dac3e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd12fd9-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678259719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259719, "uuid": "4a3c9d35-7427-4716-a5ff-9f8301c39de2", "comment": "Malware payload (RedLineStealer)", "value": "b85d611284314af33399474b0cefa495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259719, "uuid": "3252fc30-4f55-4de9-9c94-b59cc06b2fa8", "comment": "Malware payload (RedLineStealer)", "value": "e59ca3b68b66ebc9e0a7e47c38dbce2a1f1de6a48d9c151f4e1c3072d7da428c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259719, "uuid": "29fa4582-606c-4a5c-bbf2-dfcf15cfed1b", "comment": "Malware payload (RedLineStealer)", "value": "bdede99e6396ec193f593a6fabce3eb2df96b5a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259719, "uuid": "233fb7e6-f1c1-49d1-ae57-fe0060651fd1", "comment": "Malware payload (RedLineStealer)", "value": "77e895ff26dedb646a793aee93d1c12fbcd0f2be4a18d7373f10cc323ffbfc20650b0416c664037f121a91a7dc42fb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259719, "uuid": "c9d6fff3-0e3e-44cd-8536-2b5bc460b581", "value": "T115F4121266D0B850E6AB87B35E3EDAE4362EF5514F73AF5A21389B5F08301B2D573312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259719, "uuid": "8a2213fd-943c-4c6a-a80e-900e0b47f68a", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259719, "uuid": "5aa1f480-208e-4228-a601-2c4667342ada", "value": "12288:1EsDDeEPb4kscR5m/PYKuJUMuyrFE6DwbULNOIdRj430CYNWCunicLk3uz:wEPb4kmUTuyrXkgLby0CEHunikkez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259719, "uuid": "5df62fc7-6ba5-4d64-9546-a64f1d96ea5a", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259719, "uuid": "2318531d-d10a-40cb-8507-02f49a92d132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259719, "uuid": "ef4449d6-d19a-4055-9f66-3dac90e9e42d", "value": "b85d611284314af33399474b0cefa495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacc6ba7-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279394, "uuid": "26c927ad-4901-43f9-9dd8-6b907211d6a9", "comment": "Malware payload (Heodo)", "value": "8357e788f3f5758b0d5665050d27230e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279394, "uuid": "a1c342fd-5e12-4720-ac68-abc02897f713", "comment": "Malware payload (Heodo)", "value": "e5ec921fe0907d1a9fb51a532d116fca94f882128fe58b5f3eb1049704debdde", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279394, "uuid": "d3d80922-c1d4-4e64-9030-5121df0eb75c", "comment": "Malware payload (Heodo)", "value": "247ea7da59948607f8f6df5bd0327aaa39241d51", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279394, "uuid": "5e8683ee-1d06-4a11-8c7f-99ca979e9651", "comment": "Malware payload (Heodo)", "value": "ca07b9151240e87e8a48d30097cc87b1fc89886d6254d5e076ef8f26fdde34b29442d3d6a2f4d4d8c52e4eb9b14ba8a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279394, "uuid": "bc68dde9-d78f-457b-a665-e167eb15d024", "value": "T1B815233C6F67790FF5997C362AF3847AFDF9085CDC96A90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279394, "uuid": "b4c73817-5d85-4ab6-97b3-d3353ab66802", "value": "12288:24DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sB:RevtlkdJe4m19FgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279394, "uuid": "ef1b2ffc-e989-4e65-87b8-6c25cc910b5e", "value": 901157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279394, "uuid": "d897a12e-ce99-481b-839b-bf7d18e572af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279394, "uuid": "c45d0ccc-da1d-40e7-90f5-5ed6c45ac6d6", "value": "Njih11rdUw40.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33d2305-bd7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678257020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257020, "uuid": "ae0199e1-1d59-4e65-ba14-1fa6c1d6fefb", "comment": "Malware payload (Amadey)", "value": "906f7577992ba49c57c8e1e4f345b9fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257020, "uuid": "64292995-d4b6-41e7-8975-1aa7bff6bcce", "comment": "Malware payload (Amadey)", "value": "e6c6569a66256fc40bcbc3ded95a27998f5d1b0387f91099e9e97cdad4bdeecd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257020, "uuid": "492abb82-51cd-4f2f-8dc0-7f0fa6c0e9c1", "comment": "Malware payload (Amadey)", "value": "d817e6ef82dcc6acbfd122c2e3eebddc24243306", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678257020, "uuid": "f9d023fc-3215-4130-8790-ff0f44767697", "comment": "Malware payload (Amadey)", "value": "887f503e9fd852a4476fa97f78e08775c6deba5c81b9c34c1e95d6826da0ffc183ce0e2c83d83167563cdd76c1f50ce3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257020, "uuid": "78401496-be58-4aba-840d-80833e203976", "value": "T1FCF41217A6F97C51E67A0A715E3EDAE83A1EF2618E43A769223C8B5F15B01F0C173305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257020, "uuid": "096e2352-00cf-4874-995b-9ed4b11cd2e8", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257020, "uuid": "2cc4700a-2f8c-41cc-b3aa-18d0f6c74479", "value": "12288:FNZj3wKaxKRs1jLX+Mcd+c4huYBc0+Tj+4SWvC3sJMHsag60FUUZ/4Grxizao2uh:1UB1n7Iczc0QqSKC0sWUHt4HGEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678257020, "uuid": "1cb51e98-875b-46a4-a0ac-0ad2211af5d1", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678257020, "uuid": "30ca753c-eeb6-4a1f-8cef-e3937e0a43b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678257020, "uuid": "0d11ced6-6ac7-4877-89fe-5833ec49645c", "value": "906f7577992ba49c57c8e1e4f345b9fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1392bcd-bd87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678262708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262708, "uuid": "c7e7556e-6547-4c0c-b1f2-ca3a6a1803d7", "comment": "Malware payload (Formbook)", "value": "de6fac0fb353046f5dde13fbd84b6eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262708, "uuid": "29d1115c-2719-4e02-92cc-fff78ef10e99", "comment": "Malware payload (Formbook)", "value": "e6d190254a9da63d379fe136d687503b5b4f9eb34f1d45bb15bcca49aa92e79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262708, "uuid": "b14211f3-9f87-446a-8f73-fe67d630acc3", "comment": "Malware payload (Formbook)", "value": "fdefc11314b58160b39be60f4b2c554c6ad59e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262708, "uuid": "868115aa-0a24-40dc-a6d2-db8825b2b626", "comment": "Malware payload (Formbook)", "value": "aa3b662cae6f09ea475e5c0e558bc81b0cb7cc162f88ffd9f86aedae022f582e1189436c968ea7b479f82fa80c766e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262708, "uuid": "61111b4e-6587-452e-a859-57c4ec1ba2a7", "value": "T1A944125873E8D037E8B306701D3D2367BBF2B409A9258B2B6320AF4DBE51291D50A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262708, "uuid": "676f07b2-2420-4ef2-997e-d67bb35ff3ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262708, "uuid": "f667c353-a8ac-4ca1-bb6c-9564b30f354d", "value": "6144:/Ya6u9kip0fDXcHh3+taoPEgU+MzGyIXYyRXdNQwIWR5:/YA9kiafDMiPE4MzGNIyRXzZR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262708, "uuid": "b308c707-ab6b-41b4-9104-b78fe6c4fa98", "value": 255369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262708, "uuid": "34a507f8-bc95-42fa-a8b3-2d30231645cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262708, "uuid": "1df96c0e-aec0-4250-bf3c-82c40d609ae0", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fb2143-bda7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276104, "uuid": "94f2f061-fc0d-4be3-a308-dfde70763c4c", "comment": "Malware payload (AgentTesla)", "value": "40dfd8a32f6ad64b323a180966f42b7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276104, "uuid": "fe55e4bd-c6f7-49bb-b572-6534f24f167b", "comment": "Malware payload (AgentTesla)", "value": "e76fddcb9027c5217bf2933a5ff7f13d69a024ab3da4177e2b8a770bc0a0e5a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276104, "uuid": "2441f2fa-fdd6-442f-97fa-61d05d4ed001", "comment": "Malware payload (AgentTesla)", "value": "3000c54fac9ac4c00e6cfd4cf2501396241d3532", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276104, "uuid": "d270a750-4517-4b4e-86ba-c027b2df8c7e", "comment": "Malware payload (AgentTesla)", "value": "8bba4cb5743145e69c441add9807fd40082f89965a8070e1aa7e9857d82278d6e4fe413e1c4f2b1a2d53ce4839be298b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276104, "uuid": "34e82e92-970d-4bef-a911-f6605952124a", "value": "T112F3396892C98ED5C32F41F4C4F010582BB2D10E9217E7DD5EA1ACF63E467F3762A866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276104, "uuid": "6f375499-2368-4f9d-bc18-bc5fb9c8284f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276104, "uuid": "95f83e9e-6683-4a73-8875-9c51f0501e17", "value": "3072:UOMJuy89ctIZdyPd2ky+wXYZcfE7RTAXXqmTjjRd:UOMmc+8p/VThmTvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276104, "uuid": "df35e8b6-08a1-4896-9475-f1db71eb6841", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276104, "uuid": "c1c42b94-55a8-4688-bdfa-ea13beb9ccb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276104, "uuid": "ce319547-47e2-4563-b042-b9a5466a2ba7", "value": "e76fddcb9027c5217bf2933a5ff7f13d69a024ab3da4177e2b8a770bc0a0e5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bada63e2-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678263046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263046, "uuid": "c722d7b8-4279-47a9-8fec-1f47ce4dcda3", "comment": "Malware payload", "value": "0280da14a9c30f3a8fabc835cff76ff7", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263046, "uuid": "222d50e0-6b28-492f-a04b-b47d5f7386fa", "comment": "Malware payload", "value": "e7a224a7b64351a65ea657f2382500c5a5b6f52acb3771105f3f73ecd1245c40", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263046, "uuid": "c45d964e-acb6-4cad-98f5-66195b3e092b", "comment": "Malware payload", "value": "d545b4b433e69fcc8659e658e9d4d7cd9e279b2a", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263046, "uuid": "1dc77565-bf28-480a-8469-671776359310", "comment": "Malware payload", "value": "920b62bc9338ffeb66427762039ec317f41629e7af4d3a23dc841abd9cda249648950384924aad504c9224554731014d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263046, "uuid": "c22a4070-1d3e-4d28-9e35-09a5b5b17376", "value": "T1AD227D3CD611FD16C125047CE04582F1FB2D00A7E652BA3D2156729E4B616D387DFEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263046, "uuid": "eb4c7d77-f2b7-4050-9ae4-c7633a1883e2", "value": "192:ScIMmtP1aIG/bslPL++uOeml+CVWBXJC0c3Ze:SPXU/slT+LOemHkZC9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678263046, "uuid": "0428b4b4-2286-4b49-9b61-04ddf64e9c64", "value": 10404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678263046, "uuid": "d4039c85-92d2-4f92-bee8-5bed1559a47f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263046, "uuid": "c9950d18-2fcf-4166-830f-72b8b00e341e", "value": "TaxXinvoice.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5aba5b-bd48-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678235344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235344, "uuid": "c80215f9-43a3-43f9-ab7a-b2393158139a", "comment": "Malware payload (Mirai)", "value": "7fc0a07f169a253425f15c5a6c5b5448", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235344, "uuid": "8a765ee4-c43f-4146-a674-228c33f76294", "comment": "Malware payload (Mirai)", "value": "e8221c73335bae9b3eccaa2dec742cac154caed758c8208a83250c4d804365f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235344, "uuid": "ed2a4be2-c4f5-4c44-bf42-012691e54777", "comment": "Malware payload (Mirai)", "value": "ac79d68857f9f3e1b41544b35527e2dff83d764d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678235344, "uuid": "91c52534-27f3-4a7d-94da-7eb441909f1f", "comment": "Malware payload (Mirai)", "value": "7380daa821d1459204d4ddc09b33ffea562827caabba8f13cf8f724c95cd64be9cb88fedc6a2c02e65c52612a39f7d9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235344, "uuid": "f974b0c4-98e8-4881-90f2-ad5eee25859d", "value": "T179B2E04DB0883449C8CE3C7C258ECB324E9D5196B6DFDF6D53228CA8A76D90FB0091B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235344, "uuid": "67aea242-2c2f-4760-a6d9-cff755c5c05f", "value": "768:obrQlS07dEv0UXqUhvQE+CX9ZF2Yfz2NMlbh3ZqSWv0:4QlS07FUXqIYSX9Z0YfEchJqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678235344, "uuid": "17c7e5a8-c70d-4d46-ac72-4bc06ac9c803", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678235344, "uuid": "47d7f318-f93e-424d-9c56-24c472d86c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678235344, "uuid": "5b8278d6-73b0-4966-8f01-ecb48b84a230", "value": "7fc0a07f169a253425f15c5a6c5b5448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d147ac8-bd4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678236609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236609, "uuid": "87e9bfed-81ef-4b6d-9007-174ff0b1a204", "comment": "Malware payload", "value": "ad2fa2225596802e3b5e59fc1f08f43a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236609, "uuid": "d1b3609a-0f41-491c-b3d3-b221b4b4b3a8", "comment": "Malware payload", "value": "e8a99a7cc22007dcfb3acef2dd1245e19be27bb9769505e12c82292b659e58b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236609, "uuid": "a693b769-b091-4ce2-be22-f7607e763ec5", "comment": "Malware payload", "value": "c3e65f104f00d601a70d38cf205139cb9f5602ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678236609, "uuid": "1835dba3-4a4c-4a75-9c79-ef9b800f15ec", "comment": "Malware payload", "value": "0b23d5f2c782b78d30b559cf6532a4bb7795bd689e4f913d5954038cc03576106f122894d78959740d2ae1dfe6fd7bcc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236609, "uuid": "4df03d18-6ba0-46a7-b3f0-7cce4164ea05", "value": "T14F72C885F941CA07C5C51233FA0E078E7B26A708F2DE37039F166F65769B92B4F6A045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236609, "uuid": "9d784d5e-ecbf-4fc2-8c4b-a9a758c06536", "value": "384:ZiSE7fAZRnmGCDCI5UGYoBBXciaRs3Fx4es:Z9E74ZsZCEUUBXciat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678236609, "uuid": "de82c66c-1719-449c-bd20-eef6bf824dbc", "value": 16620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678236609, "uuid": "331a2aa4-1b87-4e62-8133-c248e34cee97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678236609, "uuid": "55c35a43-1960-4236-9721-f2c1ee277731", "value": "boat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d910100b-bdfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678312059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312059, "uuid": "50160a1c-d494-44dc-b03c-43f56de87a38", "comment": "Malware payload (RecordBreaker)", "value": "2ec6998e44b876f0ca2fb3549beac604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312059, "uuid": "3719259b-c9fb-4400-b665-b6c1a8c34138", "comment": "Malware payload (RecordBreaker)", "value": "e8d4fa5f9b4c34193286dae2a80c38cfe75e57942c9454ee9ca898017eab1d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312059, "uuid": "cbd34632-f38f-4319-af80-3450534f2290", "comment": "Malware payload (RecordBreaker)", "value": "abc835b8f0f8221a0e33d865dd835cd977871fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678312059, "uuid": "5bd24c78-d2c4-4fa0-a92f-44ac4272e7d6", "comment": "Malware payload (RecordBreaker)", "value": "5101fc30d5ab6c494c96c53989641d7e7e173021b53cea65dc18f5abf3e60b7d906e6fa78d4c3dbe808e3982b16666fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312059, "uuid": "094f5ca9-447b-4b3b-92de-c6ee7f634eec", "value": "T10BB622673E2C8005D04548318D6F7EA42B762F57B680622523B3BDCBDEFA790B51EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312059, "uuid": "87f9831b-1d99-4885-b30c-32e53274ded9", "value": "ba71c93bfaf8a292238017b3a884ad39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312059, "uuid": "d7aaf0dd-26ec-4d74-8dc4-530ac377fb7b", "value": "196608:7PhkYgO15K74eiFh2I0x68+3fsXoMZLO2hZ1IWWrG9N0/a5pf0fzXgt9L:75k1l8TfsXxnhZWWW69yy5psfzAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678312059, "uuid": "20a8dff0-9fe0-4b9a-aeba-53325cbb6b08", "value": 10889216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678312059, "uuid": "5d09dbeb-4b04-4b86-bb99-880e6763eb29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678312059, "uuid": "7006187b-f393-4841-8cea-ca414442adbf", "value": "SoftLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29623860-bda1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1678273540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273540, "uuid": "44b7ee1d-da15-44d8-9479-1db458690c05", "comment": "Malware payload (AuroraStealer)", "value": "1553cbac0f3011a556b0bc7ce905e472", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273540, "uuid": "a7717c48-c7a0-4012-8e00-6c9a31ef5763", "comment": "Malware payload (AuroraStealer)", "value": "e9c03d5984c7b81473046754979db24bb5c8b45e31603bc48b89a40aa7ce4431", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273540, "uuid": "ddb77586-7dc7-498b-b2ac-4f158fc99d24", "comment": "Malware payload (AuroraStealer)", "value": "e7fb77c2a9094b42dc111af8d28e11b146d5dff0", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678273540, "uuid": "fb7b6e7e-faaf-47b7-bd2e-9f99f8647698", "comment": "Malware payload (AuroraStealer)", "value": "61e627c0df77fade1604c6adf2ea0c4223a3235bfb4a080db1ca18e3baa6dfe064475bbc9f6a2941003a9f7f4fe2a5dc", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273540, "uuid": "cd713055-6533-4901-81f1-6344ce17f888", "value": "T1A5E51A90FEEB00F4E60329315497627F27306D099F39DAC7D9507F5AE873AE60A32529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273540, "uuid": "c1b5ec48-cc93-411e-bfda-a67116439ee8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273540, "uuid": "a8ee63da-c6a7-4571-a1fc-26cd5616118c", "value": "49152:VEnlsyQL2TPknj4ciuPGLRIrbiITRf+EGg7dCsHa25vTL6k1bXZ:VYbQiTMnfOL+osZTHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678273540, "uuid": "837fa7bb-58f6-4b09-a301-47e727fc0437", "value": 3205370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678273540, "uuid": "c6208de9-f5e1-4779-a143-130fdd23291b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678273540, "uuid": "d4b4e883-8bc7-413b-a0ed-d87a93b9eba8", "value": "1553cbac0f3011a556b0bc7ce905e472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f367a10d-bdf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1678309097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309097, "uuid": "43d36467-1a75-42b4-82f1-727bb333d3b0", "comment": "Malware payload (Loki)", "value": "e51e6f4347ad5940c67c8d278117a27b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309097, "uuid": "cbbbcd06-b3a2-4203-bb2c-c0f108a36145", "comment": "Malware payload (Loki)", "value": "e9e520e67cab86143d33af74423cd4f4a33a8f01ca6ee7d483a9f1adf9e17843", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309097, "uuid": "518c7f80-2a1d-4d0e-ac03-bf1a10f31571", "comment": "Malware payload (Loki)", "value": "8504d95d61b46c4175593807a2806f7192b273e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309097, "uuid": "21f1cccb-4190-4835-a5d3-157738917e2f", "comment": "Malware payload (Loki)", "value": "ceae54c380af589e35ddc0aa9bab0d9f79b0f6ecf474062d2ef9fa4031a7ff1fe60d67adf4deb3b72c636bde3b6bcc40", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309097, "uuid": "503421cd-21a8-4426-b959-211ceef6cdfd", "value": "T12055F1039138AE4BE102C7BCBA6F7459111EBC3671C1E5CA754DB70B4732EAA5ABF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309097, "uuid": "040ef464-a2f7-4c7f-955d-8265fdf946e3", "value": "24576:aLKyB+tHlxSWQmmav30xbBnPvtHlxBWQmmav30xu6FMQxU9rJo4/g53:aLKyC7XQmmQ30pBPJ7QQmmQ3086xUri9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309097, "uuid": "3b669b53-1537-4b0d-8f58-91782927610b", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309097, "uuid": "c7ce5ef8-0962-4090-91cf-adfdd096ae76", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309097, "uuid": "70dee89b-c99c-43d5-bfc3-38f298da0092", "value": "shipping doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29280fe-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678279326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279326, "uuid": "7f655ae9-0756-48f2-baaa-4f7b860aa9f8", "comment": "Malware payload (AgentTesla)", "value": "6baba180755cc2dda49077ef237be8b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279326, "uuid": "28afc99b-2f0b-4ea8-9e05-624649df1a85", "comment": "Malware payload (AgentTesla)", "value": "ea30a1012565141efc8e618c5ed5f2d1aa1f30f3c69b33e1cf760fba2d0e053e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279326, "uuid": "bf823393-5ebf-4be5-b137-793996d740ec", "comment": "Malware payload (AgentTesla)", "value": "cf342ec3686debe0b2a6b6f713ed0e43c2fd3ca9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279326, "uuid": "a46ebe5f-d0b4-455f-9684-95b30b6d2681", "comment": "Malware payload (AgentTesla)", "value": "f276c83da64f3a834abdf60f5db877851de750da83cb998f3b5e1216017af10fa913c294c2b9e88be22c191112516b25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279326, "uuid": "cdb0e610-2fcb-4d31-9b90-871c3c18e52e", "value": "T16D15CF99B3714573EC8F81790A27C5CF2C40FA8BB611E237577B7A41E2591BF7A48222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279326, "uuid": "0edc28ac-e3c2-41c9-835b-bd63b73389b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279326, "uuid": "e8505a93-c9f5-4664-9cac-767a229633cd", "value": "24576:ZEP78/1MCzV4tWlBL/g4+eOXLxpU4ltvh4pyn8vubRtm:5WC1nyhpU4LvhKy8mbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279326, "uuid": "d24ef80a-ba20-400f-b1d2-528f5018e7eb", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279326, "uuid": "ef623790-7269-4c5d-98e8-7b505904908b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279326, "uuid": "80f4c48e-45a9-4a2b-bcfd-d75f1d3cfb4a", "value": "rConsumerPO-4806125050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eaffe2-bdf1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678308127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308127, "uuid": "bba5300d-59d4-49e7-b45b-d1724c86d6e9", "comment": "Malware payload", "value": "553b7ccd9f9f9ac01c0942f8379ead12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308127, "uuid": "11c9952d-a8d2-4485-b6aa-70f075003e7e", "comment": "Malware payload", "value": "ea4f1ab1b1b6a31626dc55863c42d11f135f298bbb914dc42a11cca5e3bc93a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308127, "uuid": "c49259e6-f1de-4aeb-a0e3-ae5881d889f4", "comment": "Malware payload", "value": "9212a89cde84dc78630405b14f43c6c78b6a24ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308127, "uuid": "1b05a009-2d12-4ea7-b588-3bbe13ff5b26", "comment": "Malware payload", "value": "3af04697d27f9ddb0803bd3b849f59341c046f8b8249f6997ab17a0084f253c43b87434a1e2fefcc6984ff7d670279b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308127, "uuid": "2ee66871-638e-4dba-badd-35c7daa0aa1e", "value": "T15BD423C1EAB634F9DF6624B3B9D06737E8156631CACD2DE53395AE5128F10653A003F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308127, "uuid": "5034d543-f383-4e22-a174-4856774551e6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308127, "uuid": "83d33ecb-694d-4bed-99d8-42cb77fe2d4b", "value": "12288:TXZc3xmLIJkUYOQc1mKS2/2+9eY+jBkOGjKO96l2bREsdQ7:TX7iZVhrS2O+9eY+jBQ/9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308127, "uuid": "91a3242d-cb4d-425d-90eb-781cb41e911a", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308127, "uuid": "1a2e988a-3406-4d93-b0ca-dfd63093c623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308127, "uuid": "a35425f7-3992-4c1c-bc56-278653e27e0a", "value": "Priest.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7205371-bdcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1678292326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292326, "uuid": "3ff40c64-5aa1-4d99-8bee-e92fdfee7cc8", "comment": "Malware payload (Guildma)", "value": "67ab7f5e52a66f23ac4902128238b127", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292326, "uuid": "2375a26c-5d0f-4bb3-a917-4df0f1847a99", "comment": "Malware payload (Guildma)", "value": "ea6215ab4d1c983ec4777778155ce206218f0c6449a8fc00ed875387cbe85613", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292326, "uuid": "5852cb68-190f-40a7-b299-1415b5249929", "comment": "Malware payload (Guildma)", "value": "418ad154a89cb76ec3aef21fff1f90d1eeb43392", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678292326, "uuid": "0d14c218-6d47-4a9d-afb5-193242692ad1", "comment": "Malware payload (Guildma)", "value": "b3328eaf179f76ff2ff23693d48fa69fd6fa92423dba1eb65a3b3aab67f2417c24ff0e02f64fdd38934ac9fb6585d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292326, "uuid": "4366f0b6-4493-49c3-abb4-8b78a8dab227", "value": "T1E522EC8BBA16B09529240D150B339F84931A4E738373DE7972E874C12CB5F9276DBB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292326, "uuid": "7fbf5f4a-4816-421b-982d-8bbb782de92e", "value": "96:I6qEy0UyjB8vozUBqAD4LcYi78f9P/Qw/ozR6IlokAn4FfOFZKFfbw49ZrOufPOW:I+RrzUjcXrWoxcuF5EX0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678292326, "uuid": "36601a19-9da4-4b08-b77d-27cf64d60ef1", "value": 10785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678292326, "uuid": "55e1cfce-4007-402f-82bc-8acad06dccda", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678292326, "uuid": "2d20c875-32cf-4f93-8f81-8f3b103f402e", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f28c1d8-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277817, "uuid": "bb10540c-140a-4360-a6f4-035b2d3f1669", "comment": "Malware payload (Heodo)", "value": "f93a6d3beb949b7c77954c2cbd69f9d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277817, "uuid": "c7f84afe-725c-4dba-8bcb-86aa96c38d60", "comment": "Malware payload (Heodo)", "value": "eab6caf1b5cd67662530e019b2280c43634a17529d02bc517a7f0a4e056709b1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277817, "uuid": "b9618c3c-5352-4e62-bcca-bea4fbd63bda", "comment": "Malware payload (Heodo)", "value": "93104c9834f485c24eb86b4a655bc8a427b8092a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277817, "uuid": "32883ba7-de86-4159-8a1b-f1f983480cde", "comment": "Malware payload (Heodo)", "value": "70e7d2bb027366c92bf29a9f600ab83921333e2bac972fccd11b7df66f35e5ae634bc699e1a1c92c86bac50e5d96c05e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277817, "uuid": "9b0d630d-5bc9-4b56-8266-1f7bf794cdfa", "value": "T16015233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277817, "uuid": "f2c9ba4c-78f4-437e-aade-c233b6290546", "value": "12288:G4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sZ:hevtlkdJe4m19FgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277817, "uuid": "bef19c26-966c-4d0f-9055-1f76cd0c00a7", "value": 886872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277817, "uuid": "62bec869-c777-4260-bae5-9e78a0c0b124", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277817, "uuid": "073f0725-193f-4e21-b1fa-eea667828cb3", "value": "2H5CM1eq5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155f2f37-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274794, "uuid": "4cfb1e5d-56d5-4056-8016-b5bcfec9b6c6", "comment": "Malware payload (Heodo)", "value": "2492bcdb21848998968e2ba33eab6d48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274794, "uuid": "6e83af1d-8ff8-4f18-b034-56b5c6cb2934", "comment": "Malware payload (Heodo)", "value": "eac88a8cd17d2d1976ae1e3b4a4e476b2da264a858b60751b3a3b45bc286d607", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274794, "uuid": "14a518a3-e60e-4394-8691-8323b0261ecd", "comment": "Malware payload (Heodo)", "value": "6debc525fa261fa3df1d13403517b41e2269697b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274794, "uuid": "48f385a7-9480-4f0d-ab91-d407956f0527", "comment": "Malware payload (Heodo)", "value": "989c4a0d30a56e439c826f67b6121fdada0920d5bbe17e5c74bad8b5da8a788fe50fe8032e5c17a5d69800c8541f9617", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274794, "uuid": "2fa556d1-4888-4ea3-ad58-25840fc4b8b1", "value": "T15315233C5F67790FF5997C362AF3847AFDF90858DC96A90A17432A9209AB2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274794, "uuid": "fdf0fda8-1e07-4e1f-8345-66ede5c959a1", "value": "12288:F4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sn:6evtlkdJe4m19Fge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274794, "uuid": "3a788d55-7754-4030-b21a-b123f80fc48d", "value": 883816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274794, "uuid": "0eae277a-9241-4389-a385-12b680114257", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274794, "uuid": "d9209954-f5f0-418d-b5db-ed5a28bd7abe", "value": "MQJYSTRXyvPJFkXn0IBXzm1vC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8ce905-bd9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678270646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270646, "uuid": "b9dafe08-5ec2-4ef4-af43-c2d7962505a5", "comment": "Malware payload (Mirai)", "value": "c6a9e8cd091179f0801e9b101354e99b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270646, "uuid": "cf5b5014-1fee-442a-af41-48beceadf3e7", "comment": "Malware payload (Mirai)", "value": "eae1c1d76040dab20be324fb63506a1fe5c4b9f55e654354a950b01315d557c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270646, "uuid": "488509d9-a0b5-4452-a5be-de6116f9fcaf", "comment": "Malware payload (Mirai)", "value": "5352e1789cc2189909ddb6a8f708d2af0ff134fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678270646, "uuid": "ca9c3d2c-cf07-4893-a993-9cfb947e097d", "comment": "Malware payload (Mirai)", "value": "ac4c38904bbdd8f1df61888a4c532312abe257f521caad7fd7b66e4578368b8c27d5f22afb8c4690308b064464de2173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270646, "uuid": "5fb96f28-bba7-4c7d-a1b1-6db8632a0723", "value": "T120735C31F97A1A17C0C1A47A21F74A21B6F147CE25E8CA0E7EB10E9EFF619442543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270646, "uuid": "8c7e3ce9-7794-4406-b67d-9f906edf196b", "value": "1536:FZ/UwNUdzi5GmwIXf1/PZEQuYQL3t75g3TtCAGj4:TcvYPhO3tVw+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678270646, "uuid": "67f9a49b-682b-4039-9a31-574a3dfd0bfa", "value": 78416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678270646, "uuid": "06e3def3-029c-4bb9-83bd-9284a4221c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678270646, "uuid": "b0d08b2f-1101-4d23-aafc-8b50e715b7c5", "value": "c6a9e8cd091179f0801e9b101354e99b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b8056f-bde3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678301818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301818, "uuid": "7b0557e0-4ba8-4fdd-850f-f4b3cd4ce766", "comment": "Malware payload (GCleaner)", "value": "eea01ea8e153688c3526ba719db41e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301818, "uuid": "047c16f6-a93d-4fe2-92fa-e3d039b91136", "comment": "Malware payload (GCleaner)", "value": "ec4a3b4195a3e96b2368b55ebb4c3c64e07a2d84e8f5b8a501b0547473ebf9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301818, "uuid": "a2f45e3f-f254-41b9-b654-4203bdaf5453", "comment": "Malware payload (GCleaner)", "value": "cd618f3d4988e1eb4927b3586a45654954e9e8b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678301818, "uuid": "c4473a6a-c429-4caf-970b-8bf7ed0aa571", "comment": "Malware payload (GCleaner)", "value": "33d9f6da9250442f4dc1b53fb0c8679b4b52dd57119612f447dc8ac032b2dc1ec298a1c90a58bc87e65d3e6f7ad72db9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301818, "uuid": "0fbaa53b-3941-4046-9708-d52fa502cbde", "value": "T17244BF1293E07C35E26687714E3EF2E82A3EF5515E3BFADD22245A2F0DB11E19963311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301818, "uuid": "0e8b69ea-1006-48d0-949a-16e2c72e5fcb", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301818, "uuid": "d6ca6715-5a7b-43be-9f03-e49de7059329", "value": "3072:O/rtOYPo98S5fAlHfu6ctbqYX18hvgJrv2Tk+CQK1iCrvnAbUeypMs+okF:DMoaS5DSo72AX+CrvAQgs+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678301818, "uuid": "e04a1015-cc66-42df-9cdd-0e383f231834", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678301818, "uuid": "886e7fa3-09fa-4099-8847-b27012d2281e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678301818, "uuid": "571c596c-6929-4567-877f-b971fe0a0bd7", "value": "eea01ea8e153688c3526ba719db41e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6989dceb-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262910, "uuid": "533c3382-88b2-43fe-8971-f0bcc7f89800", "comment": "Malware payload (AgentTesla)", "value": "960953e9848501c8afad1b0dbfdd92f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262910, "uuid": "30f94c84-71e7-4227-9f9c-f5a2597b4442", "comment": "Malware payload (AgentTesla)", "value": "ed12b65c4ad6c7849a23e7e6f5b0cc6827af4dab8ff0eef24d78afd9f4bfec1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262910, "uuid": "fcc63bb4-8535-460c-8f9c-9184cee96f72", "comment": "Malware payload (AgentTesla)", "value": "20347baee4f16f123f9acf41ee00a4c86e258f32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262910, "uuid": "c04691c2-dc4f-4b55-82d5-bd3e6b0cf134", "comment": "Malware payload (AgentTesla)", "value": "2d571776f23754a1945a5f9942ce4bf7e133357587d4210455c5b99d75b9bb3083b652eb3911fbbf73d21c176ad22246", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262910, "uuid": "231b234d-e2f0-44af-872f-cc4037eaa76d", "value": "T1C625AEE83F49729FD787E4B358042EA2EB9CB95E161BC00519D3018FC58DD6D4A12EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262910, "uuid": "871bc0ab-3eaa-40f9-a634-4e002e5af250", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262910, "uuid": "ff5c3ebf-d5e3-474a-a095-982885cbe1a2", "value": "24576:YqWOqd2UhNLdYHHR3SBvZsM8LtncfOJT58:x/qLK34veNLVcfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262910, "uuid": "42849346-de44-40fb-9417-07fa1a963bff", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262910, "uuid": "791d13d3-7230-4d9b-b8fd-515819380abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262910, "uuid": "206acd4a-19b7-4e95-92b4-7565fd58ec4d", "value": "AWB #3827747403.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9affd2-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308361, "uuid": "94cbb31a-af83-4040-a383-4be83a4f81bc", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf7e8b9c78a160018b1d99d34683017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308361, "uuid": "2374a062-5bbe-4fbd-a9e4-34e9684b9d08", "comment": "Malware payload (SnakeKeylogger)", "value": "ed5e7918456cfccd873fe19861241d97abf4b157f88e9da9a9119651480eae15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308361, "uuid": "5db2476e-262f-47dc-a385-e6097fc2195b", "comment": "Malware payload (SnakeKeylogger)", "value": "ee4329bdb35479aa53806f2cd69c5560261a8650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308361, "uuid": "819e61de-e2ac-457a-b4f6-977578d3bb37", "comment": "Malware payload (SnakeKeylogger)", "value": "f2ccc8aa8aab5feb3c49770b42f0a0050945710bda06c92beba131c364550315450cce55ed574841da8423d0a8128f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308361, "uuid": "b3e15cc2-1fa7-457c-a999-d0680b83e539", "value": "T1FD15BE99B3315573EC8F80B90917C5DF2C44F98B7611E237673B7A82E2591BF7A88212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308361, "uuid": "497c8165-d17a-4fc5-82c6-02321c2fcafd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308361, "uuid": "a4eb8b67-8197-48d9-8dec-2f4e07b90886", "value": "24576:BEP78/16gMbCFHS9VPK31tmG+EhijMa3dG5:RRxIVPK/mNECMaNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308361, "uuid": "9dfe6381-4953-4107-9336-ef214905ac99", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308361, "uuid": "612293ba-6b0d-4dad-bad4-22c4d6e528af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308361, "uuid": "949650ba-50f1-451e-a258-752a853837fb", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a6696b-bdf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678307703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307703, "uuid": "c41356ec-0caf-4de2-89aa-a122e66bc178", "comment": "Malware payload (Mirai)", "value": "a429b16da1379e1d6650517102a08933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307703, "uuid": "758f21ba-abcf-4df8-975a-142940aa8e1c", "comment": "Malware payload (Mirai)", "value": "edef7c2965f2f6a1d91564b4f8cc20e6b527bf2872a8f80a7b7358291eb06231", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307703, "uuid": "482d070a-72aa-4dc2-b9c9-c4131c316d8a", "comment": "Malware payload (Mirai)", "value": "e52927daf86b546ad13cd61090ec874024624abb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678307703, "uuid": "aabea18b-ac0c-40dc-b88c-995313e58424", "comment": "Malware payload (Mirai)", "value": "0816332f445e95e2e83682c93c6398a572b915906a3a5c21a637e4610bf888627ee56271ca8b0a1fb003924df14a76ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307703, "uuid": "f8bf936c-ac05-4a70-8be4-16fc9d1c7f06", "value": "T10A23620D3E319FADFBAC823457B74A219758339976E0C5C4D2ACE9111FB020D646FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307703, "uuid": "9862d4d9-ff0b-4045-a49d-3fca7768734c", "value": "768:0hbqBadPnw0CFWuMxAd+BWepf0nmEYHj9CIb06dGRlphVh6hIyhbhwyh5YBYh1Ho:sdPnw0+W7xtDD0KYB+zmkkdqvTbpPYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678307703, "uuid": "e2b37000-c402-45c1-97fb-64a5499102ab", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678307703, "uuid": "5afde81e-42a7-4245-a78f-bc42d842fe2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678307703, "uuid": "af5abf1d-6789-4a4d-8f9c-3d7267dfea28", "value": "a429b16da1379e1d6650517102a08933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f4d0bc-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1678290155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290155, "uuid": "60f04327-f3d4-4c63-b448-742dc45604d0", "comment": "Malware payload (Sodinokibi)", "value": "f683067ec885b87fabf44d45f2ce03f6", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290155, "uuid": "9711239f-9552-4f88-9fe4-5efa2a09e0d7", "comment": "Malware payload (Sodinokibi)", "value": "ee0ac14a60605773834649b40c22acecfee0cc34f7f50ec30c42f15605ccb27c", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290155, "uuid": "bf9bd170-237d-4457-905a-d1179f2118ff", "comment": "Malware payload (Sodinokibi)", "value": "906b99c082e4ff3a7e0f3e8dd635baa519f76423", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678290155, "uuid": "678ed206-612c-4da5-917f-5864c6b7d8aa", "comment": "Malware payload (Sodinokibi)", "value": "298dd838f4021724c08844aa9bbed76123cb01c6e3011e774f6d40637bc27b067ed95004618ec8b70ad864f377cfc723", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290155, "uuid": "b5b46a6d-a3c7-45ce-83a3-02e0fc2c9e1f", "value": "T1EAB39E0BBE908136D55301F2132B2F0A5EFEBE744435953BB79898481F3359EE62B663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290155, "uuid": "402dc61c-9011-468f-b82e-e91449e57395", "value": "1da9bd2a660139c2d8ce0baa10e11ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290155, "uuid": "f3ff1fe2-1293-474f-b99b-e708bd306f31", "value": "1536:vxmFqbN+uJ+GayuAELVWwPALp1qSdkqICS4A7Wk6t:52quxA9GtW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678290155, "uuid": "d32daf38-c910-4d64-b2c0-f7c7a1b6f8f2", "value": 113668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678290155, "uuid": "b03099b6-5fee-4f5b-b149-c0d35923455c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678290155, "uuid": "d89b044b-26b7-4097-971e-9692035d11d1", "value": "2023-03-06_f683067ec885b87fabf44d45f2ce03f6_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe008358-bdb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678284204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284204, "uuid": "d1b0387d-4387-4914-8229-96fd04cf3f76", "comment": "Malware payload (Heodo)", "value": "77d57cae3a5fce854f481486238c9e39", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284204, "uuid": "d042c698-2c99-473b-9df8-7a17a19e5612", "comment": "Malware payload (Heodo)", "value": "ee3a310f1b3c0af7352a19dea19709d45c8e4af7bc27e58e2bce88d0df15a20d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284204, "uuid": "489954cf-b8a4-4df6-a2d4-b37cd917396c", "comment": "Malware payload (Heodo)", "value": "75da5bca557c50154cea598d84c881c10d0bb071", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678284204, "uuid": "873a0056-0d1e-4b88-9e43-236715e29ba0", "comment": "Malware payload (Heodo)", "value": "b04131c2a10f14a974a4cca4e06a68f01133d4d6e9bd144a3b082f3602c6d2859f56155460e247f50846199446e8a2b2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284204, "uuid": "3679b9c2-53b1-468e-9b45-512c698c2136", "value": "T160E402EB312EB155C11984318AF095D062F3BD36358B57CC01DC26DB669CCBAAB9316F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284204, "uuid": "9a0c5c22-3de2-46c7-ae37-aeac7b7822d1", "value": "3072:IdMDH1m7YdNYjS+C98TUVz8MhETlKx5nTtu0Y+sLQ:JLsUnYOzcZKx5o5+CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678284204, "uuid": "4bba1731-6126-4658-b4fd-8c75acce4346", "value": 674828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678284204, "uuid": "343f33dd-7ae9-436c-84e1-8279c59c53da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678284204, "uuid": "3019cf1d-c3d2-4b41-9550-a3415375f3c1", "value": "ZL1NK0EX1MH256E6PLK2(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f66721-bdf5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678309610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309610, "uuid": "cefd89ab-3631-4ff8-9a67-a0a6eab435f2", "comment": "Malware payload", "value": "d5e08c49b1bcb72f9decfc3eddb36655", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309610, "uuid": "638eabf9-4f2f-4561-83f7-4662515b2d61", "comment": "Malware payload", "value": "eeecc13b73494e435b8cae2c286e9da374f0ba16eb18509af640a71aa8b11195", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309610, "uuid": "60fc5ba4-b919-4713-bb1f-35deafbb5359", "comment": "Malware payload", "value": "10cce22339b26e1a5d794fcab7aa4fa683d30d40", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309610, "uuid": "868b634b-e07c-4abb-bc36-e7bee26d8e85", "comment": "Malware payload", "value": "3eeef1c5e8be0acbbc2d03b5e80fb5d13073c866742583dafa41c4a8b250c61dd1fef0441fb8544e216436a830bc4c9c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309610, "uuid": "986524b7-c7cf-4c36-80a8-8b9c346ecba4", "value": "T1CE25018C3550D717EB6454717AD1A11ACD30BDACFC668856BF93B71A683020286FBE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309610, "uuid": "6510e90d-ae16-40fd-a168-518e8adf02c1", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309610, "uuid": "a4132479-e198-4495-a853-abdd179e20ea", "value": "12288:NGI5oD/F3GaDJNhx2GRUX/03fDzJiYAx5CIuyOeoO2v2WA6AfGRo2BzYjiHkNUO4:NyFWaD7HcmxiPx5C7eG+WGf037z57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309610, "uuid": "e0860430-f8d5-4911-9f9d-434bcf32dbe6", "value": 1000751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309610, "uuid": "0652e390-2e2e-47b5-967e-bce816c902d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309610, "uuid": "cf76fce3-ec10-46b1-ba02-1f44776b9d80", "value": "dhl-009765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10c9ee-bd97-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678269355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269355, "uuid": "2e5fdcab-755e-4e44-8e0d-30c5080c14d6", "comment": "Malware payload (RemcosRAT)", "value": "4866f5b9ded12cd58c7153ba0d54cc3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269355, "uuid": "42ca8845-8e4b-40ad-988f-7baafaa8a0e3", "comment": "Malware payload (RemcosRAT)", "value": "ef03c2c9163eb0807e9fc8dee88f94990d10cbc3e58c1a49b58ebaf7230b6833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269355, "uuid": "f1a03c2a-3873-436c-9cc6-b6c7c75604c8", "comment": "Malware payload (RemcosRAT)", "value": "e5f0b357a9d5ae3fd9e3bd95bede801e50380678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678269355, "uuid": "41d896d0-535e-4703-9d57-38c5fee7d489", "comment": "Malware payload (RemcosRAT)", "value": "b077fbd279f0ca9af1f00f010684f95274b857f7f1f0a080f2e6f5288934c21f5aff35091d1e992ae4df97cc901d9188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269355, "uuid": "f4f7ca8d-7c36-46b5-9426-a5e0f807fb05", "value": "T18CB59CF19E53FD909BEB1D8480CC29C05C4C0BAB82998558FCCC2556EAE5AA4FFDD1B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269355, "uuid": "39e423a4-56ce-42d1-8bae-826bbb55eb38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269355, "uuid": "12047bdf-1f8a-41b4-aa1e-57361171bacc", "value": "24576:bmUI1F+amdINXnwLvuvlO7F/g4Jpcbp/Ufb9pV432Qmj1tq:akamdIFwr0Q5/0s9peS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678269355, "uuid": "522f7e04-e7aa-4a23-b5e8-50790d8747ef", "value": 2282496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678269355, "uuid": "fad01b77-ae07-4ee9-a545-e7f7f33cde73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678269355, "uuid": "55f3992e-06b7-4e3c-bdeb-5a61ff54a95c", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d950c3-bda4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678274820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274820, "uuid": "7dd1c885-7291-4748-9ed8-fdaaf75dc1b2", "comment": "Malware payload (Heodo)", "value": "819bab0674631f7885e1e0504ebb8859", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274820, "uuid": "a3cee60e-8ca9-4d50-881b-20b9314df063", "comment": "Malware payload (Heodo)", "value": "ef83b4a7000b2d750d15cee1ff4f80e421b59be76535b56f8f2e209a233e5b22", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274820, "uuid": "a3fd143d-e576-45c1-8657-a37cc50cc706", "comment": "Malware payload (Heodo)", "value": "265e2debf4c99074c0c59e5f7ab6fda3e2235f86", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678274820, "uuid": "4f0a8e57-1f9b-4603-abad-d5d1742015f1", "comment": "Malware payload (Heodo)", "value": "dfd71c1256c882182f5750ce3018ddd1051072f7ea58958b00c5cfd2bf1132152226e09ee1608af2f5b63afcf6142a61", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274820, "uuid": "26e3e8c9-103d-4472-87da-e5340098e3c2", "value": "T1A605233C5F67790FF5997C362AF3907AFCF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274820, "uuid": "258f8249-c15c-40e7-81aa-11bc69facbb2", "value": "12288:W4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s4:xevtlkdJe4m19FgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678274820, "uuid": "a8d1f124-708d-4844-81cd-23024b6293e7", "value": 873671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678274820, "uuid": "22655d29-86b1-4d19-b830-ef6182b803a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678274820, "uuid": "24e5307b-c7a0-4cd1-b18c-884d70a76a19", "value": "YcdAsbC5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42eff1f9-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308372, "uuid": "41ba9ad6-7069-4ca4-b6e5-a9f428fcded6", "comment": "Malware payload (SnakeKeylogger)", "value": "899b30845e5a3812ea54f10fde61d09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308372, "uuid": "a7970293-6211-4b06-bdb3-9effcc50e66b", "comment": "Malware payload (SnakeKeylogger)", "value": "f0340563a032ae166df2813554e957f99b08ad93af72bd4df6976fef51c58e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308372, "uuid": "6680f335-c87d-456f-b9d8-59bb5d6c9a49", "comment": "Malware payload (SnakeKeylogger)", "value": "8b3978104936a999d187af1cb551911fd3f7635d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308372, "uuid": "ded03002-07dd-4b84-a3ae-b47ec3858af7", "comment": "Malware payload (SnakeKeylogger)", "value": "39798ad309060e81c663d40003f509bdb5756a8787ccaec2e61ef09e0dc1bd953007fb628ea7f565bfc83754e93cd131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308372, "uuid": "f9e45f41-d4f1-4d8b-9bc9-8657af263461", "value": "T14B158DC637BDE122F8E7A1720A1511C93A39B5877211F13BAB33BB619601BFF7689540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308372, "uuid": "07ace214-7383-4978-8afb-ee7c9221b7f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308372, "uuid": "869b9bb8-affa-445f-948d-e3edb1f4593e", "value": "24576:roHlTBx+MgPCEs/r47IpZKdra8mIMVPhojEg:rsTj+Mg6q7i8dEIU+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308372, "uuid": "2b161779-4739-45d6-85f5-f66c99aa08a9", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308372, "uuid": "18ff7af2-bd86-42f5-99fe-c3e0d0348e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308372, "uuid": "fed2f979-ad56-47df-90ec-8844ea66a8a4", "value": "899b30845e5a3812ea54f10fde61d09e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e65db1a-bdec-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678305921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305921, "uuid": "2b1772a9-6585-4548-a456-fdd6f5ebc5da", "comment": "Malware payload (LaplasClipper)", "value": "177007f68ee1b8fec18ffa61b4bf8faf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305921, "uuid": "3426c109-bcb6-4e32-b38c-94c0a88e939c", "comment": "Malware payload (LaplasClipper)", "value": "f1ad2e8d7faf26ebae0dd8d04205f5ae51e220b25d73937f420f80bebcd2b46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305921, "uuid": "4f2de78e-aae1-4471-a10b-ceedfdbd2b5e", "comment": "Malware payload (LaplasClipper)", "value": "f85bb0eb619e1a6e95f0630f230607889f3f7a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678305921, "uuid": "ba447803-ba67-4cec-97e4-e93e3848acf0", "comment": "Malware payload (LaplasClipper)", "value": "be5d3d3613dcd5a060454fdcdebc2643d78877ce4e35fa32b257fdc75297d312e53ef812bfb760a48b5ceca00a28e676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305921, "uuid": "dd0a9d64-6c2a-42df-bb5f-e9ad8b522753", "value": "T131148D1293A17C25F6778F714E3EF3E4263EF4525E3BE699222C1A1B09B51E1C663312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305921, "uuid": "93491f17-f1c0-48a6-90a8-68a0f1faa480", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305921, "uuid": "cdf39423-b508-4e1f-aef6-54ea80890138", "value": "3072:QwXr7Uqowy0DtAi7FecMMx35QvqhifCBSVGipPlolWkF:NPVoR0DHecxx5WfGSVGII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678305921, "uuid": "099c87e9-7357-4809-81e6-7bce7f7b1fbb", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678305921, "uuid": "be1129e8-4e08-4d02-a625-3d26c6e764e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678305921, "uuid": "df7c40e6-3d26-40a4-a100-daab8f508bff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca1bfe3-bd85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678261546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261546, "uuid": "037aadc9-2695-486d-90dc-0da5cfd8f767", "comment": "Malware payload (Formbook)", "value": "73d228e82524b72ad95b64b040dd1a1f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261546, "uuid": "fa0d8dc8-6db9-41c2-a9e7-f9d0165e5ae4", "comment": "Malware payload (Formbook)", "value": "f1d6620d62d354c6a34c82f975579cb0a3beeaf5539d5a5993f9c470d2616a59", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261546, "uuid": "28882033-0cf9-4b28-982c-7908ff620480", "comment": "Malware payload (Formbook)", "value": "8fec94210f31e82019e06baf8d865b20f25116a6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678261546, "uuid": "69bf7fd4-ad19-4307-9478-043122567cf8", "comment": "Malware payload (Formbook)", "value": "34aa3fc80eb276d4bbe619d1893422af10c0936ebbd347e24bb7db23cfb8375e228123807c4947973a72806d39d9aa8b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261546, "uuid": "feb36991-5d12-4837-af1e-9667c979ff79", "value": "T125453319C0E3AB32CFD44CDB09CB929D94293C4B83BE96CE3131C977759B5528E8C896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261546, "uuid": "6d125080-49fa-438a-b4db-c52ee679ad10", "value": "24576:bSl8OW8I7KnPppa/YgwbvojWMB6rFm4dRP1K3GkwdIWs9E1MeoP4:bSebz7Qq/Yz7oWe6E4dRNK3k1poP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678261546, "uuid": "ad2fe6cd-4734-45c6-ba3b-0fda4333df2c", "value": 1208467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678261546, "uuid": "3353cf3b-732d-4314-886b-f9c2b3f74ee9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678261546, "uuid": "3f956a6f-d8a1-4a73-b501-9b3cff76c359", "value": "PURCHASEXORDERXRTC-3024-Steelite-HiltXNewXOrderXXSO18198810.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7b9574-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308366, "uuid": "329cb5f6-429f-44a0-bba2-855238450e88", "comment": "Malware payload (SnakeKeylogger)", "value": "0a9e2263a5819a98a2eafcf65ebace9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308366, "uuid": "e992dcca-050a-4dc2-82fa-fcd98b622958", "comment": "Malware payload (SnakeKeylogger)", "value": "f2cd868534966745bdb55e2755633797fc3a8c0b564fc1aebaa97274fed38066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308366, "uuid": "fcd654b7-f478-4e96-b146-4a73bbc403af", "comment": "Malware payload (SnakeKeylogger)", "value": "42a2a0278816d49bdba33de9e18dfb0c966c6044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308366, "uuid": "1160d3e9-9a6d-47e6-8a10-fb2ec5d53a98", "comment": "Malware payload (SnakeKeylogger)", "value": "6452895ca0105e58eadaca450985a4e57865fe88bb893671d7425c23c48370304425c0e26c2357a8049e451091266ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308366, "uuid": "5f79cdec-ca5e-424e-a53f-8c83b271c7be", "value": "T150958CF09EA2FE809BAB1C8491CC29C08C5C1B9B42AD9588FCCC2526E7F5554EFDD5B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308366, "uuid": "505a6ad6-73c5-4e0a-9751-1788e49e17e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308366, "uuid": "90362493-7f31-47bf-a2ec-d7b442f6c2ac", "value": "24576:fTJhFKlgxR/5mdZbE6a3oNsgTDxYxv3CXfMUcLp6BZZy:fP+oMo19CBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308366, "uuid": "e734b160-5f0d-4e93-a64b-2666a00eb9ff", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308366, "uuid": "c4b354e5-271a-4948-801d-c65f14c624f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308366, "uuid": "575341ec-38c6-41fc-a0a5-a96f002333b5", "value": "Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0f5a5c-bdfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678311930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678311930, "uuid": "d5408afb-34b5-4b07-b5f8-b9ee7adafcaa", "comment": "Malware payload (NanoCore)", "value": "3629da9b806fe84c68eece558cd64939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678311930, "uuid": "0ac2c376-4c5c-4291-b1c6-dafd094e46d6", "comment": "Malware payload (NanoCore)", "value": "f3da515f15efac502bd2c38592c0b6175e2f18ef715d1708bbb5f3dee454783f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678311930, "uuid": "d8d6d605-009c-4e66-aa32-21bf31107ba2", "comment": "Malware payload (NanoCore)", "value": "aa303ff5ca96a245903946b383687c46c8f6bd94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678311930, "uuid": "43a21ea1-e078-4b78-aaa8-8491911a827d", "comment": "Malware payload (NanoCore)", "value": "779bcc02f2e681ad9b14ec9e67f435caca1e883db8986ff81b0e2825560a6ea420b5f33f3a581c92b501d374d4046ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678311930, "uuid": "92df7513-cd53-4528-ad08-1fc100fab819", "value": "T16425BE97F159A82ED8BEE730DD46BD14E831B0727202752B75DBC09847ACAF29B041E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678311930, "uuid": "3dd55426-5c1a-466b-816a-1a3d68d0b36e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678311930, "uuid": "0997ccc3-9a74-4037-a878-39c02ef6f0a7", "value": "12288:4e3yg/4eeK///h4WwH9b6p+/b0ydU0v+gHCJ0e/0ZQ56BSAWj4u4qpSeSQBJl1:4e39feKHp4bwp+/LUhwRecq8BSAWj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678311930, "uuid": "e1fd23c5-7331-4e1a-b6f0-3d6f663b5a17", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678311930, "uuid": "2023af1b-60b4-4bf7-ba54-e7e4f68e358c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678311930, "uuid": "793c3bfa-edbf-4cc6-9c58-70dece173305", "value": "3H4ORp93h46r56r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c8e6c-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308387, "uuid": "bd7b934e-dd97-46f3-a55c-7da3407faa74", "comment": "Malware payload (SnakeKeylogger)", "value": "4da4815056694214b6405ac6ad1bee62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308387, "uuid": "c355ba69-1201-4a90-9ee7-a5bf07e73c7d", "comment": "Malware payload (SnakeKeylogger)", "value": "f453407e0d8ba9650704045d1f0722f70e9ab9ee1460b88c97f937842b02f585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308387, "uuid": "54b19e49-1df1-4647-9069-ba6949f0b79b", "comment": "Malware payload (SnakeKeylogger)", "value": "d145d41479d5f2e799f61d982f83f4f5dad254ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308387, "uuid": "954f0add-ea9a-4e38-b646-a80aa0faeef8", "comment": "Malware payload (SnakeKeylogger)", "value": "62bd077a4e2341b38a4c3027791908578dac13c53a89ddf47422cef7d74d1e66e5e55d8dd3b0c977a36a87a67babc864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308387, "uuid": "d932ea64-e7b8-4109-9ca8-956db6ee0485", "value": "T1B13413893E90E48FFC2347714A764BA79FD9A6321462531B07001A2E7BF2761AF5D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308387, "uuid": "998ba946-b5b3-46c3-b6f3-75e07e0a9849", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308387, "uuid": "3464cc82-943f-4d1d-8fbc-ea26fc571fa2", "value": "6144:PYa6AafF+3bCbmpkDjpmK1eu3wVtQeDCk8g:PY2afF+32mwmK4RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308387, "uuid": "02ff9fc7-3716-42e3-aac3-23694985aab3", "value": 235349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308387, "uuid": "68cb6e99-5a2f-412e-b7b7-fef58daef7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308387, "uuid": "2e7dc06b-71ff-403b-913b-7860275ef48f", "value": "TT Receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97420eff-bddc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678299064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299064, "uuid": "6d88f68a-bd42-4de5-b2bf-86cbdc6137e8", "comment": "Malware payload (Mirai)", "value": "fd4ac43bfd80367624e8656bc1952d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299064, "uuid": "fb8ced62-7c63-44c2-8408-784ff2c8a14b", "comment": "Malware payload (Mirai)", "value": "f52aa86df90490594d9bbd970d40cb3bf194eebe87a30c52d5cb3e1bbc6625de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299064, "uuid": "9f6c26f5-3e74-48b6-96ff-6cc6ee275d24", "comment": "Malware payload (Mirai)", "value": "4665e18cc1bb84cb6a580763cafbf9354190f632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678299064, "uuid": "47bcc625-bcb2-463c-8fcd-4001e5537bf6", "comment": "Malware payload (Mirai)", "value": "9e688701315492e8fad1d87bdfc15b84915f41b737a68e7d47b19c653aacf9d38299f678dfb69fb843ec36bcb6e17bc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299064, "uuid": "a9c538cf-e711-4f1a-9f26-b72c4f83d551", "value": "T189633BDAF801DD7DF80BD77A4457090AB530B3D506830B3B63ABB9A7BC721986913E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299064, "uuid": "be06b786-db8d-4ee7-b1ff-a79ea4f6f8e1", "value": "1536:EaYwtaNVQxI1EtDYX3Ax8Vw/Y1LxR071dJ67yk/4LZQ+e:XYwaNmttEX3wY11Rk1/hLZPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678299064, "uuid": "b312b85e-073a-462c-8e0e-0c6a0c05eacd", "value": 69608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678299064, "uuid": "48423373-1bfe-488b-80e2-b1812ac89a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678299064, "uuid": "deafd349-6501-4b78-829e-73f667947799", "value": "fd4ac43bfd80367624e8656bc1952d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740d2e66-bda7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678276242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276242, "uuid": "a8ade8ea-572a-41b3-bca4-dc7f8c6c3663", "comment": "Malware payload (GuLoader)", "value": "bdeba0194e78127be86628f57144788d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276242, "uuid": "bccd1326-7e95-4237-91fb-1210ef41cfa1", "comment": "Malware payload (GuLoader)", "value": "f5b2cd5bac3cc6571868e57b5836e377df7e14c2f3ea1e84887665ce9b367d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276242, "uuid": "57fe96e2-793f-4a91-b264-9b198ecf4333", "comment": "Malware payload (GuLoader)", "value": "3196b0d88fb62aed848a87236de5fe1746f5c77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276242, "uuid": "7f4db14c-f08d-441b-8601-d48334b50594", "comment": "Malware payload (GuLoader)", "value": "4e3f14c42a24d5c1025f519db9f112b482efe34561602ef4d7898011b41337f9fc897520c1a845ce628cb3b8763cfcdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276242, "uuid": "afb07b6e-e3f4-4ca1-b299-1c13a93feed5", "value": "T18A5412C13290ECA3DD284530C9BBDEFABAB5AD6AD0604B5B23457F497B733D1982D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276242, "uuid": "4322049e-1f5b-470e-86cd-9719c44d29c9", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276242, "uuid": "c7696c9c-6d06-4419-badb-9f87f8b9e164", "value": "6144:cM23XWr4UGLGk2rmW1KmOvUKO2GSQpFq9AnzHclR6w35gFpHYsT4GJA:UA4UGbjmWU3LS1qnzH5OONY6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276242, "uuid": "09bc9932-7ef9-48c3-b679-65b037084b02", "value": 285888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276242, "uuid": "6bb3ca3c-6402-4f61-beb3-04d37389667e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276242, "uuid": "9851d5b8-415a-4e15-a2e5-84b6e046aeb7", "value": "f5b2cd5bac3cc6571868e57b5836e377df7e14c2f3ea1e84887665ce9b367d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47832694-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308379, "uuid": "3988fb91-650e-4695-9bfc-4abb81efdf22", "comment": "Malware payload (SnakeKeylogger)", "value": "b5151a6e05fe8c4cfec9b36a36f8d825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308379, "uuid": "b9fbbcb6-63be-49e4-9d8d-bab28757701e", "comment": "Malware payload (SnakeKeylogger)", "value": "f696cf27f040cb96782232e31aeb05f705c9eb8451c2f2394c93582cf605b69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308379, "uuid": "d406e1e8-ab8d-4fa6-b019-6fa0c1360379", "comment": "Malware payload (SnakeKeylogger)", "value": "57a887c29fdd6b3fd06da7b1a1315a0b2bd918ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308379, "uuid": "05d4a923-e2b0-43d2-bf1e-f28a76141b90", "comment": "Malware payload (SnakeKeylogger)", "value": "6ce7f131086681bf1619dae5f6c91cefd8ed0b82ee5de808e9212e729216e5aec0d6a180713e8faed0872129c8137b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308379, "uuid": "f62d2615-e626-4e75-9165-1b5228868d53", "value": "T110357ED1B1B08897EC5F05F26C2BA53028A27D4E61A4C12D567F7B56E673377308EE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308379, "uuid": "90ff1b95-5704-4283-84ba-7810847d95e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308379, "uuid": "23242630-3bfa-4088-a8a0-7debb544d69d", "value": "12288:Ea/5u62iNQpDG22b7VrF2QYneXQo0MfoeSTRbsPkgSSqdiXNBn6:Ea/5u61h22bRFf0MQmDSRUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308379, "uuid": "0c992b94-f037-4dc5-b69e-17d551205dc8", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308379, "uuid": "5aca84ba-d90e-4bd9-b0f0-8f1003b6ee2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308379, "uuid": "11738867-5335-46dd-a833-dc20690002c7", "value": "delivery notepacking list PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d753c5-bdcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678293559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293559, "uuid": "91c4bc91-d2c9-47d9-9fe5-8630c83d8c0b", "comment": "Malware payload (RedLineStealer)", "value": "4526782c66c5114d3dc1909a656a1d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293559, "uuid": "f2ea3f18-1462-4717-ac9a-66d4b945b438", "comment": "Malware payload (RedLineStealer)", "value": "f6ae8c2cb6a6fa1c6983d535640e6b1589434bc8822f5af1d9c7e1bdee658810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293559, "uuid": "036f525e-b7fd-45c5-8b04-b7bc798dfe0e", "comment": "Malware payload (RedLineStealer)", "value": "8f02ff0f3e2b1fd0e4dcd7280672030e30ccedf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678293559, "uuid": "a0c9467f-a119-40a9-afe9-3a26640424d6", "comment": "Malware payload (RedLineStealer)", "value": "a427eeff98833c7a9a5942ba4e81f79a43a516d23ed76358b4f2e1666c4672f1fb7c725188ac61a63556fc4e0a3acfaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293559, "uuid": "012b8434-7a27-4697-9795-ef59d4ef5d9a", "value": "T1B6E4021163B0AC22E36346719F2EF2E16E7EF5625E3BE6D922145B2F19B10F1C953312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293559, "uuid": "a170d953-3c25-4e4e-8f4d-6cc91823b954", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293559, "uuid": "1c746b0b-03ed-44d1-b585-d763430a1c6b", "value": "12288:SxpuT17TXnao3tkR5EHaLcICtDdxWGiGl112T8KtOWTmAAz:SqB7Tv3qqaLzuvTRlT2T9Nmfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678293559, "uuid": "9044f06f-3de3-4eec-82be-0cbd32f9c89a", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678293559, "uuid": "3798a115-32f2-4cf6-a1cf-595674b52f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678293559, "uuid": "ac482a8e-35f6-4ea5-9d35-ed8cc67cadfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bf7cb3-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678276518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276518, "uuid": "52d0758e-3539-43dd-998f-f6137c9db606", "comment": "Malware payload (AgentTesla)", "value": "3a7f66b8f082ea1d24dcdffd2ce276aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276518, "uuid": "c3ddb50d-eeee-4ad2-9774-1e10ca4071f7", "comment": "Malware payload (AgentTesla)", "value": "f81ea0341cc62ab6c2d730bcfd2d03ec3a970030b028c2083c3e4cb59b2efe9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276518, "uuid": "acf9593f-ff39-45b5-b1cc-7cd0de3cad01", "comment": "Malware payload (AgentTesla)", "value": "38edb1d67a6ce979212fbb727482460ebbc9f6e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276518, "uuid": "092f3392-3873-4348-b7f5-25cc09cb2d65", "comment": "Malware payload (AgentTesla)", "value": "21e598e11dfcbb743f1f5999873b83609597a2d014b3a746bc5c534fcace31596a3b0a5071fb070ad2da3ea3e8314769", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276518, "uuid": "e0047410-48de-4bdd-91dd-d9aa338c9e10", "value": "T1F615CE98B3714123ECDF81790927C5DF2D04F98B7621E237573B7A82E2591BF7A48222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276518, "uuid": "556d53eb-ebba-4518-ac90-efc5d72b3839", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276518, "uuid": "470b81a0-7851-46ef-a9f0-f9153f1bf452", "value": "24576:hEP78/1/MTARZOiOpX9yr9yQl9QyclnCw4MzDcyo:xi0T/nZ9VWnCJyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276518, "uuid": "b6801a94-b736-416e-97b4-c6f9e86d1980", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276518, "uuid": "6523baa4-8870-4a13-8358-dd5a85d87e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276518, "uuid": "aebe3648-3c8f-49f8-8e60-a7358e12dd1a", "value": "New quotation 20230203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d81b85a-bda7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1678276204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276204, "uuid": "f41c58ac-fb43-41a3-9c5a-7f198abf0c78", "comment": "Malware payload (AveMariaRAT)", "value": "314121adbd05ae03c385028988fb4e1a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276204, "uuid": "743ba090-6760-497f-84b6-6839598430b5", "comment": "Malware payload (AveMariaRAT)", "value": "f8327f12b0690c4b14cb1193aed97f419452ba86d05b633f5c24d3edd46221a9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276204, "uuid": "55ba540a-ecd5-47db-a67c-56b9515a514d", "comment": "Malware payload (AveMariaRAT)", "value": "2cb28f8007b98d354c1f10857f53ebd261d18392", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276204, "uuid": "e109418d-ec3a-4662-9f74-403ac599d475", "comment": "Malware payload (AveMariaRAT)", "value": "1a15af3a260dd3f6f03e7f55ac375629c925a6c26da4623ef09116f1fa01b472f830dde1d00764cff57d3e8125500675", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276204, "uuid": "6ef0dcbb-52eb-4ed9-8737-376df9997f22", "value": "T16D933A3557C8DB1BC7EE03B9E4B0912447F2AD1A5163FB8D4C9831E66D733A10A2226F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276204, "uuid": "e9052269-a4c2-414e-80af-a7d8bfb839d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276204, "uuid": "a053a10c-4912-47bd-b03d-d59e44608197", "value": "1536:vAaxBx2d92DptEHNdYkZp+4nvN+WmMR10HrZmOlH/LdJ5B4dVF4c+IOBC5j37Ig9:vAUCjpZp+4TmZxlfLdw+IOs37IgZpppV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276204, "uuid": "9d3918d4-be90-4a85-bba4-2d9817fb9371", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276204, "uuid": "bcd75772-bd67-4497-97ee-ea613f216219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276204, "uuid": "1976533a-a7e5-4f96-9ebb-059b5fa42a8e", "value": "Leaflets & Company Profile_Doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c817d96-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289973, "uuid": "49f04182-a419-4497-8ba9-9d3c067b93f7", "comment": "Malware payload (GandCrab)", "value": "0eabe059f84911449f17fdd20ce3072e", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289973, "uuid": "d0fa865e-0a0c-45d3-b3e6-6a9afbf7c677", "comment": "Malware payload (GandCrab)", "value": "f85399cb1864fb7fce0f1902db1cb1b45902d601108416aa7fd4e3a869ec55c0", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289973, "uuid": "ddfa74a9-4dc5-456c-838a-2cac4883018c", "comment": "Malware payload (GandCrab)", "value": "d9b30ddb34cdb52bd5f748588ee90fd43d7d8cb1", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289973, "uuid": "148a3d27-cbc0-4877-99e8-b85dbcd31fcf", "comment": "Malware payload (GandCrab)", "value": "0d050279d23f33d026d2b2dd80e10d16d09e9ffc9b57e5d3df3bc893858d017034c8db9f2481018ca07794486ba63c67", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289973, "uuid": "2868ab68-7c5e-4ee0-881a-d3676b4005a8", "value": "T1E6636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F568220F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289973, "uuid": "56eef7eb-659a-4362-a3fc-046b8fc71d2a", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289973, "uuid": "ef07ff9d-b16d-4540-87a1-a89559e2fb1c", "value": "1536:NZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Md5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289973, "uuid": "299c543e-2d08-4107-a14a-cae7215079b5", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289973, "uuid": "a387e556-1e10-4e01-8c2e-5793de2f5212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289973, "uuid": "c9dd0cde-6e0e-4855-9c7b-d1acb36be3c9", "value": "2023-03-07_0eabe059f84911449f17fdd20ce3072e_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c32d897-bd86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262082, "uuid": "2dddfc5a-183b-446d-974c-3de21fc86c68", "comment": "Malware payload (AgentTesla)", "value": "0bcf648aaec668d0f208abd5deb56cad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262082, "uuid": "3d26151d-1dd5-4fda-8cf2-5aa8d400135d", "comment": "Malware payload (AgentTesla)", "value": "f85eee48a83f5476bcd38bcddab53fbfc818d591c07e1c01fd73934a21f9ca7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262082, "uuid": "bae61446-13b7-42bb-9c86-c2a4701332eb", "comment": "Malware payload (AgentTesla)", "value": "7b1042bd14da1a3f9c6e85213f0c9cf68ec5d422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262082, "uuid": "72e3b0ba-1d6e-4295-95f8-8efa3c9bcebf", "comment": "Malware payload (AgentTesla)", "value": "be5cd504466316fe3cff0afa4bb9f1dab557a96bcb9ac063df3a32583683816ff934e11d554b50a2438ad55ddc9ab0e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262082, "uuid": "69cedb3f-c1c1-4d4d-928d-100a55d64c9c", "value": "T1FA05373CFCA49BD6E13AF7738567E210F3F590F2B311C8166EE2488406A4A75A2DE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262082, "uuid": "935d764a-f5c8-4d18-9138-652eae594a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262082, "uuid": "594f11d1-9994-4ff3-be97-dbdaa9963e41", "value": "12288:7eFEnHobVYDexYXbR8anV2X/clGQrnURro3BxXcCE+tM5qK:+EHtDeoeUGQKrWBmGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262082, "uuid": "3a2d540c-7690-4440-995d-29e70b3a5eb5", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262082, "uuid": "af39385a-d926-4111-89f0-3e04a248c951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262082, "uuid": "4e96ac2c-d259-432b-b8d5-7303aee4962b", "value": "Scan_0013882982_SKMBT Remittance Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed75824-bdf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678308392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308392, "uuid": "f16f587d-04c3-4cda-bba7-305adae5ff7f", "comment": "Malware payload (SnakeKeylogger)", "value": "a58224fec4e31b1904227037339bb386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308392, "uuid": "4c4af23a-34bd-490d-965a-9a6171406382", "comment": "Malware payload (SnakeKeylogger)", "value": "f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308392, "uuid": "74b009d9-8c25-4b76-abb2-6dd717a17b4d", "comment": "Malware payload (SnakeKeylogger)", "value": "ab9dab1df5b30fbd8ae86ff647df2289cd248477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678308392, "uuid": "82bf5cfe-14bd-43e1-87b7-d19ef18e2f79", "comment": "Malware payload (SnakeKeylogger)", "value": "5a2e7e079f6dbf0e5360d067622bd2fd99e67a6def512ff2a44458f1a7eb7967a80d64dc715077ed5ad66ad3a4b50679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308392, "uuid": "88583f87-d289-4120-bea5-7150328f8ffb", "value": "T1FE05CF95B3B15463FC8F41BA192BE19D2D7171437315E23B5B7B3AE0E2119BFB288242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308392, "uuid": "ffdce03a-482f-4c3e-8d51-6eb7c39db63e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308392, "uuid": "d42ed275-cd59-4f43-b8fd-c9d528e1da67", "value": "24576:la/5u61WhDgRtBnIr7OzMSdQLp1Qtog8:mLj07OzMvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678308392, "uuid": "68036dba-74da-41e4-8795-f74646eaf623", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678308392, "uuid": "4ed85071-97e8-477d-8be1-c728ca440d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678308392, "uuid": "482317ce-7913-4ee0-9416-7d8af0ff2802", "value": "drawing and specs.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3306e9-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678262916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262916, "uuid": "d50e235d-9d2e-452f-98c5-e5402e6d1774", "comment": "Malware payload (AgentTesla)", "value": "8301a95732df93b5fc7ed9cf9b87b2b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262916, "uuid": "068a68b4-5124-4185-aa18-5c51db25576f", "comment": "Malware payload (AgentTesla)", "value": "f8db919f34a3d0adbab3adae4d5dd2f8992db2f25afec21bec5ca55650ddf583", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262916, "uuid": "c1988c64-14c7-48c1-b122-ff196352231b", "comment": "Malware payload (AgentTesla)", "value": "13c4dbf5db6ef52a0de62ab16118c30f53e0684e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678262916, "uuid": "76a6f9e3-8c2c-4551-adea-6477de66af0f", "comment": "Malware payload (AgentTesla)", "value": "b822741eafca571b6440784bca158d7fa2cefd7438d1eb3c3ad0cad281ebf3f0a3cf5c4c5191aafc32727105b5dd13ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262916, "uuid": "d58d3f41-90f4-41a9-9be4-433f80f3e812", "value": "T1EA25AEE83F09729FD787E4B358042EA2EB5CB95E162BC00519D7018FC68DD6D4A12EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262916, "uuid": "4edec9d2-dab1-49ed-8dc8-5cd8932392c3", "value": "24576:LqWOqd2UhNLdYHHR3SBvZsM8LtncfOJT58:e/qLK34veNLVcfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678262916, "uuid": "6c547f50-0c32-4415-b016-be6bbe9ab42a", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678262916, "uuid": "5351113f-6536-48ad-82b4-9e2c93545e8c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678262916, "uuid": "2a316831-5631-4181-a585-275de2fb2058", "value": "AWB #3827747403.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8f4c6d-bdf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678309409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309409, "uuid": "2c2c2a94-baa5-43c5-a9e6-e3c6a18635fa", "comment": "Malware payload (Formbook)", "value": "f6da8359772a109e1011b72d544fe9e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309409, "uuid": "bf7e5262-f82c-4449-a380-29df46098fb7", "comment": "Malware payload (Formbook)", "value": "f8efe35ff8fb36fd8b4125827fec4a6b32937eebeac71662a6490a61c8bab704", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309409, "uuid": "1e769aba-1ad1-421e-b825-6ea6e1ca3b6f", "comment": "Malware payload (Formbook)", "value": "e701990b94aec902f5a905c408f4106d904e051f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678309409, "uuid": "be20a389-3510-412a-a126-9ad73be96493", "comment": "Malware payload (Formbook)", "value": "e7009c3510249b7b2f08326bc0f8e1fc0696bed8f4a73efad3a91a6e10fbf2d8804295f73acd4ad4da221a2d6e31e37d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309409, "uuid": "9b4f17f6-6c85-431b-b863-87b969de0f0f", "value": "T1C153A128BE45060AF4425FA28B7A34BAE73301A777B445F5285DF2691E40FD83D1F9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309409, "uuid": "5f80ebd8-aa7d-45db-8046-0fc557ab0e16", "value": "768:T7Nu7t1b4TGQPcvLjZvFMKt8fvZJU/cjnm32LNVgQhtGvGWdiCLYE:c4YjZvZt85nKSWKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678309409, "uuid": "ffc36fef-62c0-4a3a-a912-c619fb5ce39c", "value": 61118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678309409, "uuid": "a276231f-8b1a-4e7c-85b6-eb027cbdeaf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678309409, "uuid": "f34a767b-2f07-4e62-8760-e3424b2089c6", "value": "Aviso pagamento_08.03.2023.025104938.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119fb622-bd47-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1678234845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234845, "uuid": "98376141-4cc1-4f86-995c-7c4136c4dcf2", "comment": "Malware payload (IcedID)", "value": "6e8eead4b0ebe2d0276260484e497ee2", "object_relation": "md5", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234845, "uuid": "6e8a390c-96b0-406a-91a5-fd9827319c27", "comment": "Malware payload (IcedID)", "value": "f9475c29de1061817571429391a687b0292f840a08c1de51f4254657d7363e59", "object_relation": "sha256", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234845, "uuid": "fcf1bdac-4f68-4f3b-a0f2-14665ecc7937", "comment": "Malware payload (IcedID)", "value": "fc32148273e541c942107c00462077ba22dc677a", "object_relation": "sha1", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678234845, "uuid": "59d1685d-d0f7-4107-a100-4c8adf4d533d", "comment": "Malware payload (IcedID)", "value": "a113930a23f7aa4f801fc77cfaa6ab5fcdc0b6021957f3a2d3d4a9e37e32df1f2ab979ead953b2e682c5fb11c02467b0", "object_relation": "sha3-384", "Tag": [ { "name": "2615141838", "colour": "#928E66", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234845, "uuid": "4648678c-dc40-4a7a-bf5d-af0e54ee66d8", "value": "T1D2245B17B56284EEC277C13443F9A272B632B8251372BB27B76CD7701B21F606A5E394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234845, "uuid": "37026a79-e63e-419b-863a-01bf49413b36", "value": "6144:ElKtGI0Tg+2f0/pLkR5brhEKN8M9yeF3u:xGi06Dr78IyeF3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678234845, "uuid": "6675e082-21f2-4b47-868f-e2ff6033b452", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678234845, "uuid": "e46b77a2-85da-4a35-bcea-bfc8f0215334", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678234845, "uuid": "035dd1b5-4775-4ece-99b4-f597eb63960e", "value": "sec_upd_SN-09658831.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc87665b-bdbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678285007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285007, "uuid": "1cf908d2-9083-4abb-8b37-f367ee1848b3", "comment": "Malware payload (Mirai)", "value": "e3051e9035005e40ae4aba2705764b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285007, "uuid": "e0c0de7a-00a7-421b-ae95-4e55df20a75f", "comment": "Malware payload (Mirai)", "value": "f9907cef47ee86c20e47cd0fbf19bbd67153032835641018b5d1c5fd02b6e0f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285007, "uuid": "f594b791-8925-459d-a05f-2d9772e298b1", "comment": "Malware payload (Mirai)", "value": "2b7ef1612a74da7de9ee9ff0b1fc76aab5e99eb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678285007, "uuid": "1d1ddc19-8de3-4106-aa88-62488561b554", "comment": "Malware payload (Mirai)", "value": "4121bff3306a73654429d326e590c1a8fef7adc55a2eff3cdbebdac6a02af04781eb356996f3495ffaeb15611bb1d621", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285007, "uuid": "02bdab25-670c-4318-8cb5-fc1d0ee52a27", "value": "T1C3330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285007, "uuid": "8f86a49c-fa25-4ef2-82e9-b0d1a06466f8", "value": "768:gduPBFnHooqR8qOCKq2KH4Y3e+TK806MMUVjzMfQXOtHud2oGx:r/hqaJO53eqK806MHdMfQXoHuCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678285007, "uuid": "bce2ee76-0a60-4b43-9167-6fae63bae959", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678285007, "uuid": "0df4e3e3-5a6d-4cd9-b44f-9c20c9ffebe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678285007, "uuid": "9c6f37e1-dd0e-4cfa-9a6c-8e6112e89289", "value": "e3051e9035005e40ae4aba2705764b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f341fbc-bdbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678286407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286407, "uuid": "9e83f543-0a1f-4910-8db9-1f71b48cef58", "comment": "Malware payload (NanoCore)", "value": "42006852619847f368bc4062849cd6dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286407, "uuid": "ad2d961b-33e6-4e1f-aa52-b05ae3f1c87d", "comment": "Malware payload (NanoCore)", "value": "f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286407, "uuid": "4ec01910-4f99-4f55-ac3d-31a6e590efe6", "comment": "Malware payload (NanoCore)", "value": "ba6edc3a5aba8eac15b6a30e1407cdae80b2481d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286407, "uuid": "ab17e3d9-698f-4c4c-b864-3f2306d6f655", "comment": "Malware payload (NanoCore)", "value": "201a8c71a37dc4dbd0df68b438794dab6fa7ae615b5a6a2e73ad4db8e2173640f1fd04e11272028001a4a010d64b85b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286407, "uuid": "4c40e23d-e589-48fc-9b2f-88d1f05099fb", "value": "T1B042D61EDF8CC667DB6993BCD4E24E0A1760A431BA73DB9FB80481640587BF8051B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286407, "uuid": "f2c069c8-4bf9-49fb-a900-6461b6176688", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286407, "uuid": "05dc8e9b-bc86-470c-8ec6-d902cef5976c", "value": "192:Wb5lecl5SzxgU1g16ldP8i9CL69w582bDAetqL0yQA+cj:Wb5QlnrdP8ICL6q5vb0et9yQXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286407, "uuid": "110908a0-841a-4de4-a65c-5ae800da4616", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286407, "uuid": "b9767c16-8d64-4929-9092-d0a7a0e1ec8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286407, "uuid": "d2d409f3-311c-4dea-af2c-d66828a2aeb0", "value": "f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61431388-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678268050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268050, "uuid": "5e5ed3f7-9f64-4111-8e99-8cec278c83ec", "comment": "Malware payload (Heodo)", "value": "64048e240c1db85470fcab72ef05b1ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268050, "uuid": "6eb30856-7524-4bbd-8a77-81586b7f0f76", "comment": "Malware payload (Heodo)", "value": "fa3d349119a0d23573d2f35770da77e082ce3434934a6e98ed43696b40043761", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268050, "uuid": "3a29776d-c944-403e-8069-cd017aafe29e", "comment": "Malware payload (Heodo)", "value": "85226cf76a1a6b72bbdc146f1a535fb1ba891c94", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678268050, "uuid": "194a897e-5f23-4892-8848-309e57016d7b", "comment": "Malware payload (Heodo)", "value": "07d35a195b77d5a38a3d2e9a664a4aa675d63914375e74c8600f7180235af5eacfdf222155a58123aa341eb3f91b674f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268050, "uuid": "98a79d74-1613-4379-b510-6c5599159664", "value": "T14315233C5F67790FF5997C362AF3847AFDF9085CDC96A90A17432A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268050, "uuid": "37eb3460-112c-4f45-bce8-7d5234d6cab0", "value": "12288:74DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sX:0evtlkdJe4m19Fgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678268050, "uuid": "b8c1c0d3-1945-4f08-a5d8-a1b53e6dc9bf", "value": 894029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678268050, "uuid": "28cbe9f7-2e14-498b-bc34-5f2cf03e3a95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678268050, "uuid": "15357c63-37b4-4a48-832e-df469c3b34f9", "value": "TRwu8tfxztNty5tIogFjsKG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132efa54-bdab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678277797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277797, "uuid": "5ad24b35-c9c5-46d1-8cc7-36a4b44c690f", "comment": "Malware payload (Heodo)", "value": "46045a41586ef3e6fc0caf3b52bf2714", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277797, "uuid": "8650d20e-e19f-4167-86a5-a1c453888374", "comment": "Malware payload (Heodo)", "value": "fae8c23da9a25a918688104c4cbc6c256178c82e0031a9949bc182696c740ba1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277797, "uuid": "9d0874af-9add-4589-860a-ceee0508b650", "comment": "Malware payload (Heodo)", "value": "526b550012f7305b501b017dfb6ec0afbadd1788", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678277797, "uuid": "de3d828b-a65d-4938-97df-ab334c5c03e0", "comment": "Malware payload (Heodo)", "value": "5fda64cb95969ade16c655d278c061cd8a3e823406ec0c2da87d99d5af9a6d494c0a5656c9526874366ec371544509d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277797, "uuid": "e93ab14d-98c7-41d0-bf73-cd8a797cbee0", "value": "T17A15233C5F67790FF5997C362AF3807AFCF9085CDC96A90A17531A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277797, "uuid": "6f8f3ef7-1f92-4a50-b2d0-7e882f6378e4", "value": "12288:v4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/s2:wevtlkdJe4m19Fg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678277797, "uuid": "3cebd388-0216-4b4d-8376-6d87af2598df", "value": 886880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678277797, "uuid": "1330243b-3b25-43b4-9651-50d195133b98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678277797, "uuid": "ed87cad0-9fc7-4ec7-9dab-da8f64a1313f", "value": "MMIj8s8DvPmOjLiAuxD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411723e3-bd8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678265419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265419, "uuid": "a3425dc9-835d-4d4f-98f2-ade73d1f67b3", "comment": "Malware payload (RedLineStealer)", "value": "2b809d73b0b5062037119fd327fd5ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265419, "uuid": "97984e0a-a7c3-4c23-bcbb-0a6cb086cd85", "comment": "Malware payload (RedLineStealer)", "value": "fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265419, "uuid": "0b47dbfb-7522-4048-9ebe-1c23219f968b", "comment": "Malware payload (RedLineStealer)", "value": "bfbd54086f2099beeadb22834f9d2cfa3505e2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678265419, "uuid": "f287427f-7ec2-4125-9b3b-5059cbb13095", "comment": "Malware payload (RedLineStealer)", "value": "4cdc7dc681d1e9b4d180ac1e83d69a475ed3fb9c96d8c108828b91abec11c97391cb0b318081f1d57d4a6636faf6b719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265419, "uuid": "c92aac68-3134-4cf1-9f6b-2ef7a816542f", "value": "T10CE4020292ED6922E6771B727F3EC3E4562FB9639F24235732046B2F19712D19972323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265419, "uuid": "9fa9bef6-76d8-4e42-8afe-60495d6eea96", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265419, "uuid": "80b7fb85-3c6e-4a7e-8c82-8c6ab3d1b81d", "value": "12288:pJI3WClIN8y/AZYHhiY8HtjPFke4OGY2Z9dsGlt1yz58eJvBDb:pJI5q/0YHhGNjPFx4OGzvssteRJvtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678265419, "uuid": "37e92c42-5e70-488b-bba2-acc62dea9d0c", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678265419, "uuid": "70ad0ba3-83e5-4fa8-808d-8ba35871a954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678265419, "uuid": "7bf3f2c9-485c-47fb-8f08-908256d36282", "value": "2b809d73b0b5062037119fd327fd5ab6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288b0227-bda8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678276545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276545, "uuid": "06824579-e87e-4e18-80d4-46307fe2a85b", "comment": "Malware payload (GuLoader)", "value": "bec78df47ff8cf0b1961430b92790ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276545, "uuid": "5bd96e45-26ea-4979-88ff-dcb814b18582", "comment": "Malware payload (GuLoader)", "value": "fb4acd018acf7a2682ea82e941f8167c2008bbdb7fec77ef8fc91d786835c309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276545, "uuid": "aa7098a4-c224-492b-93d0-0da438911847", "comment": "Malware payload (GuLoader)", "value": "25500dd32e965451340cf48d1c010d3840cfebcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678276545, "uuid": "425dd5ab-6190-4f9e-b6eb-3ac182fab064", "comment": "Malware payload (GuLoader)", "value": "a64a6e321dc504ec4a4cf77f2cb593f71b3b1dd2f55166043757ef8083e971ec497617d53918fbc20f40805e24a3155d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276545, "uuid": "20a3d2e4-ab80-402b-83c4-eed91c7de3b3", "value": "T1105412433BB4C5B3F5A4CBB1F9BB6F1B2FB9507C8658134B7B448A5438924B58B0E909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276545, "uuid": "2321c6f0-535c-4e69-8d20-51ee79deb637", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276545, "uuid": "decbb7cc-cf51-48aa-86de-c2cad5e2465e", "value": "6144:Tps/ya+u+kM3zB99Go0YAP9vVbOOt2AeNDyQ2cQn7bk6bhs/+EeP:Fa+uGjv0YUVbLHcGFbhs/YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678276545, "uuid": "f8df9abd-0dcf-4dac-976b-05a2d2237616", "value": 297032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678276545, "uuid": "279a8156-58d9-4500-b603-1257edc688bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678276545, "uuid": "369f8011-636a-461f-a425-7ac3e0cd449f", "value": "fb4acd018acf7a2682ea82e941f8167c2008bbdb7fec77ef8fc91d786835c309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1219f17-bdae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1678279404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279404, "uuid": "9756134d-afdb-45f2-b9d5-3bc41c73f469", "comment": "Malware payload (Heodo)", "value": "66f354e49d580165ec5bb355981276f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279404, "uuid": "afd12a36-a373-46d5-904b-dae0b8774b8e", "comment": "Malware payload (Heodo)", "value": "fbc7c93059e6115456970c66454c1b3ebe2518f08064441815ca8ea42dbe2f80", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279404, "uuid": "0e27331c-db99-417a-895b-a3e56625ca5a", "comment": "Malware payload (Heodo)", "value": "dd8962256148f2b6430aef6101cfa728fdc3b4d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678279404, "uuid": "cdeac43b-c26d-478d-a22b-2df7c25d3bb2", "comment": "Malware payload (Heodo)", "value": "f3f02a8e2863172e30cddef7b7767dba15bee743cd58f840ea39b969e4b216c24ddaadaa9992392372c0fc00d5308674", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279404, "uuid": "af7c25ec-065a-4fd5-81a0-29fe24b8a5e8", "value": "T19A15233C5F67790FF5997C362AF3847AFDF90858DC96E90A17431A9209AF2046794E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279404, "uuid": "d1dd1aa1-ff51-4909-97bf-385ed5c363bd", "value": "12288:x4DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sB:uevtlkdJe4m19Fgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678279404, "uuid": "b98bfd7c-1f05-4645-926e-7f3d8acec62b", "value": 881788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678279404, "uuid": "7011f2ea-fbc4-4417-9bc0-1ee4166d0918", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678279404, "uuid": "b0e04014-49a9-4f94-b157-5ef76719af60", "value": "2Tn6kzU0Il7E1b4NgrCMtpbgA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe36899-bdc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GandCrab)", "timestamp": 1678289979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "abbf31ec-ff2d-4d3c-bbb2-32b64d5631c7", "comment": "Malware payload (GandCrab)", "value": "e8e2ac7e4c04bec6956815da2d1a89a9", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "25950e83-fcec-4b46-9b3c-72e6654ed274", "comment": "Malware payload (GandCrab)", "value": "fc89cae4c4b985f224a7e8e33deedcabcbdcf86a5b21e7a88a2f529db9083660", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "2ad059b4-b4bc-476c-83b5-6d8a3bba270c", "comment": "Malware payload (GandCrab)", "value": "b38caf3c446661fb29e5a77644d7be5b26f279e5", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678289979, "uuid": "bfe2ed95-a27a-4190-8d0a-fb2a23969e6c", "comment": "Malware payload (GandCrab)", "value": "995e274c106843241dd23014efc500e316e3d27062da97e122454d6ea7faab4120afa5eb155c69e6d8feaf0e0a0a2f2b", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "ba54e3fc-274f-4f86-be74-826842e5fccc", "value": "T10E636C1DB2D1B293F1E396B9FAB57E25445D2D103B056BEB08A369F968120F16C3B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "5e19504e-e5e5-4727-b464-aacab1747baa", "value": "8735e6cad23590d9b5b60978db488a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "71d7a2a6-d8f8-46b6-ae9e-beb2f1cdf3a8", "value": "1536:LZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Kd5BJHMqqDL2/Ovvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678289979, "uuid": "6c6be71f-c8b3-4da0-a8d4-349ac80f3d60", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678289979, "uuid": "0280cd5a-2633-4d54-818f-f1dde9af12b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678289979, "uuid": "0db82855-718b-41e7-87fd-8ee2b3ecd11f", "value": "2023-03-07_e8e2ac7e4c04bec6956815da2d1a89a9_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11080692-bd94-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678267915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267915, "uuid": "619e74be-8858-4aae-bfa7-8fbc8998b363", "comment": "Malware payload (SnakeKeylogger)", "value": "1ac1be0e7e1a945a547a3c19e3f9f2c9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267915, "uuid": "f7d8c1d4-f1bf-471c-9250-923aa8aab406", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267915, "uuid": "c7a2db1e-9443-4945-8c68-5ac8c933a1cf", "comment": "Malware payload (SnakeKeylogger)", "value": "dc0032b4f82bc884a7f428f93ea8fe8452772402", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678267915, "uuid": "579a3b07-f479-4e52-b026-a0037cb8e5a4", "comment": "Malware payload (SnakeKeylogger)", "value": "ae8687c78c8618f04447b5089c87073b7d96d0e1e28f59f081fc0fc514298cc5d78b36ed102a3cf63cb5a7cc332539ab", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267915, "uuid": "60e8aca0-ed26-4ef3-bad7-22e9dfaf7252", "value": "T1772412F5E4723A12F4751B3EC6F208922BE460133E5E646D6F1D3AB246C846E68D84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267915, "uuid": "528e3a45-1210-4e93-98ef-f02b1cc995d0", "value": "6144:/TFaoPISXKQF/lgvyDTUlCqbf077u0xLB8SispK2x1S:/TsoPjbF/lgvcTUlTbfqu0lzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678267915, "uuid": "9d646507-67d7-49e1-873f-13c91d78686a", "value": 222153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678267915, "uuid": "9ddcca9f-988b-4321-a5fa-392f4d9205dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678267915, "uuid": "2658e314-7a26-46bd-af68-b68737494b00", "value": "Shipping Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ff9b68-bd80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678259419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259419, "uuid": "c6774e6d-1457-4a0b-af33-dd1710fe5cfe", "comment": "Malware payload (Amadey)", "value": "0f63174b0eeb561ed37c14ed4e57e6b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259419, "uuid": "28e446fe-f70e-4198-ac91-2a4eefeac338", "comment": "Malware payload (Amadey)", "value": "fceb3b6d7ea0f7d13e45f8aad5f61490f8ab9b095b1a5872aa370fec58b03715", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259419, "uuid": "2b8db4ef-056c-44de-a012-1fbb03b1e807", "comment": "Malware payload (Amadey)", "value": "57ccf2c95cba79b2310e858dd55491e8f0265534", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678259419, "uuid": "3b89e50f-46ed-4fb5-bb09-fb277fe050a0", "comment": "Malware payload (Amadey)", "value": "3c02b40901487211346bcc982302ce5ce4929909dde883faf9aa427755675ed06f017766ed0d7d2c50689ff549dd30a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259419, "uuid": "a8a97db4-4121-48f9-b873-bc5bb1f97727", "value": "T18CF40212B2E17D11D67B4A725E1FA9D87D3EF5204E569B6A12388BDF0B312B1C1B3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259419, "uuid": "ec6dd510-1c3d-4236-8543-fe791e40d05a", "value": "d830a1acd5e70912b6ba60beaa84ef80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259419, "uuid": "456cc3d8-667b-4a31-b085-ef4649fbe784", "value": "12288:Rm6pfk35o48lo+f4fZjgpfoRQZ7DuPpDsTYksCPIKh/yZDRYZiRjuz:7kiVO+bfoRaPuVsTYks+nh/yZDRYZiUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678259419, "uuid": "637b9853-426d-4794-817c-f7f411342c76", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678259419, "uuid": "6ff1a1a1-a46b-4e8b-b247-3004803a097a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678259419, "uuid": "a18ad364-dcd6-4cbf-a682-69d40497dae0", "value": "0f63174b0eeb561ed37c14ed4e57e6b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6601cf69-bdbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678286097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286097, "uuid": "dc1a1e0e-3463-4313-8f1b-5c3836cc78ff", "comment": "Malware payload (Mirai)", "value": "be5de076acc866c4420fef6034acc464", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286097, "uuid": "b3b897a3-afbe-4b2f-8a38-3467016d0d2b", "comment": "Malware payload (Mirai)", "value": "fddbea4c3874e124566e3d4739a32463da149195aaa927d1af7c0bf63d27ffb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286097, "uuid": "10697c1f-a681-4d80-a880-d2613b602eaf", "comment": "Malware payload (Mirai)", "value": "e5030fd71b35d18ace95198d65b1ca0a1e449f6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678286097, "uuid": "4cef81f0-f13d-40ff-ada8-e8b3c3ad5321", "comment": "Malware payload (Mirai)", "value": "8f301a611280aa7a7f0c3125c88572eacfa76d33543a9ece1f74ec2731991abca6d20bf705285d08840b7d6bf6592892", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286097, "uuid": "0a3180e2-d7d0-4727-b856-3e752e666ce1", "value": "T187C2D0F0E664A961C4704D37E12E4ECB594A873450FB307BB2644D64CAE7DCBE9F4292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286097, "uuid": "f5d1a051-79c3-4d6c-85a6-64fdca74402a", "value": "768:AMKyhegCCMqfUU6XfQa/ug6DN9q3UELuX:nKy4qfUXfuqLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678286097, "uuid": "582144ff-557c-4cba-a652-beb951cf5f63", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678286097, "uuid": "46d83305-0869-447c-b5a6-33aaa68f2a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678286097, "uuid": "4ee852be-aa56-43f4-8c0f-b3695943faf6", "value": "be5de076acc866c4420fef6034acc464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd6471c-bd4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678237204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237204, "uuid": "3a542c11-5464-4301-a93e-de43abf6a163", "comment": "Malware payload (Mirai)", "value": "a57de0351cdc6d72df7943af1f17f41e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237204, "uuid": "ff3c7a5a-0a9b-4f26-a16a-b8a61371e8f8", "comment": "Malware payload (Mirai)", "value": "fe9f3cbdbc9132eb03d603f0a99c582332bfd055d38e086eb53eefa7eb141fa7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237204, "uuid": "e036c4c5-8d36-4a22-920a-81bcc12f790e", "comment": "Malware payload (Mirai)", "value": "536eee08a4946b671b87472c51474553dd526059", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678237204, "uuid": "6478063d-c7cd-4288-8333-57c8723eb221", "comment": "Malware payload (Mirai)", "value": "ab36cd6ad22a7893352a6b792d7dd16b5d2b378618305ce11db460ee20a621051bc491bee3d14021abaa2a9918c214fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237204, "uuid": "084decaa-5ef6-4a59-aa34-49c127b93dc2", "value": "T1DCC33B0AEB408B53C0D61775BA9B434633239B54E7DB73069928BBF43F8779A4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237204, "uuid": "b44295c7-3949-4388-99b6-6205a4628325", "value": "3072:wF6SR7RMrSC3QY3e8lyarkBiP5fplfOLUc7M/9fb3:wFNR7ISCgqBlfrkBiPNpcLUcM/9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678237204, "uuid": "ee06ee58-5567-482e-8ce6-c5f03febd863", "value": 125716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678237204, "uuid": "3da1acb3-6ce9-4911-90d2-a50c6fe071d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678237204, "uuid": "af210b00-e6d4-4335-b74e-5ec3cf9634da", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1a097e-bdb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678280741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280741, "uuid": "246b8e9c-770f-4db6-8dd6-a0074719b083", "comment": "Malware payload (RedLineStealer)", "value": "e2fa590001fba01014179e7ce2e9a92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280741, "uuid": "077a554d-7989-4cfa-a7c9-2ea8d0cb9134", "comment": "Malware payload (RedLineStealer)", "value": "fec0f46a728f0b1906b753eb5e294203a820e06caa4c44d03b8cdbb50a47f840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280741, "uuid": "40e2b06f-a52c-4424-a2b5-91578581771a", "comment": "Malware payload (RedLineStealer)", "value": "c44fd95e1f5ba0783909d25e23eeca4d9cb0318e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678280741, "uuid": "bdead67c-c76b-44db-8a34-3f91ca05d7ed", "comment": "Malware payload (RedLineStealer)", "value": "45e96e6e1dd93ec566ae38709a91571b295897b22e4a89f39aa8ad1853b13f0f064123c0dd7f4311f4297d40f51ec52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280741, "uuid": "b5b32448-eca7-4798-95d4-86e8c46eb9ac", "value": "T11E552734B4F0E47EF865063209A3496C4578F8603B6294A767DF0EED0ADFE83B124766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280741, "uuid": "d52e2ec6-3fa2-441c-bfc4-a1c3adbd4ad5", "value": "858cfad24fb5db04ff86c07b8d3d3c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280741, "uuid": "2ac78b12-cd73-4a8c-b283-9f75916ebbb0", "value": "6144:cHRCtw93p7Xdxmq8dAAO3L+ZqHqtqxUAk+ENKOzDC:cHkm9ZLLtyAk7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678280741, "uuid": "e4511ad8-bb42-47e2-b100-b78bea2cb1ce", "value": 1290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678280741, "uuid": "d079b644-2d28-44f3-bec4-a9cdf3e4e469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678280741, "uuid": "50738d80-006a-423f-ae8c-332dffcae767", "value": "e2fa590001fba01014179e7ce2e9a92f.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5bee37-bd88-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678263024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263024, "uuid": "81f295e3-0272-46f2-b2c4-f99aebef022b", "comment": "Malware payload (AgentTesla)", "value": "fdef4779888519d5e5fe6b0e550d5c28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263024, "uuid": "9445f02f-69ea-4673-b4f6-aa913d80def0", "comment": "Malware payload (AgentTesla)", "value": "ff007e71d8e95799f0a1273a31178ac58a93a23fbf954bce7c48d8d14ce1b846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263024, "uuid": "8e051cfb-1c8b-4b22-8148-18292161e1bb", "comment": "Malware payload (AgentTesla)", "value": "b1ce32bd15f8a22a254e25377b92498fddcd2567", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678263024, "uuid": "d505a436-ba08-4237-b19d-c88f6889768c", "comment": "Malware payload (AgentTesla)", "value": "29e9b5caddf043a0432f2a9cfdbcb47bec626ab34675bcecc691332170391097ea1273f94794cec30d6f00cd063a71f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263024, "uuid": "409f68dc-a422-400e-b33e-c69e790d7f9b", "value": "T191B52303B9C148F2D17329775625A700AA7DB9211F79CEEBA7D04B1ECA338C1C675B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263024, "uuid": "8ac9034a-1f82-403e-9d6c-0f742b1aea6a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263024, "uuid": "bc2db1d0-4c03-4378-9077-6a553f5874db", "value": "49152:PB0mC3AJmHQ14XgQriD+IIXbYD3hEc/Zkqcb6IjpX:Z0zAJmc0riD+/ELhH/ZZnI1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678263024, "uuid": "f0106de5-cf48-4e62-ac74-5e52967c6c16", "value": 2366365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678263024, "uuid": "70b165bf-083b-4b21-8a0f-6d76bb979079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678263024, "uuid": "570efa4a-3e05-407c-b26f-d9a4d329d3b0", "value": "Invoice + BL#8477585399PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc13d26e-bded-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678306535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306535, "uuid": "e0a58ac2-6b4f-4186-8b98-2731b1c49ff8", "comment": "Malware payload (RedLineStealer)", "value": "500611ba9de8684deb7b46ee0074660d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306535, "uuid": "8430c82e-1bff-498f-beca-c58fae73f0f7", "comment": "Malware payload (RedLineStealer)", "value": "ff79faec0e6b6ca52616b242355f4ca1dc725d0225bef32bf3fb1fbcce3767dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306535, "uuid": "3c159141-91f5-4535-88c9-8ad46eeb3959", "comment": "Malware payload (RedLineStealer)", "value": "0010034a43b0c2f649b3c9b314a2d70271b8171a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678306535, "uuid": "ad5c89f4-53a8-491b-99aa-c29451ba6071", "comment": "Malware payload (RedLineStealer)", "value": "929e520a8fc9acce9c81f1104bf8608b64e68c1f9111146a07160b47142fc24963d2fddd969e4088fde4fe9fa06121b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306535, "uuid": "314be7e3-5633-42a9-9f10-50098efa744a", "value": "T12464C002A2F0AC35F6764B319E3DF2F56A2EF9514E7BEBD922205A1B1DB01D1C963311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306535, "uuid": "62e965d7-e70d-46a0-98f1-2ef8d0800474", "value": "9d87275419603abb20f5f1f078df04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306535, "uuid": "9a01af45-1312-4f8b-aaf1-824c802961f6", "value": "3072:SIHSuAoO+hleAZcrAtdAdqRSHD+Zm6i5fc8k+TsM9LJYRusAsVKa2utkF:eBoPhlGy2dq3Zbii8dn9LJYRFaa2ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678306535, "uuid": "6c625f46-fb60-43e1-8e9a-4bc788342f4b", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678306535, "uuid": "0afe7c58-1be9-499a-8aa7-a347652b70e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678306535, "uuid": "54e0e6e7-8f68-4809-b971-16fae57844a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }