{ "Event": { "published": true, "date": "2023-02-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-01", "timestamp": 1675296181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a4f4ac05-7684-4907-9231-668dbe7c245b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25e2766-a1f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675231295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231295, "uuid": "3ab7417c-5345-4cd0-a338-dd20acdb11be", "comment": "Malware payload (GCleaner)", "value": "c2fee3e7239069cd4d8e398807337bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231295, "uuid": "e75f3e12-95da-4969-91fe-ce93e5c99f4f", "comment": "Malware payload (GCleaner)", "value": "004664e37894d55f39d7154a8b78ebd10f10c1b2bdcd862511b56634ebb9b0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231295, "uuid": "4b671194-6d05-456a-9c0d-0fdbc52b96e5", "comment": "Malware payload (GCleaner)", "value": "1665ecddb21fcf56f8864df3ce7d684654ff0857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231295, "uuid": "f9c937e7-5ca0-48ba-9ace-5719a4433d90", "comment": "Malware payload (GCleaner)", "value": "37de036ad24109b8ccf6ed21c68c460b86925cfac19c78f3eaf64e0e2c42e486e62665caf1d2d4702e088051384f981a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231295, "uuid": "77a1bbc0-52e8-47b9-86c8-1ee99ad11171", "value": "T108A5338A696CCC35D161E9B80E21C677AEB66E51353CE60170E97C0F76BA3C36D0E2C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231295, "uuid": "117ea417-fe1a-4793-b565-150902785047", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231295, "uuid": "c0463139-c0ed-497d-afd5-938c5e624426", "value": "49152:icPLnQMplH+CTlTwDmn3UPeUQ/RdJSRhV7Sl8QLCgv2MR:XPLnQMjZkG510hk1v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231295, "uuid": "1357d03a-a811-4f5d-aeb6-9d4535a45b5d", "value": 2178770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231295, "uuid": "d589a4ef-da88-45a0-96fd-b6517cf7c951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231295, "uuid": "ff80ee66-9a93-477b-b676-3db63a5b5bcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c0e539-a26d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675282649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282649, "uuid": "b258ee1f-321f-4e16-b1ca-c7a90bd512e8", "comment": "Malware payload (Smoke Loader)", "value": "26c775d1c36d4633cd162d5a4ac81b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282649, "uuid": "7d2d1554-3988-42de-a003-2592e2d6df04", "comment": "Malware payload (Smoke Loader)", "value": "00cf0d57fcce08e10952008c2b901093155c5045972e2cdbdcec667811986d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282649, "uuid": "fdb4b2a9-58d5-45cd-8726-b07199ae213d", "comment": "Malware payload (Smoke Loader)", "value": "ee0c9b29ba38bde4959ae3eeb365ffdd7a540eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282649, "uuid": "344879f9-bd8f-4669-a3dc-972b3bb299c7", "comment": "Malware payload (Smoke Loader)", "value": "34eee94efcdbfe9b4e90d21b8a355a12c15d48ccbf7cce8385474b1792dd4a49787b3bb6f92e81f161aa0700ac21f591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282649, "uuid": "51bc9b61-8455-4c4c-8d16-1665ab354c23", "value": "T184649E21B2B0BDE0F652C632AD6AEFE4753EF8556E15EE07231A671F14742A1C522333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282649, "uuid": "326c78c1-199f-4ee3-93b1-6b8fde6f0444", "value": "b436a108241919d1ed46fd1d53c12eaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282649, "uuid": "2ea890c8-443a-4dd9-a7cf-9a6b54a28de1", "value": "6144:sd+LkIdRp0OKYrtAWvGwMyJwIqA7KLU8u55u:C+gIdRS230yKd5LU//u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282649, "uuid": "d95686a4-96b3-44c4-9d58-dd6eb1cef8f5", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282649, "uuid": "75e3cc6a-434e-4b21-a72e-41e689abc3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282649, "uuid": "1dbcb3f3-3b3c-4037-9b1a-865fcd0a44a6", "value": "polpbaoce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f364724-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675211748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211748, "uuid": "ff97cbdf-5416-4e24-ad16-b94949778ecb", "comment": "Malware payload", "value": "0dc2b1cce5b2a0406241bcc3e81097d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211748, "uuid": "dffd2634-bc01-472d-9671-02a5280d13ea", "comment": "Malware payload", "value": "00e03ccbd5b491755c7ad2303976a949f1ea9e778d4cf43c7f6f4ea0bb21a075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211748, "uuid": "2447fe66-3204-452f-94d5-2b454d9d893d", "comment": "Malware payload", "value": "cc258b84a510ba6c58280469354b70b6388f621d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211748, "uuid": "f58fd43c-9722-42eb-b827-633b510bfcaa", "comment": "Malware payload", "value": "882ed1e00fd7ca8052b8c2b105f600d58678d3f5855fd5c9ac8b9996904316bdbe7fda858335ca493ef219d918144448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211748, "uuid": "79678c09-c3b4-415b-951c-fa4766c14a7d", "value": "T1068533CD9EA7AC34C88C9471FE7AB5E3429C5DD4BC086BF26D04FB1BED638581060969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211748, "uuid": "3989f63e-540e-435c-95b9-5c94229c2534", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211748, "uuid": "cddaf7b1-16d1-4adc-8e31-d0e83de4059b", "value": "49152:XDVmvHyQ3oCysk3YOyYLk8icI5FrdO6QFiNBc3a:xmvJ3oZAOtLk7x8aBcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211748, "uuid": "9b795665-519e-4e68-957f-469b022eb1d7", "value": 1748480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211748, "uuid": "d7ed5998-fdf9-469b-9431-30a28b84a0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211748, "uuid": "f85cf75f-5de1-4943-a009-752886206773", "value": "SecuriteInfo.com.Trojan.Generic.15032718.6615.5238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c5a6c-a1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675232386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232386, "uuid": "fb82e995-0437-4eb2-be3e-3c9103476f6d", "comment": "Malware payload (Guildma)", "value": "6a04cb119228b5ca8bb2fc2f4856103f", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232386, "uuid": "dd6e86de-8b85-49e8-99c5-05c15e1bd893", "comment": "Malware payload (Guildma)", "value": "0135bf39f5a2167cce8af04e8eaac0caee8b52123fea1a3ec2411be0a92da400", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232386, "uuid": "0a4970ca-5462-46bb-8872-982d7e79952c", "comment": "Malware payload (Guildma)", "value": "2f7eb865bd303466749a66e5cee8f21962d43cd0", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232386, "uuid": "fb69658c-6d45-491c-a852-9fae8f4468c3", "comment": "Malware payload (Guildma)", "value": "3a242ac58e95ce71410914ab2caa3d2bd7b726dcfc8660253cc3680f0074e3a83351bd5d9495eadccb0e893c89877412", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232386, "uuid": "fd15032e-e4ba-48c3-b2e2-61b44cf52087", "value": "T12EF0A34D71532D96F82E1132458B1E4B0EDCB9963F113C335A5D01C92660B087F0D174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232386, "uuid": "151c9df8-7be4-4aba-b286-fb32eb0c5486", "value": "12:8rflM8OBE6ZG8WgkUeX0WMjdXMLJUOmn8m7f8oi4ukxpRVIgmF:8loG8WFfXRMZMLeOg8m7fy4vIBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232386, "uuid": "4e252b8e-e834-43e1-9edb-c339a8840b79", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232386, "uuid": "09c62dfb-991b-44fd-9fbc-82942ff0ef06", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232386, "uuid": "9ec04fa6-f87b-4ba8-affc-f381c687c2c4", "value": "6a04cb119228b5ca8bb2fc2f4856103f.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f306e5d4-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675262247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262247, "uuid": "1b20a1b8-450e-42e4-8f96-94a98b9eca2d", "comment": "Malware payload (Rhadamanthys)", "value": "722cfe6c90a1f1dc019e350825e92cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262247, "uuid": "d50f84fd-8fe1-4460-b2b9-0caa718974b0", "comment": "Malware payload (Rhadamanthys)", "value": "01672de8ef90ad10d73d61377d1466d897b1f212c169612f43bce8ce1c625905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262247, "uuid": "15d3bbf2-93fe-4f9e-8ec8-4bebc2279d36", "comment": "Malware payload (Rhadamanthys)", "value": "aab735ed3b40b598e27933887c095cb4b05b2856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262247, "uuid": "2594ffcd-c3d3-4981-b2ed-441b882a19ac", "comment": "Malware payload (Rhadamanthys)", "value": "526c43a6b6fc70abf7ed1d6fc43ea30b572cc7da2a33c71dc3dcc8e27b0001169b8e19a4517775c0aca1b7436fbae321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262247, "uuid": "212d43ef-85d8-463b-8c2b-c159177bdcd9", "value": "T13574AEC2B6B2BC63E9228A329E1ED6F8761EF5434E096765131B9BDF15B01F1C5A3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262247, "uuid": "b38d5dcf-9b3c-4cfe-83e7-22683a1e3015", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262247, "uuid": "d7d0da14-0aad-4f56-adf9-3c25d3d2ef54", "value": "6144:Df6LIEG7iJv1pWakM9u3pVio5JPYmqMoI69CC8M:DScOfWbLZv5JP3qMI9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262247, "uuid": "5981eb6a-0184-4257-8980-d96fb638f9be", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262247, "uuid": "5e77b8a6-3a3f-4d97-94d3-c3f57dbd26d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262247, "uuid": "54cc440c-fb2f-4dc4-8b44-fc1caddbb604", "value": "722cfe6c90a1f1dc019e350825e92cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc35b6f-a217-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675245699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245699, "uuid": "38e14d12-8cc8-48a9-83eb-a3222ff60b04", "comment": "Malware payload (RedLineStealer)", "value": "00c9b6e06e6bdbb76c619916def5ec41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245699, "uuid": "47505569-14b5-45a7-afa9-7d3433e0c7e0", "comment": "Malware payload (RedLineStealer)", "value": "01b5cac74dea5fae5247e8d62d4ed2aa43ebc44bc930640552232c83de979cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245699, "uuid": "579491ad-f4b0-4024-b892-96d08f834d53", "comment": "Malware payload (RedLineStealer)", "value": "cd73609a47d3790931e008e138a44433482826c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245699, "uuid": "ca609b5e-c16a-45d0-b1f4-68805f4da9ac", "comment": "Malware payload (RedLineStealer)", "value": "275b9d160ab57b51c0bdce210d5aeffa89d53e7b59564a4c5fd30f632dede838ee5100bd44476e5b93227a61a19df96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245699, "uuid": "c0f3fab9-931a-46ad-a35e-44649188d6fb", "value": "T16A7401F272A0D032C9A716748D30A699BFBEB930193999477B5813BDAF702D0573A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245699, "uuid": "9659ff8d-53d9-4cbd-be07-ed0bb30a4441", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245699, "uuid": "3cb81385-957d-4f9c-945b-210acfda9f6f", "value": "6144:OW8lO2xLZ1fqR4/n7mAQHudTmF3yVQCSNs6:OWarxzfqqv7LwOTA3yVQ5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675245699, "uuid": "ddc96735-2952-4e3e-bb7b-3eca2e62284b", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675245699, "uuid": "fc6a842d-f1e5-4b1e-bbac-6eb3b72a5508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245699, "uuid": "1b5113e2-d929-4992-afd9-573f33166d3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44485226-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675262383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262383, "uuid": "faf5787c-8b79-435d-b9e5-b785260b7c48", "comment": "Malware payload (Formbook)", "value": "3d2997c1e6e61f075938e9db2cff60bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262383, "uuid": "d96b27cb-b4ca-4656-bfd2-cc75aca71ef2", "comment": "Malware payload (Formbook)", "value": "02070af1fb7addd7e49ec65159e87b2505ece1e70e173d4f9553e7f33228b0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262383, "uuid": "96ea5aa5-b2df-4e3f-a532-0f49dcf037e9", "comment": "Malware payload (Formbook)", "value": "0b3a1e43e74c878e0a1223f142db9fe56948c22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262383, "uuid": "1695b941-98d0-45ae-b865-916a7dd55ca5", "comment": "Malware payload (Formbook)", "value": "7da8f0f46485b1517afed547a483ecc450bbbde03f682566e66b7f6b3bcd1e9ef490a4c8dede602858ff381602da956b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262383, "uuid": "f19a8b95-e095-4998-812d-94f616ad85f2", "value": "T1A954124439B0CEBAE4124E376D358B46A3FDAD1258785B4F13712647BDA5FA1CA0E332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262383, "uuid": "1c84ef06-7be8-4742-b8f5-f186b0b7d2f5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262383, "uuid": "adba1d9b-1772-4659-8b80-1a3eed692078", "value": "6144:/Ya6U2BGwSDlDTpk56wqDqnXdx8WVYIOTbGx8KwUk0/66/XFT9w:/Y6q2N1mBqDqdx7VYFbGSFyD9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262383, "uuid": "64fa62fb-69ce-4233-83e7-f947425c3dbd", "value": 293505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262383, "uuid": "222984f0-ee18-4433-8ae3-edfee2bed87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262383, "uuid": "bbce7c2e-5a0f-4ef2-9d25-822341cf53f4", "value": "QTN SH-23-091406(LR1 CARRIER).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3b6b87-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675261563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261563, "uuid": "6994a2b7-05ba-4ca2-95b3-c379e7ba215b", "comment": "Malware payload (SystemBC)", "value": "e545e36b0145aa349b48286dc9351b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261563, "uuid": "80b3aa0c-3cdf-487f-ac50-a50526b42aec", "comment": "Malware payload (SystemBC)", "value": "02606e09c7b25fe4e4e3285aef59456bcf72b5f0b242ccfdcbdf2340824fadc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261563, "uuid": "dea5e4c8-ce96-429c-a4e6-2133512202d5", "comment": "Malware payload (SystemBC)", "value": "d1f58fdf7153302e2756ad054d84774e280e1696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261563, "uuid": "30286e0e-828e-4f64-a3d1-78e73245462a", "comment": "Malware payload (SystemBC)", "value": "70e02bda15782e2a9d73e1de65b85e78aad4eaa2fccb79bd53f6237a3391e878ae5ce1594b779cf8cc09702a0031b89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261563, "uuid": "21fcfd76-d67b-4122-bf52-873e7f2337cb", "value": "T1FB5208EB31208C96C016C6B03E6FA324C4BD657216759035EFE00E187B7EB938B1232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261563, "uuid": "98d5e577-0ea2-4c6f-b255-9a7dc45bbf1b", "value": "e482b82a8d8801190972939fe54c538d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261563, "uuid": "01f1894a-a095-4b6e-ae5e-3437e8943185", "value": "192:ucDfLAThZ1e7sf4QTbPk5+cput6tmyvmgN9AbytrrnLuy:hDkThZ0o4kbc5F0kfN9Airniy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261563, "uuid": "4d90e293-9770-41c3-8d6a-0a91aec3a977", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261563, "uuid": "d17edaee-d168-4e13-be21-edf58c6d6eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261563, "uuid": "d2e13e70-71b8-434d-a17e-b4a2432943f1", "value": "e545e36b0145aa349b48286dc9351b38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edda6d7-a23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675260602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260602, "uuid": "e7bbb329-b6cd-4c46-b14d-85d4bc0d5333", "comment": "Malware payload (Vidar)", "value": "165565e5544c5b2912fbb7527c10c89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260602, "uuid": "12b52f97-816d-4468-808f-23ca70f77873", "comment": "Malware payload (Vidar)", "value": "0278ba554a2930ea59fbe679e07224c2a97362becda8c5c422f3c775dbc53a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260602, "uuid": "72ace2b2-ec7a-4f1e-81c3-56cfed349c5a", "comment": "Malware payload (Vidar)", "value": "5c94ff6c3c6b5e371ce790856eee98ac0fc8b88a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260602, "uuid": "0f264db0-db7e-4c41-baac-04df2ebee939", "comment": "Malware payload (Vidar)", "value": "fa9ad1e70f231bcae9756c60ed4037fe3b809d497832c679513c2c038734ee7fdbe4b46d3a8999e9f60320e616c7a970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260602, "uuid": "9d72d91d-c98e-4309-b2c5-a821ee9ac4f7", "value": "T160B508B02B0B19DFD7560ABCD4874B52DF142274D3245980DCE97436EBE7E273D8A928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260602, "uuid": "1204a0a6-c229-4377-9861-3fe8e7ed8025", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260602, "uuid": "4d5fa3bc-6e32-4cc3-ac67-8602e8ae557c", "value": "24576:JP2Nr/ox3EmOgBRWoIy1MIWHOq8aDCc5Orzb06Y51fdJFP9XJ2VyGbYJc6IU2rew:JP2NDox3nLMIOOq8aOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260602, "uuid": "f765a00b-6cbd-454b-babd-6515c4c9258a", "value": 2445311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260602, "uuid": "9cf2ffa7-35b2-400e-ba36-74697c2912ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260602, "uuid": "a8e9861a-0454-478e-8078-03309faaa37b", "value": "Filmora2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90dd312-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675239413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239413, "uuid": "e0ca16d8-a1f0-47a0-b559-82e0aa231c57", "comment": "Malware payload (Gafgyt)", "value": "f47e1c562e473caf8bd69318b5cc9de2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239413, "uuid": "cff948b6-c1d0-439d-b5c3-219dc40718fa", "comment": "Malware payload (Gafgyt)", "value": "02ad7683c2409c942a13bff24448983ed86163d80c62c0cb830361a9a4717ed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239413, "uuid": "4cbe13cd-044e-4ea3-a8ea-c9d47baa7baa", "comment": "Malware payload (Gafgyt)", "value": "9b9722145dd4379f678571d397fd462a4125e27e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239413, "uuid": "e582267b-ef0f-4c0e-8d08-764e7a21732f", "comment": "Malware payload (Gafgyt)", "value": "6dac351c5b8cc03b0ba346b306f675185c71fe89a8065a25c1316956acb7fd53bcef1f9f300c125f622e96c819e7f283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239413, "uuid": "ada4da22-e881-4cd3-a3d0-65e9f1d08450", "value": "T187E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239413, "uuid": "a1664717-17fd-4513-a1d8-f7ac709ce87d", "value": "3072:fuNaNpF4uVN++dkhnxHQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnhQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239413, "uuid": "b1560631-939b-4b8a-9c60-7753417fa279", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239413, "uuid": "3445fa71-f536-4a85-81a1-0069642f0f58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239413, "uuid": "d83ec7e0-2829-4a8b-821a-3681b7b2f40a", "value": "f47e1c562e473caf8bd69318b5cc9de2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aaea93-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267195, "uuid": "a13ceb89-e648-4e5f-ae92-90d48c99058d", "comment": "Malware payload", "value": "335ebfd3421b0c58c258bbff94fd7f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267195, "uuid": "9beded57-f947-41ea-a1e4-e6d861f3e399", "comment": "Malware payload", "value": "02fa44b9687f061867ed258f14e0542ba8c3af5db68f69fda02c94b73cd9568b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267195, "uuid": "9d2255e7-4fb5-4fba-9cd1-78549645db6f", "comment": "Malware payload", "value": "164f6cb1b5bc5c0905de512d355363705cd62154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267195, "uuid": "6397969d-b24a-4d82-8c98-0362059820ed", "comment": "Malware payload", "value": "42be4a36075b94da305e0cb018ec1494150ca5dc5c2817ec76c3beecb72a6f9c97fc5e416d72ca20a5979daebe1df3c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267195, "uuid": "821c3764-21a1-43ef-a52a-2ba4a6c9f0c1", "value": "T19EC1F0115FEF50DEF22307705BE6B3BB1166E9B1452E61B870848A995F71BD0C812FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267195, "uuid": "3b4ecba9-accc-4dd1-8ce6-89a4282422c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267195, "uuid": "d8021672-32dc-4e77-ac53-8d67b9ad8763", "value": "96:Dyyxn79v4uL1bhycQmntWWvk+dl8J/66sfeYId3ojilrl:f9v4uL1bhycbnzvkg8J/6NIdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267195, "uuid": "291c24b0-1fde-44c7-a6e6-812b549dde61", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267195, "uuid": "fdd29bec-cd45-4091-91bd-63fb9d3c3f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267195, "uuid": "d139ca6d-f866-4e73-9a43-3edbad110113", "value": "335ebfd3421b0c58c258bbff94fd7f9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef0a340-a20d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675241382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241382, "uuid": "9dea2b78-8ebc-46f5-9dfa-563543061dcb", "comment": "Malware payload", "value": "01f7ccb438096b1f991cdb84bf6a1beb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241382, "uuid": "69a707ad-c357-4b7d-9615-1fe1d398122f", "comment": "Malware payload", "value": "0348e6f66be9ce19c8f8b97b959fbbe0f848f9b0fa912b039a95eee665e9f06a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241382, "uuid": "71d1f3d0-86b9-47e5-ba34-7c2b7c06926e", "comment": "Malware payload", "value": "e8c7909760fde03b434dfeb70a78599910977500", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241382, "uuid": "ebe18af2-5ed3-4ca6-95cf-a4a69e9c2ece", "comment": "Malware payload", "value": "940f25c8996a9e44a3b04950914e41942757975dba82a132cd30cdda8c12ab3db7ae18ffbdf95dd4d369cafe25a2253e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241382, "uuid": "de3d78b9-77d6-4f94-85ab-ace4070d3c68", "value": "T19413E13ED443E82DD0572C7C80960279FAD56943F22523EE3BE4B1D85E81D8B6E281D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241382, "uuid": "3074b351-8dc3-4f4f-8a88-a15f195cd9f1", "value": "768:0ctanskfA7MnOK6PYBKazlllewNYZsIkLlJJfrCfGU3ADz3fIHo8e:0D947MKYsYfVNYjkpXrCuxPfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675241382, "uuid": "95b915a3-4b00-40d2-9a9e-8dd620821314", "value": 41711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675241382, "uuid": "16f1c5fa-9e35-4044-9a23-11d20bcdaf50", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241382, "uuid": "d72b000b-4136-4720-b73b-86e4250ef492", "value": "Sunethra_Duvvuru_Resume (1).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa26fb7-a228-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675252945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252945, "uuid": "4400ec8c-fb46-4726-b7ef-ffd05f9a77f2", "comment": "Malware payload (RemcosRAT)", "value": "21605edd439a91f69b7c2584413ae3f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252945, "uuid": "5f9c7188-8a43-4757-ac46-b528a0495f6b", "comment": "Malware payload (RemcosRAT)", "value": "03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252945, "uuid": "cfaab268-9421-4369-a2a7-61e6df93e667", "comment": "Malware payload (RemcosRAT)", "value": "76353ff45df865cee24b8802c2332c8f07590df6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252945, "uuid": "398229db-27d3-4d6a-8c89-159e9f2a7f2c", "comment": "Malware payload (RemcosRAT)", "value": "0511c4675d1f8d28a0498254f14bf7cd9b2bfc0c497edee58a92125654f007a09841396447f12c1b427545d6bf0409ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252945, "uuid": "83637c45-2cf2-4db8-8c32-5d7262fa4584", "value": "T1B7D5AEA163E8BD1B66727BB9E286017EC8738418B5128ECBF70E5EF25335F344E46245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252945, "uuid": "985c50f3-47d1-4a43-8fdf-a47509c4582e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252945, "uuid": "54f27c6c-2a11-41fd-af37-40c1ab0c1f77", "value": "49152:Q61jlIn2e7zgWTSOa7Q4hVBP35NxVg1DHeTz0CTssEORTdQRYdN+1rHzE42i9:Q6FynB7JTSOWBBNxVg1zen0CLEOhdQTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252945, "uuid": "9838de14-d38a-4f88-b196-05020dfa7fea", "value": 2798592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252945, "uuid": "81f9d611-7e0d-4856-a95d-6bf4fd5e4775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252945, "uuid": "a32e4118-e589-4aa5-ba85-ae4adc4694b2", "value": "21605edd439a91f69b7c2584413ae3f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5512bf9d-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238789, "uuid": "26b09694-9186-4874-b912-0bcc15dfa4b1", "comment": "Malware payload (Gafgyt)", "value": "2b8d65ea77afefb9e8f80f76de35b677", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238789, "uuid": "0518151e-5b50-41f9-bf73-ff41659b367a", "comment": "Malware payload (Gafgyt)", "value": "037d56bfc8aab2d5e5566375abb0988dcd5793c4277f66f43b86de4592364fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238789, "uuid": "96b14e91-8e7b-4796-9297-844a0906f827", "comment": "Malware payload (Gafgyt)", "value": "ff8b8624e811feac5221bcd4b5303344a23c786c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238789, "uuid": "9ed5e102-48a3-471d-b4ed-377ab94fd855", "comment": "Malware payload (Gafgyt)", "value": "5c8a7dea2592a9501b31c228f05ff1d57559d8ac85562e0f91489ccaa657e1030e818b0b93e11710c57c39f82265a388", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238789, "uuid": "68fc3e61-f352-4b47-b939-bd29e44db6b5", "value": "T1B2930892B901DFB6F40ED77A04D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238789, "uuid": "f790b397-74dd-41bf-9d03-3ac08bd1d5e9", "value": "1536:4wZVhxpB8F9OEG6ktQm3r/FS3n9RIB6Yy36g8d2f7vTmQ9VqXjewf2Le:R3p09W6KTG/IB6Yy361YfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238789, "uuid": "53a6858c-cdbb-432a-bd3e-aceb8dbfd42c", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238789, "uuid": "cb2f0910-6f62-4601-ad79-b00840c678ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238789, "uuid": "e15979dc-8885-49c6-8a2a-93f25efe79e5", "value": "2b8d65ea77afefb9e8f80f76de35b677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e2f505-a1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675224555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224555, "uuid": "0083d18f-e415-4e89-9af7-f26504cf1fab", "comment": "Malware payload (Smoke Loader)", "value": "bb70991c845df5f4974e753d90a5d1cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224555, "uuid": "9d28c813-a5c2-40d1-bcc4-8f316d36baa2", "comment": "Malware payload (Smoke Loader)", "value": "03951c5b4724f5ea3074855da67088226f3ce343f0eb33b6331e4a48de0758e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224555, "uuid": "5094ac13-31d5-41aa-ad78-98efd9067674", "comment": "Malware payload (Smoke Loader)", "value": "35b0471b6e95ab79261f38afb9b13b3ccd1eaa1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224555, "uuid": "9f4f527f-4e9c-4c7f-bd15-8088be102033", "comment": "Malware payload (Smoke Loader)", "value": "1e248f3d487881df46219753ca27cc3fde76d098996180a2eb7cf54e42dd134cc77f11345ea266a8455ee7bb9b6eb822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224555, "uuid": "5f9439c7-8d85-43b0-93be-68159f78551e", "value": "T103548EE276B1BC62E92286719E1EC6F47E1EB5434E187365221B9BDF25B01E1C1E3740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224555, "uuid": "3c36a470-5350-4fae-81ac-361dfdb3f0d3", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224555, "uuid": "ceefab1a-6c5b-4cc1-ad76-612b8344b40f", "value": "6144:todLBBlMyXAsNH/I2KbY2zkmqMoISx8M:tq9lX7qE2zrqM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224555, "uuid": "558de4b6-7f7a-4dc0-8c77-3b66984b6fef", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224555, "uuid": "63305983-ff9a-4a0e-a723-12c687203eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224555, "uuid": "95446d15-52a1-4f85-a8d4-af0bc5f3a999", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1bfde6-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675239742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239742, "uuid": "451bcd45-6636-4801-8398-dc01c0eb6649", "comment": "Malware payload (Formbook)", "value": "a0229bef9a286e605ed3bb2e6af8e7a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239742, "uuid": "2ed54c04-2c23-47cf-aa63-2cf40f00d89d", "comment": "Malware payload (Formbook)", "value": "03a84155093ab32f570220991ff8f30d65fa048544c4e0fd95038c730be6cec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239742, "uuid": "469d1d6a-8601-493a-a24a-260eba02c403", "comment": "Malware payload (Formbook)", "value": "76bfbb6424ee41f5a2ae9b06ff77fd5cb73c50b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239742, "uuid": "5a6b3296-a15a-46a5-90f5-5f665e5bc339", "comment": "Malware payload (Formbook)", "value": "013b735071be54f2a07bda8b12f49c55c9bd28699bdf422b53b1a2875d58ff57d0239e4e8a8c0ff6e14a91c47892ee42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239742, "uuid": "948b2fea-9e65-4c33-ab8e-ba397fc90706", "value": "T127055B8137F15462F1DB05B9102876881E3D7403A6E6E2675BBB79C49703AFBF298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239742, "uuid": "52f868f5-69fa-4f82-8d5b-1270d17c541b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239742, "uuid": "ab34b0bb-20fd-44d7-b32b-89e057d337e1", "value": "12288:eeEaLIWJ/rXl7N6Mk/P/iMhZcI2CfUvygvr8z9i7+pv5c4N34m:eeEaLXJ7jihZcIVfU6qr8zw6R5c4N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239742, "uuid": "365a6a2f-fcbc-4101-b543-72750ea07d1f", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239742, "uuid": "da257d7e-67b6-46ec-a7b9-37754c403499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239742, "uuid": "53b91d68-c1d4-41a0-af84-0288e9526596", "value": "Payment Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61baa1bb-a284-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292497, "uuid": "86e2e846-82e0-40c4-986e-ff0fd0f69dd4", "comment": "Malware payload", "value": "f9223ce10430ed989beb6315b8ef10ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292497, "uuid": "9ed97c0e-23fa-426a-860b-27676b910733", "comment": "Malware payload", "value": "044fe896805f74d4abf6888958d96a8660ba2b016eb62e4cfd72457706258dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292497, "uuid": "e01217cf-d2cd-4d78-aaae-8a9118c3e05a", "comment": "Malware payload", "value": "e743ca02767c216b72506488a1ebcea005009823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292497, "uuid": "d628e9d0-df27-49d4-82f5-06bd282fbc7c", "comment": "Malware payload", "value": "ee6940a535a0fa5fcf4f82d7f4412f308aba8d9226ab5419eb855bdde34a9ad22a78ae9c75fe24a952569e367b746c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292497, "uuid": "94c3fa61-4877-4532-8f45-6e5d4fe98a8c", "value": "T14C34DF3278C0F072C46610745C60E6947FBEAD321979991F7BA81BAE9F702D1673A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292497, "uuid": "3630bc4b-e32a-4f2a-8748-4896a049a27f", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292497, "uuid": "bc159dde-0b5d-4656-9650-a86f42a662ed", "value": "3072:j3T98vcQyrw4jpL7NMWS65Pr55z1fK2n3TMAa8HOvqFlasZ+Zl1nzaH:jTimM4VLRMP653z13K0OvQlasQZnza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292497, "uuid": "85fedfbc-18cd-4026-8726-7033b99c73b6", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292497, "uuid": "30107379-3bf0-4506-a0ed-dd869aa4fb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292497, "uuid": "15575318-1f80-44a9-9ca3-963669b2b756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7b2d96-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675233028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233028, "uuid": "f34e271f-6b53-4d17-a0c0-3559de2444b0", "comment": "Malware payload (RedLineStealer)", "value": "5d7f45bf230ced3c9dfe3e5377551f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233028, "uuid": "68517b13-ba44-477a-9c97-47cd81e8664a", "comment": "Malware payload (RedLineStealer)", "value": "04736be95c8b63ed86873b55cd354a70d6f36293b96b8e2f40195228b9fb27a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233028, "uuid": "b6949a3a-c7a2-4153-81d4-33a686d7af51", "comment": "Malware payload (RedLineStealer)", "value": "049ce5605ed7de4109fd452858d412fee8242467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233028, "uuid": "2990e320-ed06-4141-9309-dcb30e332482", "comment": "Malware payload (RedLineStealer)", "value": "17366cbcc7484b8139eceb26fc806e24bc86d8a0d9f1b04c98dcd1f809750960762bcf10a1412daf2b0bb8f4249781b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233028, "uuid": "d29d2ca2-bf24-4e35-bb4b-f4938676db1b", "value": "T14F74F1237180D033D56644749920E7F4AABEA83D1978586F7BA81B7E6F306C1673B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233028, "uuid": "b08ae1cd-22ab-479e-a0da-6c8930c03f7b", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233028, "uuid": "80f1e051-57bd-4502-b24d-34bfe508a639", "value": "6144:dW1mPghoLIVKx4cDqfP4LcodvWj1VwbCvLH/aBnBih8DKwG:dW8YmWKxFqfPmcodvWI4fwBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233028, "uuid": "0f1d5492-22ee-40c0-b2a2-d20bc76ff8d1", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233028, "uuid": "d0775d1d-b940-47aa-a362-068504ae0ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233028, "uuid": "9ab9da96-0c50-4d1a-8cdb-53520f5a865a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3aca96-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675264195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264195, "uuid": "9bac6b5b-dd98-4eee-a26b-912314d142f9", "comment": "Malware payload (Formbook)", "value": "3c232417ac519a9a0b407e4644f469c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264195, "uuid": "bb18a29a-44f1-459f-86c8-a204263620a4", "comment": "Malware payload (Formbook)", "value": "04b2ea00c6a5376c064e2cc546e8df707c2cf45135d2b544a49fbd56bbc891a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264195, "uuid": "25cc0e13-0126-4253-a982-de388efadbc4", "comment": "Malware payload (Formbook)", "value": "69e9691c5f80a10783d820d2c8e8df6b7018af1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264195, "uuid": "b0196cdb-36dd-429f-9fb2-ed8953d839ec", "comment": "Malware payload (Formbook)", "value": "fb338e6c0abe9834773770763c91f9e4aac74f11a60ee39c02c1f79a30c7a38f37fd92cbb529dc3999b0b834a1893ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264195, "uuid": "248fbaaa-4acf-4090-8516-b9c095ea588b", "value": "T11794DF01A784AFD8D2E335F78A7363ADD0AB5D9E8431F1836BA4B7C4E637140C857626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264195, "uuid": "13eadc5c-ca8c-4aac-8e49-38d29e3d4e84", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264195, "uuid": "beed6ad5-7bf4-414a-ae85-929b6d6af794", "value": "6144:QYa6HDdD9PpjOovpV6XCx9XzEZazURQp8j7Li6Rn1Wop92J0yaphjX2SU0+10s26:QYZR9wEdp8j7+qUoznpC0sitJGF99gHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264195, "uuid": "6e1379a6-c62d-4847-83e5-074faf914d97", "value": 419322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264195, "uuid": "8c59c48e-4aed-4e97-8ade-45dc715be243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264195, "uuid": "b5c85371-4313-449d-a03f-10f61e0db52e", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15dbf8f-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261788, "uuid": "6393de15-bf82-4ca4-9389-bbfb6ba1e7b2", "comment": "Malware payload (SnakeKeylogger)", "value": "6051fd48e2ec1aae6498a09ae7c83ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261788, "uuid": "09b007d9-25c2-47c0-b637-c371022c3701", "comment": "Malware payload (SnakeKeylogger)", "value": "052a3c85e696dab18d11e90ab71cc94b9fb1358a8f27aa5eb0e838ab8299cb0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261788, "uuid": "daf2c10f-d1be-4a17-94d9-9edfc0383752", "comment": "Malware payload (SnakeKeylogger)", "value": "667062c55e440a81747f641077cb58d0330f19f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261788, "uuid": "8d3a5943-530a-49d3-a824-528989e71af9", "comment": "Malware payload (SnakeKeylogger)", "value": "04c393f6ea8f0eee20d0100880f8ce54054ab2868902a49bfff4b64767a05b3cb9d810d67fe6529678e78071795dd7da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261788, "uuid": "70f52cb1-df16-4bcf-b86c-df8529d026bc", "value": "T15CE4AE432978D59AFF6906FBE10A506437F5CCBA811CF6185BAD3382D9E1B510C6BA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261788, "uuid": "72f07677-e502-4bd6-a4ab-5a575a73eff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261788, "uuid": "d168d4a3-725f-4c2e-b8ef-1a8232024353", "value": "12288:33bU6hLk6yK3SHMDjLpp6avlKLwzyyn24miBBLLUfo5v6nnjqKoe:7Uqk6y00MnLf6avcLwzyynrmQLLUO6nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261788, "uuid": "422571a7-da6f-48f1-9da1-0333439ca386", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261788, "uuid": "44079456-7aa8-4e83-819e-2fa4465b90c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261788, "uuid": "4ac6ccbc-5017-4719-90ae-16bb4ad711b3", "value": "Project 14-17-BRI180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f563c2-a1d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675217289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675217289, "uuid": "4cf7f010-eb86-48e1-b328-065c62966399", "comment": "Malware payload (Smoke Loader)", "value": "2899e15f43576858281884a292b4d54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675217289, "uuid": "b3057ec2-3968-463c-97cd-744c19038a68", "comment": "Malware payload (Smoke Loader)", "value": "057e90f950aa42fa41d89c01521574902aeb46d7220f66ef4b7565a4afa12083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675217289, "uuid": "b4e352aa-684f-4d27-ab09-cf42093c54ca", "comment": "Malware payload (Smoke Loader)", "value": "f3ee1854e20d16e39cad5ec8f9e58d30c5761068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675217289, "uuid": "20cc4d41-fa38-44ee-9e83-f3d22a610b56", "comment": "Malware payload (Smoke Loader)", "value": "a8e83518fae014bc69175daf20b43f08375cae01ba8e5071868c5b36dcb8757491c84a624a03b5f9fcd924332e6b74f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675217289, "uuid": "05ce8a75-38b9-491b-b309-60ed415e0f04", "value": "T1BE547EC273B2EC62E961CB319E1EC6F4761EF9524E19736E121B9BDF25B01E1C1A3211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675217289, "uuid": "2c5090a4-0900-43ba-afc3-52ab65b62296", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675217289, "uuid": "fed623d9-7d76-4dbe-ab9a-3fa0b009fa0c", "value": "3072:uIqBNO+LlhKMRcLJfSMsWiUPDCssBMb+eyvxrBmqPUx6WfQz86SZcIeR3MM5:DUO+LLO9RLZ2SyvDmqMoIbcII8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675217289, "uuid": "044e5bef-c35a-4332-9be0-49f56cc13ebe", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675217289, "uuid": "a187c2f5-ad24-467d-a689-523bf50069f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675217289, "uuid": "3bb04c60-6f4d-4313-bfbf-fb03661fcaa9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ff6636-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292773, "uuid": "3eea5d7c-7f7a-4b3d-bc03-582249af82ca", "comment": "Malware payload", "value": "3edf3856d10b65eab7c4e9a7942b00b1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292773, "uuid": "9d31314a-7285-407c-9066-4fdf3af20dd7", "comment": "Malware payload", "value": "05d508067fcce1ff471b259d54478194cf66c9a08ec7f230199f01932114dd8b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292773, "uuid": "f2a71fae-64e7-4f51-8124-131ba0929324", "comment": "Malware payload", "value": "d5195b55b85fc9b7061531657d0be23f46d2b33e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292773, "uuid": "dc75a95c-9b01-40fb-881a-ae7d188f7728", "comment": "Malware payload", "value": "d51b1e1be908a805923007e6ae18e7c378da12cdfc1c3feb6e074f24394739ef139e970a3dfa93b61b35ed94f21527eb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292773, "uuid": "794f8288-3eea-4210-a5ea-15898d74e330", "value": "T193363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292773, "uuid": "a0a1c789-78e6-42ef-9fc0-4adf8ed30c57", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXx:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292773, "uuid": "6d1aa1b2-de51-4ee5-bf83-6e67d6d05dc8", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292773, "uuid": "7c9a7a3d-cacc-43fa-a297-bba0fb8fe54c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292773, "uuid": "1bb08f94-d6ee-4e73-aeda-ebf378e9d47f", "value": "05d508067fcce1ff471b259d54478194cf66c9a08ec7f230199f01932114dd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963bd9c0-a28b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675295592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295592, "uuid": "8cee5314-afa4-4c21-88ae-960a0df687a9", "comment": "Malware payload", "value": "f2ea6ffb11caebe23db4939ae2f3faf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295592, "uuid": "2abd0a30-5d88-4157-9d97-dbb0f8eedbfd", "comment": "Malware payload", "value": "069f26b91b13d2ebbca88ac98894e859995555a2559cbb274383a9379b98a61a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295592, "uuid": "e699a79e-df59-4b2e-8d45-023093780bcd", "comment": "Malware payload", "value": "0ea8d9844264954345ac7cbcd3ea50726871626b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295592, "uuid": "4b449557-2106-42dd-9621-f97382f98b18", "comment": "Malware payload", "value": "c60c1ea5be41ce5687e7b6b3542f654f9b2d6234fbcb74a54f7af3c6d1e24201f921c19661370f81f63c8ac4160e726e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295592, "uuid": "a12d8bfa-a426-4331-a555-6c7c5e9126fc", "value": "T12D55F1B53E69787BE4360E3E03A720389B053DB5D76EB65105C4712DAB06A4EF883D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295592, "uuid": "97c2017f-bbe7-48f0-9428-fdbfc471f8a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295592, "uuid": "44ecb5eb-105b-4f1d-b39e-9cdf6e2ce89e", "value": "24576:lB1DxgUPbYDSxqFfh+myYDwC03OPIurG1UyWqqfDB6ypdMHL51pwu3HKz5wzZdSY:lB1DxNPbYDSxqFZ+myYDw33OA8SUyBqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675295592, "uuid": "103706dd-0691-4438-9e2b-2ee99aa16bb2", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675295592, "uuid": "cd81c0ac-b82e-4c72-bbdb-8970125a6499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295592, "uuid": "74be4e2b-dcd0-4ed0-ac82-594942bde753", "value": "Tkeeyr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9f148f-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675264353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264353, "uuid": "48438c16-7738-442c-b62c-3672a80dee5e", "comment": "Malware payload (NanoCore)", "value": "c1e6f89b24d1304d31dc64015d9bda62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264353, "uuid": "7203bc43-e8fb-4b5c-8db3-1a12fc08adeb", "comment": "Malware payload (NanoCore)", "value": "06b5465e33770e469fcd576f34f55021df7f348b6b262e8721e23e801629e29e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264353, "uuid": "a9683eb5-e073-4cb7-a350-7cbf5be025d2", "comment": "Malware payload (NanoCore)", "value": "27f825c528d3011316720bd8011edfed129b3289", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264353, "uuid": "d2ff85e2-64b4-4585-9455-1e3990309091", "comment": "Malware payload (NanoCore)", "value": "988b9ea5dcaf81b6b351e8b09ec17d073c67a91a86bcb966581ce02dad72c7b1328ecae6806979cbb32b292fda067a0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264353, "uuid": "0cc713a2-63fa-420b-93b7-bb48c3bad6ba", "value": "T1BBB4BDB1DF0D7F651115BA8AF06A9AB02F16278F43CA7114B4C4EEEA7C79310C4BDA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264353, "uuid": "ef5c0aeb-9987-49e7-a155-c8e5ee5b5f2f", "value": "12288:+Kl9/5ZX7bp6aXa3x1t84FJJWzAbPOgOT:ZPh5Sx1eAbGgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264353, "uuid": "35ba3f7b-c385-4ac2-99e1-becf6d27b3e9", "value": 516742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264353, "uuid": "80ec9298-4292-444b-ab9a-b76d0f431d78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264353, "uuid": "1e5d3fe9-c3c6-4290-abab-f143bab787da", "value": "SCAN COPY CV 310123.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081daf20-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292776, "uuid": "4b48ec6b-fd59-4c48-bdca-c5746c411afd", "comment": "Malware payload", "value": "976e41dd09cae6c5dc0f2e5a48f8e4cb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292776, "uuid": "4022e7ec-9c67-41c2-b5cd-32a774c4ae42", "comment": "Malware payload", "value": "078020ab65ceffd8c9941736b56ddf888ccd7db26a6094c4d9b8d3c4c8d9834f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292776, "uuid": "3baea211-a730-4061-be61-a442a41a445c", "comment": "Malware payload", "value": "ce7cd00e3a68f4a1a3d09c8b385eb689ce2da1ba", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292776, "uuid": "7d40a9ca-1e57-4dd7-8797-f1d8326a6b10", "comment": "Malware payload", "value": "39a3737ff5af0131b9f7faa12a26cdbf7855484939c6b4b9f0d7710756abd66e04797e633d64a031b0697ec05b68786f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292776, "uuid": "ef650504-9e03-4efd-8b3c-75a76cbd6702", "value": "T123363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292776, "uuid": "5046e3f4-f4a7-44a9-8a57-4c584b063aa7", "value": "98304:1v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXZ:1vpvFa+g8RWLdPk/84tCEr0RtNiC5eSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292776, "uuid": "6f310da2-8b07-4567-a9da-2af36d1753ff", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292776, "uuid": "49cea480-c2c1-4c15-aeca-167783407a56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292776, "uuid": "cfc11cb5-84d6-423f-a4a7-5e4c85b99435", "value": "078020ab65ceffd8c9941736b56ddf888ccd7db26a6094c4d9b8d3c4c8d9834f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76f4041-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261825, "uuid": "f812ca59-f2ac-4319-995c-2dd4ada66651", "comment": "Malware payload (SnakeKeylogger)", "value": "d2509f72c1b2febebdaa8058b52f43a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261825, "uuid": "af480def-90bd-44eb-8e8e-b68238e36c8f", "comment": "Malware payload (SnakeKeylogger)", "value": "07a1258c5ef18d86c00f843408aa21667c7817b8e7d1ead1a5411856d0d21ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261825, "uuid": "bd4b9714-15ce-4615-8ce8-195cf25af923", "comment": "Malware payload (SnakeKeylogger)", "value": "eb4db1db3a23102297fc38e96b3d8c29033c676e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261825, "uuid": "7219daab-13cb-44a4-99eb-1d9aa7d0623e", "comment": "Malware payload (SnakeKeylogger)", "value": "89b9a9318e4c83a7556ee59957f7034a16cc038e9fdb08f5f1994c0a5326a6d4fc337b734c4b262032a2cd2a20d88749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261825, "uuid": "a0e805d0-4535-42b4-977e-41b8c95fdbb1", "value": "T1D1E401BD935DDCAFC78C00FF91B45049AB75127AF591EB8D0ADFE1A9848B30119221EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261825, "uuid": "8f1b166a-ea49-4732-a2d0-8b6335b2ac9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261825, "uuid": "d0bde390-f9a3-4c25-ab1c-d9a835af033f", "value": "12288:s6puW68gG3AiuKKtzbhFZhh1EqjnvsYZ3sWeh3ih9HnAYcH/d:nmXG3EKKFEZ+sBYTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261825, "uuid": "068a5b3a-1bec-47fe-8ad5-2564917fd211", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261825, "uuid": "b682852a-07a9-4944-b232-c3aebe9886bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261825, "uuid": "bd72229c-89b2-49fd-bdda-3d09178f2c5e", "value": "Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5fdd93-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262264, "uuid": "ddc5c19a-ecc6-4547-8f08-de733e58d0c1", "comment": "Malware payload", "value": "fb10c8eb9f3346737b08d1d276467f7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262264, "uuid": "dddb01b9-e5d8-47a7-b68d-4acfe72ef45d", "comment": "Malware payload", "value": "083d4184bc895d803048f375cb821d87f1f5acfa10b9d6057b3e9c9c1ed95d59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262264, "uuid": "d413b694-0b9c-4cb6-a6cf-d89ed77f6072", "comment": "Malware payload", "value": "62480603ecd4b5e444d9ebf1fbb1ef7ddcbbef99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262264, "uuid": "8b25b440-6cf4-4843-9c20-ff4e5693ea48", "comment": "Malware payload", "value": "2120c667fcd7444aeb9b2cc1ab15dc6f38fc9ecf99a91c45f137ab42ee6ed6c552b2db94e6f1fb90251fc314e199ae1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262264, "uuid": "8fc2bad1-0f90-4df6-9217-590b7d93b912", "value": "T1B123F68256FF19DF3601CE63547AFB076CC68A03CAA114F472376487EC8C29A727E55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262264, "uuid": "d19f2b29-36c4-4610-9622-bffc3c697a66", "value": "768:yK0FmWhlhcVcmVs1JsFqk6TmnGT6ePuXSxjRhr:yK0F5hlhcVcauaok6Tg4uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262264, "uuid": "d6f45586-232b-407e-b31a-bdb6578dbc05", "value": 45961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262264, "uuid": "e59f6387-2644-408b-8f66-037af921c900", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262264, "uuid": "81701e3f-7ee0-44af-8f25-d4ac92fa1c4b", "value": "DocuSign-Feb01-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b1d2b3-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262714, "uuid": "334c484b-c7cc-4060-a129-f6cf03b24950", "comment": "Malware payload", "value": "039ddf0a4b8eacf26abf68a6d79b0a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262714, "uuid": "de529e31-b195-4500-b7ab-58df2b57544f", "comment": "Malware payload", "value": "08984497aa652a7084383e7880b99a71fb760dfef732d691084f0e4f5073408e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262714, "uuid": "93e10ee8-cf5f-48b0-b5bf-923dec5f6281", "comment": "Malware payload", "value": "028cc52d8cb558a2ff8e642a8b03a6096158652e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262714, "uuid": "01c7245a-4d88-4277-9735-3edd69dbd57d", "comment": "Malware payload", "value": "eaad358168f273f25f75b2c6985ca4403b08c8bfa1097196a74b769d1299276178c1316d01accfd1ca8e176a24fcc4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262714, "uuid": "558cf02e-1371-4ecf-8bb7-1b52ccc47551", "value": "T1FDF6338277B901B9C59A12B5D0E3140567B3FA1B6F36DB4B384102DA6F473F89D0AF68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262714, "uuid": "134003f1-39ef-435a-9ff4-82a5998c658a", "value": "dc12932426806b6b47a373d7ae42c21d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262714, "uuid": "b5340657-04a8-4fc0-b69e-a7f5ce138395", "value": "196608:Xq+D8mXZAdacJF6z/jeTEIqD3fz2cc4euJS57c0orZ3:XqEKdBFM/j/rD3fBfvM756", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262714, "uuid": "60612e64-750e-4d3e-9d88-f2a84ef9a324", "value": 16777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262714, "uuid": "9240671e-95db-45f4-90bd-0ee790e03909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262714, "uuid": "30960f60-5500-45d6-adf8-6739641b5d57", "value": "039ddf0a4b8eacf26abf68a6d79b0a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afdb8c5-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675266582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266582, "uuid": "65856e2b-23e1-497e-9784-971fbfef01fd", "comment": "Malware payload (SnakeKeylogger)", "value": "c9a84ad25e24836dd2f7c9081670fe06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266582, "uuid": "0d2bc411-2c2c-4dcc-9ec7-f55d8f4f0c87", "comment": "Malware payload (SnakeKeylogger)", "value": "093e669e3e7672fd4bce100c627920b416c2cf0ac4523289e2644ccaaa2f30a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266582, "uuid": "4b03220a-fe8f-48d1-a6c6-15d58133309c", "comment": "Malware payload (SnakeKeylogger)", "value": "c47e6c0a4b9b38c6f2caf19da109a09469147507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266582, "uuid": "c0c0252f-deda-4e0f-869e-133fae5e17c1", "comment": "Malware payload (SnakeKeylogger)", "value": "c6d50dc093203bf089e514802ea56db777cc23300df413568685fdeb5a068af3cbe93806c371a2483403c7641ae2b94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266582, "uuid": "4956aa6c-1e39-42eb-bc11-d9b82ce68367", "value": "T1EDE47C8777F198B2FACB00A1142837CD2FE06103BE95E2679B7B79C097059FB7698251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266582, "uuid": "809c0785-5ba7-4735-adcd-f7099b5d2609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266582, "uuid": "3c0f05db-0d1b-479b-ae3b-d86e4fa1fd13", "value": "12288:ttz8L6gur/oG4PKrVNfNe4T9Z6mPxMRSR5SWqG4yPa:wL8/gPQpTRyRU5JqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266582, "uuid": "6eac3eea-c018-4848-9727-fd77a9ad1a0e", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266582, "uuid": "7a1388a1-5233-4ed0-b67c-02c7f5c65267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266582, "uuid": "999dbef3-80f0-41e5-ae15-1487ce20ffe4", "value": "c9a84ad25e24836dd2f7c9081670fe06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70cf8b3-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1675263515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263515, "uuid": "67a9900d-7097-4961-92c1-fb3ba82577dd", "comment": "Malware payload (DanaBot)", "value": "3cdaca80f86804b2e837331a0728de3f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263515, "uuid": "6b84491d-6949-4bed-a4ad-f36c5c5bf9f2", "comment": "Malware payload (DanaBot)", "value": "0974600df5ce3148dbce0a102687eac7fe834fc71cd620bb40a11584bc58572a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263515, "uuid": "b33c17cc-2da4-41fc-ba6f-d0da92ea5550", "comment": "Malware payload (DanaBot)", "value": "a6ff93a2e3c8a324fdd38e54927f47a65d985bda", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263515, "uuid": "b52a9939-c835-417c-8e50-332035c81b05", "comment": "Malware payload (DanaBot)", "value": "23fcbecafffde531fedf39839da703336ff99c757a534e3bde27a5bf6a23886e9f7de2620f66287d1b7f829805d166d9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263515, "uuid": "a2a08970-7a64-473b-bf48-57fc28b1323d", "value": "T17BE533206044E0BAD5C2647CD118D9313B3E6D3187AA93C6F7A1627EDF226D2B174BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263515, "uuid": "322a1f75-796b-40e0-b08f-b6e47180eb0d", "value": "c12d2adb2dbd84013790ab3af15b680d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263515, "uuid": "ee68b642-b959-4927-8de5-ee015bccd91d", "value": "98304:iLwIElYOCPJ+HLCRHd/5t64pGHv9sqxRGJueAQe+:nIE2PJ+He5fABVXRQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263515, "uuid": "d8d92a29-7e9d-41e5-a0cc-1755a7130344", "value": 3276288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263515, "uuid": "fbfcd25c-8511-402b-a65d-cba27f222015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263515, "uuid": "668dcb75-83e2-469b-80cc-4f819c3d1419", "value": "3cdaca80f86804b2e837331a0728de3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ed58d7-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675232831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232831, "uuid": "05f420d3-3c0b-4c5e-86e7-77423e508754", "comment": "Malware payload (AuroraStealer)", "value": "3c88de41a1fafab68ad70a0bcdfa7b9f", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232831, "uuid": "d43b4cb3-35bd-43c6-83a6-d6ad01989880", "comment": "Malware payload (AuroraStealer)", "value": "0a43971f0d73f2723b0b96526ddebcc07d89e1e3893a1692c412ab742fb5deca", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232831, "uuid": "5da58f00-7065-4c4b-a798-fabc59ad825b", "comment": "Malware payload (AuroraStealer)", "value": "d8d6883d482598ce6ba1d4c942827adae9d13f73", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232831, "uuid": "f24ebcd3-ba4c-4671-a2c9-93b637d21636", "comment": "Malware payload (AuroraStealer)", "value": "fd310720fc78bb6ee4a6e6866bc1e7f06628f80bd780298736a4172f6815ef41a3bcec2ef17d31f64a37c632dccabf77", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232831, "uuid": "5bdd442f-c143-430b-b62b-84abc5016407", "value": "T125D53307751088BCE25B61B11136B379B5B77D239DA1EC039B8FED2E643242A76F061B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232831, "uuid": "a1ab6466-0470-40f3-ba52-2e362b2849ad", "value": "6c88dad5a5f84c7345ad41e7d2809b0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232831, "uuid": "7cc375e6-1a4e-47fb-8109-9054d50e70ed", "value": "49152:R6h16VIZRUQEDL2j2XhSNXwAPX1BgoD/oyIs6tXy2ExmP8r0p6Wbz:Rs6P1ffAPlKyP4XlrPK0p6Wbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232831, "uuid": "bf779a39-0281-4407-ae7e-f59d0d7436a2", "value": 2772992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232831, "uuid": "3323fbed-9232-4403-895b-5365f9134b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232831, "uuid": "2b9f9e13-299a-4f7f-8ab8-c31e1002d392", "value": "gimp-help-2.10.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7c29be-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261724, "uuid": "9afe22f1-9214-47e8-a55d-e7991f1baeae", "comment": "Malware payload (SnakeKeylogger)", "value": "b91b698f53f21ae80348efa7932e8e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261724, "uuid": "8ef5c795-5e4b-4b45-a330-ea5753b40d95", "comment": "Malware payload (SnakeKeylogger)", "value": "0a5c76da6166e4373fc963e4cf7e5b00c25126b10e36881b30b290d59107014b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261724, "uuid": "77737d34-1b5f-4308-ae9f-dedf5d0a3fc9", "comment": "Malware payload (SnakeKeylogger)", "value": "45ed9dd522ee38ee277ba02a9eb48b95e16b027e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261724, "uuid": "91d1537f-7eac-4225-a073-3c924e9d2e30", "comment": "Malware payload (SnakeKeylogger)", "value": "4fbbd729d9c9fce62c3dca9f7a2cf593869bfc203826c5e2fbf07e50a6ae548fd09f03686a7f1631a0b712054498c2e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261724, "uuid": "98b27786-a490-4b17-8f9a-660814ae33b5", "value": "T106B402808D9021A6C57E4F71D2F085BD7B417112AAB1B0BB010DFDAADE919C1FC6ED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261724, "uuid": "c56f377b-bfd5-4e26-935b-14a0a67da17a", "value": "7dc8a7abc496d99feefc72c0a0d7748c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261724, "uuid": "e559a2b8-a2e3-4a8c-8a42-705776967a99", "value": "12288:2CcmFM0luMoL4Ip5iYVCZWOERUB3HDrOtW:27m20M4IpAqCZZE6B3POc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261724, "uuid": "ee01e4e2-e3ed-4897-8c41-f27f7da442f5", "value": 495173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261724, "uuid": "6e67f0bc-b7cd-41af-b88a-4e256c1d5753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261724, "uuid": "6022c1fa-88a1-4d2f-9b64-95c59fd06ed3", "value": "b91b698f53f21ae80348efa7932e8e50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0887fe-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293397, "uuid": "e24aa62e-4732-4622-b07e-769278cbac9b", "comment": "Malware payload", "value": "db6b01b13aecb472ede7fa23a46d1d25", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293397, "uuid": "d3c0ce9b-6138-4143-ac0a-3d1ae10fa8b3", "comment": "Malware payload", "value": "0a879469f6f7bf9a99e56b5c5d88b7908aa7287183e5b33e737bdec7829ac40e", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293397, "uuid": "fdca54a4-a754-453c-aaa7-7b47fff935b7", "comment": "Malware payload", "value": "73c039030dfebd7847987b7740f6b7e759ae8a78", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293397, "uuid": "14df4e65-de4f-4fe3-909f-87f160f5de15", "comment": "Malware payload", "value": "1545c6784393ee06ddbdb05a64d9afc8bc6f71dc2741531a0f955302fff9bfe00d9665dcabce1ae6b65ebae6a6d536ec", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293397, "uuid": "97c9eb9c-c097-4455-8efa-a2607d632e45", "value": "T13C027C44518D19CCC0A1FF15E34E3697AE2DB096E4C4689E033EDB4B4242EECFAE65A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293397, "uuid": "04bcb474-27b7-4f21-949b-b0a946500d2f", "value": "192:5P5uFm4kUpp2RHUS+opYGs83EaN3ZhgveWbrIe/3QGmqtwqfXgDYT:5P5uFm4kag1ju03N3oeWvTAmtLfXgDYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293397, "uuid": "7965f5fe-ce42-4768-99b3-a9354ea72489", "value": 8282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293397, "uuid": "dab68a82-5108-42be-ac03-ce58567c4344", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293397, "uuid": "b796efdc-d16a-4a68-a008-2e504fcf2f69", "value": "0a879469f6f7bf9a99e56b5c5d88b7908aa7287183e5b33e737bdec7829ac40e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7378e7a5-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675259026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259026, "uuid": "096abd84-f171-4efe-a9b9-5e7ddb68621d", "comment": "Malware payload (Formbook)", "value": "d657072894b4ddaf1d6d5de3bcca50f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259026, "uuid": "00b21137-a17c-457e-815a-bebd442835b4", "comment": "Malware payload (Formbook)", "value": "0b3359f98d68ac53feeb501eff6954b770cd4acec5717e0ac5b4c7c84f6fd27e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259026, "uuid": "9fe610f8-4a28-4999-850f-27ab13f99ae7", "comment": "Malware payload (Formbook)", "value": "0422a7db1e7fab619cbbbfb99760878bf8352d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259026, "uuid": "0323b749-7fe2-4443-a16d-3a40a780d919", "comment": "Malware payload (Formbook)", "value": "f8876c73b5621e34d293f1bdf6156654934f2945223218df1275a621fe51613f73adde05ffdffb263dac9dd1e2c1fdf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259026, "uuid": "94df552a-bc86-4f5a-b67f-a5b68edd0564", "value": "T11FF49C8777B1A872F6DB1095142837CD2FE0B103BE85E2579B7B79C0A7059FBB298241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259026, "uuid": "83d99dff-1304-4b8a-9a55-08d651967927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259026, "uuid": "2fbe114d-0aaa-4303-89dd-e1fe96e8602e", "value": "12288:mtz8L6gu+xMRSR5SkVyP3MycnW4kIEFxQfb6ocDzybNMSCdof7KqG4yPa:vLzyRU599cFGT616BMgDKqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259026, "uuid": "79ffed28-eea5-456f-97a4-9d830ea2d60c", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259026, "uuid": "124c904c-3355-4edb-a150-728258ab76dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259026, "uuid": "d7bb16d8-4e93-4042-9297-5eaa1759e64f", "value": "DHL Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e679eb1-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292894, "uuid": "19fea608-88d1-467b-a59a-9ff5821fc439", "comment": "Malware payload", "value": "a488b6228a18d684a15193eea58123f9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292894, "uuid": "fa33a48a-3f31-4dc7-87d1-3fb6fcd536d7", "comment": "Malware payload", "value": "0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292894, "uuid": "8b8f53bb-98d0-473e-aa14-224edd262616", "comment": "Malware payload", "value": "6ee15175930903eefa212dfda2cea7d7a9d9a559", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292894, "uuid": "96200144-fd6a-499b-8a02-0eef4a87b7fa", "comment": "Malware payload", "value": "e32959b166ec0b22490f75e105797845562618c4b82399175c1884bf3dc04f120c831986d3635af083c58f74e529f296", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292894, "uuid": "72bca417-b063-466e-8761-38ed012a7c1b", "value": "T1C6363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292894, "uuid": "681dfb3d-8836-4b4b-aaba-1cd45ef5dc18", "value": "98304:8v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX8:8vpvFa+g8RWLdPk/84tCEr0RtNiC5eS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292894, "uuid": "edadf2bd-120f-4bb5-91b6-2a5710b49ff8", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292894, "uuid": "40e74d69-4718-4b4e-b370-c126152625de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292894, "uuid": "76aa2303-3317-407b-9c30-e56325646e0e", "value": "0b61c8441a3c857e7bf69d2045656c5e1ae643f080f0959e1287bc9395998bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436cb0fd-a202-11ed-88f6-42010a9c006e", "comment": "Malware payload (GodFather)", "timestamp": 1675236612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236612, "uuid": "d51ef627-50ff-4a97-96ad-05adccdea928", "comment": "Malware payload (GodFather)", "value": "ec9f857999b4fc3dd007fdb786b7a8d1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236612, "uuid": "5259159c-ebf8-4beb-a919-711e75933c88", "comment": "Malware payload (GodFather)", "value": "0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236612, "uuid": "43678495-bd25-46f8-9f6f-d1315865cb86", "comment": "Malware payload (GodFather)", "value": "3fa48a36d22d848ad111b246ca94fa58088dbb7a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236612, "uuid": "d3605659-4238-4468-8244-0728f0431578", "comment": "Malware payload (GodFather)", "value": "b0a16b363b9c1827147bc4555888978a49b3f22ebb9070b0ad47e77df99442ef1739938aca295b602546c3d43d674f40", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236612, "uuid": "db17a14f-1eea-4c0f-b932-4b9f9141e240", "value": "T1CB76125AF718A86FC1F792324679522A66074C268743EA875968727C0DBBDC04F4BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236612, "uuid": "20106d2d-84c4-49bf-a91e-05e63670e9e4", "value": "98304:vDdInEpAOdLl2DfGjOmP34z09nmw3xAZMV8JiDQeZgUGdh0fr33dmh++0oEHi6Pz:5gE7tf3u09nmiOZmDid9h+CFZMXmwfXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236612, "uuid": "f1bc1e58-53fe-4bea-864c-5856077a5124", "value": 7559177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236612, "uuid": "162e551c-7757-4b1c-91df-bf13744d1928", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236612, "uuid": "e6b9c5e5-e169-48b0-907f-be8c62c43d05", "value": "0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77ff5eb-a20b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675240672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240672, "uuid": "fc1ffdd5-3c5f-4e34-9d33-51784bffa0c3", "comment": "Malware payload (AgentTesla)", "value": "5f6b2db95a39b931b5a7084ea8375717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240672, "uuid": "d18eb4c4-361b-4bda-81fd-8f29852eb994", "comment": "Malware payload (AgentTesla)", "value": "0bad8d1f6417bda422bc762403bcc9260dd3406d5d7f788833a3c956ad7e86f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240672, "uuid": "3a44127c-8f93-45ee-8973-4de15a006048", "comment": "Malware payload (AgentTesla)", "value": "7f56010b5165568b4af0827b8a93821ba91a2878", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240672, "uuid": "9535f45b-2a27-42d3-b1c9-f908151888e7", "comment": "Malware payload (AgentTesla)", "value": "5a40dc89a1a50a9dfd05b92cee4e3c45a33e0e1222e566572b0f0b7686ea3340c0c950ae0d1614a644f03726f0585378", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240672, "uuid": "3e509d8e-5c95-44a0-a5e4-928431c3a3d2", "value": "T19B655C8437B0A4AFF08B487641183E986E3C705363CBE253A67739D4960D5FBFA54DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240672, "uuid": "a0605017-4cc7-46c6-bb06-75c2f5f16c57", "value": "12288:5ZflYWr87728fM/f6RSabB2RiTh3DTUYX+IJNCNJ9i7+pv7c4N34iDstW7RQxK6R:rflYWr8BMX6R5N8CzTAJw6R7c4N34V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675240672, "uuid": "22bbebec-e029-4f16-bc3f-3e36abbc0d3f", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675240672, "uuid": "cfa1f91d-490b-46ce-a6fe-3fcde52ff198", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240672, "uuid": "b3d47d2b-9b67-4125-b612-f77ca5015e37", "value": "Zahlung.jpg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69891d6b-a226-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675252138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252138, "uuid": "f6cac850-b09d-43af-8fba-385fb93333d0", "comment": "Malware payload (GuLoader)", "value": "2d836d1f8cfa7ca1cc2b6d727f9dfb59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252138, "uuid": "d5bdcbec-2944-4f16-885b-ace9a4c9664c", "comment": "Malware payload (GuLoader)", "value": "0c72b93ed62e3fe25024e78a07ff1207a31ba9a66fb6f8531b37ef9528fa0b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252138, "uuid": "45710217-7df1-4c65-afec-4ee94682ce7a", "comment": "Malware payload (GuLoader)", "value": "4d4844d62b353bfd7f7cf4827cab895b547681b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252138, "uuid": "99468427-5998-4fea-80d3-52a583de1fe3", "comment": "Malware payload (GuLoader)", "value": "4a5cc81a3fd0db1421db38a27c23a19138d57c6fcae04648f2b15c60bf7f34e0ce51db9ea4299505ddd25873fbecb40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252138, "uuid": "8335e5ee-935c-4357-9095-ffa97fd2fb8a", "value": "T13CA422812374C2EBD6B367B129121B47B96EB8493241430B8771035DBD3AE9DEC1D3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252138, "uuid": "9f054dc2-ded2-49dc-afc1-09df9358dd0c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252138, "uuid": "ce01eada-1273-4710-9e34-875119179d41", "value": "12288:cFk7JkvjPMNgvCj8gW21X9X6XpHUaMSlvLXbx+:cK7GvjLKjvSYSd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252138, "uuid": "c41b3d0e-1706-4341-a5da-49a709ca776e", "value": 462110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252138, "uuid": "df6ca044-0c85-4f4c-aadb-284da34086eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252138, "uuid": "4166ca3c-9948-41ec-8cc9-fc784d9754a9", "value": "Contract Agreements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3cd4f9-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293402, "uuid": "9daf14ed-1279-4034-94c7-dfc414801205", "comment": "Malware payload", "value": "56e694c1aa475fec7c7e9c71678041a8", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293402, "uuid": "013fbd90-4e30-43e9-bb80-b53e9017a173", "comment": "Malware payload", "value": "0c803c24a78a1a839d19138bf0cd306b5f5dd812d9db2815b87482163a25960f", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293402, "uuid": "9409fb38-0606-4247-9f34-f9d6acb01d30", "comment": "Malware payload", "value": "9a5204c9ce03d065ccc3b7cd203f0f95ed67c2ce", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293402, "uuid": "24db1778-9b72-4c94-954a-ac8d756b1c1d", "comment": "Malware payload", "value": "1005c555055875a0a98af01f4b585d30a25d00876df592038ee6b09fc724f4d4f6faafceec0043e78a15915810056b49", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293402, "uuid": "0418a90c-4ea0-47ba-880b-fb0bb781d5dc", "value": "T1C332F81AE18E0B39DB90C513906B37EB4459B65E12C8AEAE29C3CA59F520CBD7B405E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293402, "uuid": "2fd1ca52-a17d-4ddc-948c-dfb43063c463", "value": "192:nG2mAyjTQ0gZb9XAuFy90lVaFSP1/1tLrF2MXf+8hP361uSODS1:OAOgvQuFm/SPZL0MXGEvcOW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293402, "uuid": "de149c3c-8b25-4560-a1ae-52bc98a99b8d", "value": 11171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293402, "uuid": "2eead896-00b0-4117-b408-612719b4938a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293402, "uuid": "f949295f-3c7d-4924-a70d-db7b8fb3ae97", "value": "0c803c24a78a1a839d19138bf0cd306b5f5dd812d9db2815b87482163a25960f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a85827-a220-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675249692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249692, "uuid": "21e3ef9e-2cb6-4356-b93d-2d1675035313", "comment": "Malware payload (AgentTesla)", "value": "ce715da3cc8c69a4554f409bc8565af0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249692, "uuid": "8c90da78-6b6d-46dd-ada9-5a45210d7825", "comment": "Malware payload (AgentTesla)", "value": "0cd1e100ad1648356e399179f96723005f7e6b158f746ab54b5bcafc5db9ff41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249692, "uuid": "f823475b-86cc-4af9-bfc2-5bb799fc240b", "comment": "Malware payload (AgentTesla)", "value": "3dc3e3e566e0c14b686b8d84d19f6d705ae48f1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249692, "uuid": "542ae792-aae5-499c-a7d8-4a8fdc83b858", "comment": "Malware payload (AgentTesla)", "value": "fa689cd67949df87df9172f94f5ae9311c353a222dd66bbf49a2991355792352b650790af9dd8b25df593e42217bb7ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249692, "uuid": "4616d302-88f8-49bb-aa49-45c11ba45789", "value": "T1DBD42351D7CF1053D99B66A7E36F9BE6320CD065608CFA14E6EB986EC812722DD42F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249692, "uuid": "2fb5b870-131b-4eb6-9cb1-6c0f6bc396c3", "value": "12288:oDAmAFm1usBhuIHwsHzQHGG2AQgkQ8/qAxW/3avU+cZpHUgAD7aquIxqn4mJE:oFAFMu0gIHwsTQiEiSj3a8+qxAvaWW4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249692, "uuid": "80c144fa-d830-4264-8a5d-2192a9ade91b", "value": 615658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249692, "uuid": "3ea057de-aca3-4f9d-ace7-c6e4345ffe14", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249692, "uuid": "7c71ef30-061e-42a0-8e98-38e896fd79c2", "value": "SI-22311 II DOC- SIMUM2022-3000307 II New PO# 10344 CNEE_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98691176-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263383, "uuid": "c8db60f7-1615-444a-ac97-f133b0f12302", "comment": "Malware payload", "value": "ed0be56461eb04e1eccc0c4c69995381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263383, "uuid": "19ae691d-6682-4432-90b8-56b3f6d77a8d", "comment": "Malware payload", "value": "0d6ea7460a8cd101cdc638e2ffd0e3056c07a0eca3930264ac0a56bf3b66542c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263383, "uuid": "7e920a24-9e07-46a3-87cd-3f2f850aacdd", "comment": "Malware payload", "value": "e77d5b2712fbf9cd6b16665aa658777882811f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263383, "uuid": "fb54185e-59b4-4897-9874-8521370125ef", "comment": "Malware payload", "value": "26459b8edfea6f051239046a626d3c5cd727f9c4b47175916c5774fea8df76c6e95fded1e0da1f538f92f29ed293250c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263383, "uuid": "5832f635-d944-4099-8fd6-82eaf39fb266", "value": "T167C4C5487103358FEC269433F5DD5CB2A5706CA6C6278E3B6217369C8B7C44BAA713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263383, "uuid": "d249c616-5da3-40f4-946b-f41ad9ad0f61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263383, "uuid": "23d78125-a82b-4b70-969b-eac1bc7d15ef", "value": "12288:Lvw0RIxRzdK2PFx6Qc/cCODc+meJnBx/8mueUNuyIuTW4NW:7wweuzWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263383, "uuid": "fdeaacb7-6804-44a4-92dc-7756ea0af4dc", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263383, "uuid": "038b21f6-087d-48fc-98cd-e94f19023f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263383, "uuid": "033bfd69-5071-4e8d-b115-14860013e933", "value": "ed0be56461eb04e1eccc0c4c69995381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e20820-a262-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675278010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278010, "uuid": "be9536ba-6895-40e4-928f-831dcdb9056d", "comment": "Malware payload (RedLineStealer)", "value": "2e36b99fab0f62a1ca48ec53733149f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278010, "uuid": "0835122e-d2ce-49ff-abe1-ac8a847326fa", "comment": "Malware payload (RedLineStealer)", "value": "0ddf97b870f84886319a165da6e079f3f5c7831e3c2a60b94eb42fc50681a8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278010, "uuid": "d3c47afb-8259-4604-a37e-f276fdc8e6ba", "comment": "Malware payload (RedLineStealer)", "value": "0614e05f0d58f5b704533e318f4bb5581eaf975e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278010, "uuid": "126b0518-1e31-44ef-9f06-63778ae62e6d", "comment": "Malware payload (RedLineStealer)", "value": "333724c9048bbac737302c19f09badb17d535ff6934962b04d4bd30bf0f68c597445d633cd639326fb7efef1271e2e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278010, "uuid": "69803fb1-6608-4118-b813-0dd49a3e0c41", "value": "T17D74F1227590C372C9671170A834EAD2FBBE743115B9951B7BB807AE9F306E0673634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278010, "uuid": "ce80da11-824e-4888-96a4-b6817eef1081", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278010, "uuid": "9a8108dd-656e-4feb-9c8c-6473e2231b4c", "value": "6144:ejiZ0L4sjsFHalSCrIpamtI7UD+rMA6yyJv8u8kHrvL:ejiSEsjsNwAom+4DvXR8fEvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278010, "uuid": "41a8311f-fbd4-4e68-8778-89948d49af15", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278010, "uuid": "58c93add-83ba-4bd3-86b6-fdec4d49b940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278010, "uuid": "8ef68ecd-f6ec-4863-9977-18b6fd46f809", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e3b410-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675261765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261765, "uuid": "7fbde742-fe76-4c5d-8975-f2a9e46572a8", "comment": "Malware payload", "value": "03fd5c37e0939a302d0bfd335d808cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261765, "uuid": "4051cc4a-ba31-442f-945c-3a9efea5e90e", "comment": "Malware payload", "value": "0e78a86f26a42335770e1a79657525389260b0213f243cb5f3cfa70948043303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261765, "uuid": "9f3393af-62ba-46e8-8b62-a95becb41367", "comment": "Malware payload", "value": "f5ef1bec6f10a54e8fc85e4c2a2fa5e82f7e13e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261765, "uuid": "44bebd9e-e80d-4171-bd92-c0841a20f3c5", "comment": "Malware payload", "value": "f8587387584c6277de29cd8cb53d9519c714eb97ffc3cb5f58565e2fad549ec7749c73094d7bce6b08acaea491d82b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261765, "uuid": "8d883e45-1bb0-4e0c-b40a-c36f9a386b1e", "value": "T17DB4221133F9936EC33D477ED1B2A430B37AAB406E17FA402FA854E82547B5927606E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261765, "uuid": "be676e56-d40b-4790-b58b-40e002fbbd90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261765, "uuid": "4658d393-df31-4941-9eb1-b1c2e0fdcd25", "value": "12288:ooEevLH/zkcKGdPnbx6KdENaxLsSfBEgAiTlr8z9i7+pv1CWtO:odevLfOKPnbJdEN0V2gAClr8zw6R0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261765, "uuid": "963bc09a-b04a-4063-86bb-2c10e38cb47e", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261765, "uuid": "3176fa36-d228-4469-bb65-f2954a0e7343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261765, "uuid": "ca5b4863-76a1-497a-aace-8f5202483318", "value": "Halkbank_Ekstre_20230129_075423_612150o.pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b63e19-a1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675224662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224662, "uuid": "0a55cadf-9e0c-4535-bc3f-c2adb2bfd8fa", "comment": "Malware payload (SnakeKeylogger)", "value": "660e3fcc23c3a833e6e8af22b13ebd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224662, "uuid": "4ab0e952-4136-4fcc-b2d5-3d9d2c0ca5d7", "comment": "Malware payload (SnakeKeylogger)", "value": "0ea47499aa08a0ed53a42fd19259cb677b4f87446f7fa7609b650f18d327de72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224662, "uuid": "5cfe301c-e7f7-475f-a2b0-06d73c309e6a", "comment": "Malware payload (SnakeKeylogger)", "value": "3966263baa4e4e511fe383910555ef5ceaa40914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224662, "uuid": "df22d206-dd9f-495d-b50f-6935c0b7b628", "comment": "Malware payload (SnakeKeylogger)", "value": "082146ac2210f35f0245f2e22ba1307c3428be770146cdb73b6f79eb76104830b2f49fd524332efea6e0eda76f83ff0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224662, "uuid": "add3f71e-08e6-4c1f-accd-4803f4a0760a", "value": "T17D04BEC563DCDF19D1A9457E80B226B7D329CD2D5F47E32E209031BD9E2238E8612E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224662, "uuid": "8f7940cc-f560-4f7e-9e5c-e7e8f2ff5737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224662, "uuid": "31bcd489-a559-4e8a-a23d-22bce8a415b4", "value": "3072:P44CG54MEA4qmNCNqiSnVm6BY1T2gg/HvV0qZ1+ipTraV8u1VcGLT9XM:Aveu/TMsiaeA/H/P+Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224662, "uuid": "95e92436-f447-4cc5-a692-71b7343b895c", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224662, "uuid": "36f002c7-4b6f-46d4-b0c5-68f8e3df4d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224662, "uuid": "17c17824-c69b-45d1-a058-5112cb870916", "value": "660e3fcc23c3a833e6e8af22b13ebd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f54a7fa-a1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675232256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232256, "uuid": "298ad2ab-c812-4b76-a2ca-be93ee0f7640", "comment": "Malware payload (AgentTesla)", "value": "8014e7e9d75a3129601499b8d168f38c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232256, "uuid": "f1a6b9bc-56d3-4906-9a8b-477d4080c006", "comment": "Malware payload (AgentTesla)", "value": "0fd88c71fe3b4a48c44fb0c303e03e0d1e4c750dda74bba19e41cb8125520989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232256, "uuid": "4ad65996-37a1-429b-9908-fa4f21148eae", "comment": "Malware payload (AgentTesla)", "value": "a9fbff233e8c1b520d276cbfa7ae7c6f4d84a873", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232256, "uuid": "77b48e05-1384-4701-be93-a97c47db63a4", "comment": "Malware payload (AgentTesla)", "value": "058f9165f80db6834bcd7ee076dc4544f8a1221ede00281187c21c4fc2fc7e690cdc4e8710456f5d74859a9cbe826727", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232256, "uuid": "a24174b5-aea0-40a6-8fd8-07d41c718489", "value": "T1DCF4E041AA684B53F5F88FFC437DA6865FB0286B67A3F3B50ED112E314577828500AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232256, "uuid": "28c1bde1-9e33-4058-8d62-1fe742f2e2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232256, "uuid": "13860800-336e-4b96-81f9-7a857cc7394e", "value": "12288:Ht4qSMtEwcU3gZ+GQzjkATGds7BPTmfkBbRX+oPYl5afXal2IFq2QFr:N/S6AAgZbQzlGQBKfk3ja5aPaEP2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232256, "uuid": "a2d26c39-e002-44d0-b68f-b1bc5a4aa665", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232256, "uuid": "6a5bb339-06ec-43c7-a10f-3c695f844a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232256, "uuid": "26e34f52-c103-4a5f-a94d-6b20e0078343", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2474e56-a223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675251052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251052, "uuid": "ff2ff94f-fc4a-4b73-8fec-92858519ef54", "comment": "Malware payload (Amadey)", "value": "d9f343ef3d19bcb2d9cf34a026475f6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251052, "uuid": "ed7062c3-f623-4b94-9d5e-a1d8b5c7ba93", "comment": "Malware payload (Amadey)", "value": "105139f8457f27fb483d283729f0c00705ddf254e8c2021b803fe64057381f52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251052, "uuid": "03207a93-5ea7-4330-9cb8-b1c30d5b975f", "comment": "Malware payload (Amadey)", "value": "d40edeccf97e8c623be22e282418c507a2d202c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251052, "uuid": "8b5b4384-9ea1-49e6-a850-3d54ad021782", "comment": "Malware payload (Amadey)", "value": "5c5e23ad622d2e5146a5c4251d5e3af182571d9d67a4250084a886651c89af240f090c4042b9e6b96cf147234ed4f650", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251052, "uuid": "7062e520-9785-46cc-83fb-6e95ae343a92", "value": "T18234C0327980E0F2F47650705830EEA56BFEB931193558477BD80A6E5F702E2673A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251052, "uuid": "f76b2f56-159d-4c7c-bbba-035dd49fa811", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251052, "uuid": "2b0d9ef8-aa85-4f1d-adfd-6301056406a9", "value": "3072:TSoGhlp+dmC+gwLzNLgpWcY52+bsfl2TUJ6aOkNmKQhnC72RAPpHeI+o:TSo2KGgwNLgp9t+s82NzQh+lPpX+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251052, "uuid": "a18b7e1a-ab43-444e-afb2-3b4f529b88f4", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251052, "uuid": "7bc6cfe7-faa6-4541-8413-f62080db8560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251052, "uuid": "dc99db9b-b0dd-4938-94ea-a08a39056428", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4175cc-a27f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675290292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290292, "uuid": "e2f752e3-9075-4a91-af80-944118cfbc50", "comment": "Malware payload", "value": "092334866080e7ec50fccc264d869221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290292, "uuid": "77e3e54e-f956-4076-b439-191bd0d40a5e", "comment": "Malware payload", "value": "1080f3cd4328fd1e0597c4aba89bf5004894c938234f2d2ccf282f1416219864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290292, "uuid": "a9e199fc-412a-4dcd-8822-73a91cdc0714", "comment": "Malware payload", "value": "b4b69530c71474507e8ec5a341252e11862986e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290292, "uuid": "e8d68e3b-8de5-40ce-ac1b-41c7b79a5769", "comment": "Malware payload", "value": "57dc9bab3789039c8b84371164ed86e62545dca7c9251e91a74910f92656923177b66dffa9cef8639b41b0d6cf1ed873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290292, "uuid": "a00241e5-7b28-41d6-80ab-83fc2a5d6ca4", "value": "T1E8D4E0129AB287CCF8D45BF6C58AA13163968FC0E4E3D31754AE3BDB2C8DD4226714D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290292, "uuid": "f328fe85-b9c0-4fe7-876b-d5a41cdd6082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290292, "uuid": "82cdcaf1-cd69-4b26-bf7a-390e9bc8ff8e", "value": "12288:/QGF2tAu9o+JPYx+5psS5GkwqbT7pllql+WZcYrje23UFDd6S7sQo:/7F2tAu9o+JQ+5psSU12olvraDt7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675290292, "uuid": "d88f68ff-b3c9-4bea-a3ee-b11273aca023", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675290292, "uuid": "3eaf78fc-c896-43d6-b66b-2c9058cf912c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290292, "uuid": "1843c595-b843-4cca-8f6f-c84fa9c92365", "value": "Legion Private Bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472150f1-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267112, "uuid": "0134554a-a043-461e-a24e-a9a856c7c344", "comment": "Malware payload", "value": "331cd311b56cebcad9ff7d41c536aff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267112, "uuid": "737346d6-3d44-4b2a-a342-e296af2c6a64", "comment": "Malware payload", "value": "10c53048944570e3619bd2fa4dad951b8b63634f062ba676abaefbdb70b7a463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267112, "uuid": "743fb614-922e-4ab6-b64a-b40137929ce3", "comment": "Malware payload", "value": "2dd7afd306971b79113d9effdee7329f2768949b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267112, "uuid": "f13a32a7-c76c-41ad-a1f4-2bb4cb3dbb89", "comment": "Malware payload", "value": "218d95df5244e4b55f17b6993cc79a64d6db27f75113a0efde6e539e7ff05c7e46481ff83549f830ccacc2c25f5a31de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267112, "uuid": "203f91bc-9f47-4cca-93c8-24566c058b6d", "value": "T126E533062FA79F26D664703069869E72DF70F6B0E983DF677D41196B8D78382F0121CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267112, "uuid": "9a956fdf-2d06-4348-b733-295a195db919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267112, "uuid": "a36d5e6f-bb6a-4481-aa24-402878321f74", "value": "49152:lSlow8NNDHBloYNSQZQwZCgoEQvlcQ1MDzWs5ZgfyIBegg7jtvnkXMj4z:IlPotbPNreylHWEOyuaxM8j4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267112, "uuid": "d21d88f2-dbce-428d-b96d-f7ddca06f3d3", "value": 3254784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267112, "uuid": "ed77c034-24a1-48ad-9501-3397661e7a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267112, "uuid": "4f872390-a012-4f49-9c09-1d2afcf58a27", "value": "331cd311b56cebcad9ff7d41c536aff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176eaa7f-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257154, "uuid": "d92787a4-55a5-41cc-b946-d0aa9cc65f20", "comment": "Malware payload", "value": "fed3a82db8740cf85fbdc2de82160072", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257154, "uuid": "996aa81c-5637-4c2e-b3a2-558c8d6c4615", "comment": "Malware payload", "value": "11e0695087138cd1710acd777ec6caf1d6d9b096f94d0a3182a87ec816221294", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257154, "uuid": "e1db38f5-e62b-430f-a22b-a29eb46bf54d", "comment": "Malware payload", "value": "854f0a9801e43dd406ff4f1bec8d1915f88475bc", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257154, "uuid": "6e5f8375-8b37-41f4-a72f-1b045b5b80e2", "comment": "Malware payload", "value": "35cc456830788319fa7e092554fcd7aa2278d55e720e0563997230706ad59ba7762ea5da429f542eb9e9421bdda42f51", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257154, "uuid": "e1d6a9cf-248c-42aa-a7d0-aeace3061cd0", "value": "T175E30B1869858536D37A03767095BD34C33EE01A2512E3BA7CEC55AE3F37F6805A1BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257154, "uuid": "ab2e7e9e-d19f-4aae-a274-d505a367f14e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257154, "uuid": "d06d63c0-98f5-48b9-b498-7554e9370023", "value": "1536:3iLqAEkCqQ2ovFQ36U3QVbChbO+A0FvGI39qFe57Ila8cKgXJ/oq2WrtJb:NTv+3H7A0ZGTFg24JoXUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257154, "uuid": "499ce483-8d19-4c0e-a254-799d0d8724e3", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257154, "uuid": "5f8fe839-22c7-4e42-8670-74d1d9929283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257154, "uuid": "dcf4f895-caa9-451c-bd6f-8d5645f7d87a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0635dd-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675257162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257162, "uuid": "17ab3c4c-3c12-439b-9601-1d2df66ee486", "comment": "Malware payload (Loki)", "value": "71169e2bb6e19b3c3edcd7d8f3d6d3f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257162, "uuid": "bd8bf914-f0ca-4f6e-a827-23253c39e101", "comment": "Malware payload (Loki)", "value": "12256ae063a7afb4bffdd880d213a272b4d0b1cbfbdf0b5334cd4a0ad5693844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257162, "uuid": "c2c2e34e-b662-44c1-872f-2e9bb20f90ab", "comment": "Malware payload (Loki)", "value": "5bfa1d6c520f1fc1399075451e7041710892f831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257162, "uuid": "fabdd3f9-2d1c-4164-943d-6058c465e3b3", "comment": "Malware payload (Loki)", "value": "f9880b51d9541bebe9acff926d04f75cbd034f87ff75aedaea0a9689ce78343cbf64824cb2cfc9bd6a02976f5db201e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257162, "uuid": "f13c9c25-92c2-4952-b7df-17e67edcf5d5", "value": "T125353305D15D2872F97FC9B24DE7BA1856B021F0D9D734D922C8B67B86E64FFC0A2092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257162, "uuid": "c54be882-1cdd-4e5a-a7ad-aa90ad10460d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257162, "uuid": "0b835469-d2a7-4aa7-b553-9fe2a6899116", "value": "24576:UvI7TSou8WggsUVxqip4Fb8xxBryiYeJwJXuPPKBAkwEDML2:Uu2CWgglVb4Fb8xxlyipaNuKh5Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257162, "uuid": "3dfe83a7-7099-40af-a335-c7f85bde107e", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257162, "uuid": "165e9af7-c1ec-45dd-bfe4-cc058a51b19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257162, "uuid": "61ba353a-43cd-4691-9c77-a1922cceb636", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67651908-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1675261583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261583, "uuid": "9f0c0b44-9bec-4aa4-bb29-7316f9863f51", "comment": "Malware payload (RaccoonStealer)", "value": "67d56c44c8097f14018b2a9bd9f671cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261583, "uuid": "9ca5be27-ceb9-4d39-9dc7-665a6dc650bd", "comment": "Malware payload (RaccoonStealer)", "value": "1273d769ad266f4fc8772da8dc6402a318f05f8c3a84abe3e5542e83dce1497c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261583, "uuid": "db054da6-59a5-4a30-969e-cd9e8f8d07ea", "comment": "Malware payload (RaccoonStealer)", "value": "5c35f05d59106ce7850428a403f037e80d198a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261583, "uuid": "322d4ad6-492c-445b-9f39-ba69fb734426", "comment": "Malware payload (RaccoonStealer)", "value": "ca35efe02df3070b5c96ea61cdc33c65f2a6110549023dd0496724d7dedac0af54bdcba4f52c4a72a0a9e5a3aaeea36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261583, "uuid": "87c4ed0f-d35c-4799-af53-7a37f7457770", "value": "T1FC6623A3A68016C5E87588389537FDF13EBB7E3ECDC169B862C9B9C124324E59523C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261583, "uuid": "7e06650d-5155-45a7-8b21-964b8fa1ecf3", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261583, "uuid": "f934e0d3-ac10-4c81-b8a1-0e3ee71beb56", "value": "196608:xmD/cRu3LyA8OYtgd/bS/4jqJK7nmLAqqY:xmq5KjS/ojnBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261583, "uuid": "ef35f60b-b7c5-419d-a2ae-7be19ddd0e1b", "value": 6597562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261583, "uuid": "e24d3fde-3bf3-4ce1-89bd-9c5eacd82686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261583, "uuid": "9bc57cbf-2269-4efb-9538-9a0945a378f6", "value": "Autodesk.AutoCAD.2022.1.1.en.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e5eef0-a26d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675282679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282679, "uuid": "6e76fe8f-b3b9-4afe-bbd2-100f0a8a70ac", "comment": "Malware payload (RedLineStealer)", "value": "a346afb6ac91d3c334389ee2a77375a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282679, "uuid": "656f5b7a-2aaf-4b17-8d13-16f775618ae5", "comment": "Malware payload (RedLineStealer)", "value": "128d2d2a6a859ba8f5d85b83bea6e97c360092672e84a1265a0efa3882456fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282679, "uuid": "5853cabc-4e3e-4c05-93f5-e474d53f8c65", "comment": "Malware payload (RedLineStealer)", "value": "7400fc454ceb0afbfd06c3488fbc41c8b91b28ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282679, "uuid": "4a839775-47a0-47e3-b87f-f33249be1055", "comment": "Malware payload (RedLineStealer)", "value": "117d047e6e7acb30b0a067b8c64435891357ac68b3f6747260960523ba5323c0174b66214a325f0e49037ab07c1b4125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282679, "uuid": "31779363-571d-436e-bd75-3d652122b8dd", "value": "T1C614D52437FCCD11E1BA1A3F6961A05146BF9802AC42F25B76C767CD0E36B40F957AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282679, "uuid": "470a5e34-0715-4bfe-a444-a6bef5cae7d1", "value": "3072:1xqZWjIaVECnCNB30u0wzWeme9nhrrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0x:/qZNNB3XHz/nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282679, "uuid": "1c13952f-f1da-4684-8879-8e0ac34a18f3", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282679, "uuid": "c3e1e06a-003c-4cb3-860f-ce8466e69fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282679, "uuid": "152f77c5-9083-4b96-b968-bba04fbfdf0e", "value": "read.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e182ffb8-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675268230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268230, "uuid": "b16dff87-8a97-42a3-953d-902dafba8226", "comment": "Malware payload (Mirai)", "value": "fdda4e277ab57c7e5d4a52312f9eb0d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268230, "uuid": "6580305c-f26c-4472-8687-6a88706a57f3", "comment": "Malware payload (Mirai)", "value": "12bb43c7ecc70e436135f15a5eb9faf1c8d4ffed281b9e233c83055365fda6d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268230, "uuid": "4e2f19e0-0061-49c1-b504-06d05f465479", "comment": "Malware payload (Mirai)", "value": "573dafa10aee8cc7dd2f176b96726822cc0ef082", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268230, "uuid": "352cd0ba-9d9c-407e-b66f-22c076ebd170", "comment": "Malware payload (Mirai)", "value": "38dc520ceb816f8004b564bec5e8cb76e017501b359a899cc66ef1aa6aa5041c487b4b03fd1124af95c137e9ff4e5ab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268230, "uuid": "ef6a9dbc-f77f-402b-a27f-59b48da3ef52", "value": "T1B423F21320D7EA13D460447FD9119D687E045AB9B9AD77BB18411294CC20B63FEF1ABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268230, "uuid": "5370b326-5abf-4965-b863-bea171d5fd31", "value": "768:/K7y1XGO1LCNgukEkvwtqPnH7u83nc0iFmW9q3UELv1Q06pMBwAA3i5Q:312O1LCNguovDPH7Tcro7LtQ/pSAy5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268230, "uuid": "d2eeee8f-2818-484c-85a9-3939a2d04be7", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268230, "uuid": "b1d1b4c9-1144-42ab-96e0-8672db3ee024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268230, "uuid": "0c0ad70c-0f6c-4265-a4fc-251b47258b36", "value": "fdda4e277ab57c7e5d4a52312f9eb0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56ec833-a27b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675288853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288853, "uuid": "bb78cd60-f85e-439c-922e-84a01868a57d", "comment": "Malware payload", "value": "12b8a1f114a8b3e2ce261847cffef2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288853, "uuid": "4bb20133-99b8-4063-8a76-9ea4da7b3792", "comment": "Malware payload", "value": "135ab9ce2b0cbc675599081cbeb58bf3fa1f1507884cc2b0473e294c3bb10be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288853, "uuid": "676c50cd-fe3c-42ca-b22e-906dfd75bca2", "comment": "Malware payload", "value": "13165ab78229bddefb49036b15a641c0d898485e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288853, "uuid": "45296b3d-b548-4c6a-a5ea-d361f549c181", "comment": "Malware payload", "value": "8d7fe76799ff98829c955e85f51ba326904660e6365716a71c8cd1989cefcb59f0f3fc8805ef12b676e0352750518a67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288853, "uuid": "3a077530-4236-4f27-81ba-63c9ecc7a01d", "value": "T18C34DF3275C0C073C5B751300C64E6957ABEA5324935A91F7BA81BBEAF702D0673A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288853, "uuid": "44d71ec3-1cc1-4c94-b2ff-ec9e773a4d85", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288853, "uuid": "352242e0-c062-4b30-909d-9845f28bdf1a", "value": "3072:V9TRbcSTglJpcLwhWtcZNr5UYCBELAfVWg3nj0zv82umsN6eqOb:fTRYnuLwh8cZovBELA9H3tbNOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675288853, "uuid": "2d5ae504-c63b-4b9a-80d6-78e587ad4ee4", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675288853, "uuid": "db4deb82-3e70-41da-8b37-b8f113a595bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288853, "uuid": "ded3e19a-64d7-4803-9ad3-99a58422f3e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0389f57e-a283-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675291910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291910, "uuid": "5417c996-675b-42ec-b26f-de245f1bf825", "comment": "Malware payload", "value": "4326474c74ba2be1ab257f1e9d69c390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291910, "uuid": "acf32935-2b32-4514-af76-e238a9d4e185", "comment": "Malware payload", "value": "136f12a4955e20f4719668b24ef38fe5bab2c8e67c08de6dc7a25f7e83a4000e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291910, "uuid": "f1f7eafc-8847-4513-8dfb-7a345f0eedae", "comment": "Malware payload", "value": "c05a6ae46861f23bd62a36aa90cdc086bb3e9828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291910, "uuid": "031e627e-da48-4223-987e-ed302adcb84a", "comment": "Malware payload", "value": "a2e890f35edb32058f5db9d0d3d1570d2ea7b8e83dfba9f272c391f213def2b23cb2f1661e3bc8860bb0b7cf3419d09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291910, "uuid": "0e86b590-1c51-4eee-949b-0bf366a4ec95", "value": "T1D494022A8931488BF7B340B93E4854D6996F307D7DD27E7E3CAE5F8E073556A1821382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291910, "uuid": "64977b3b-1898-4bd8-a3ed-5535f3d37075", "value": "27f78e8c084a84bab9d06db9765091c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291910, "uuid": "2cf92e13-9c2b-47af-a8f6-53a52baef6f1", "value": "6144:uZUUN1IR8LHWDw0OEVaR9O8cb/LI4HTPasf1RPmSD2paV4GVwb:c1IsHWDLyvwc4rzTPifX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675291910, "uuid": "5029b9e0-6843-4818-9486-c968053df906", "value": 409601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675291910, "uuid": "2f2b8959-6f78-465e-8194-13b9ec4058f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291910, "uuid": "e9d6819a-687a-42c8-9c5f-d3fc825049a7", "value": "sAMSuNG.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4abb623-a202-11ed-88f6-42010a9c006e", "comment": "Malware payload (GodFather)", "timestamp": 1675236775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236775, "uuid": "5ad03664-253c-482b-88b3-18d4827ae222", "comment": "Malware payload (GodFather)", "value": "c685ca051d3ca0cdee08f5a33a548031", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236775, "uuid": "22a58d7d-0dd5-4b0a-bb8b-d2c74a3d5f54", "comment": "Malware payload (GodFather)", "value": "138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236775, "uuid": "53ffc4f1-8330-4607-9d57-f911eea52fe9", "comment": "Malware payload (GodFather)", "value": "e2757e1edd96238202862ba5e7f926f5a3911e17", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236775, "uuid": "b6388263-2286-4fe0-af58-af29598f4c0c", "comment": "Malware payload (GodFather)", "value": "2c42a4bf16b2b14912549d1261a0428b99c2ef52f2858d1f8c9836347f7031ff0319d5e47e472b5ca0d684bca16d6248", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236775, "uuid": "c6e5a13e-0c05-43ec-9175-b74416395387", "value": "T15256F042FB44AC7BC8F783324675163A563BCC658B43D287295C327C59B79DC4B8AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236775, "uuid": "d684543b-0b92-4b36-9178-9ae21038fa8e", "value": "98304:R/eo4hMLS/ppS5HjEoPkB49NLcJ7FJfWememnetVbIhXicG9bL+cLudyETyzfr9E:R/eo4t/jvqchnZCetVby09bCQudyMMH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236775, "uuid": "02ef6c10-6a8a-4b71-8207-47ac46f1a0c3", "value": 6103659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236775, "uuid": "46087dbd-0d41-4a44-a8b0-29837dd9141b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236775, "uuid": "28165bf0-6fad-4dde-a06d-adc166824aef", "value": "3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2958234-a25b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675275104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275104, "uuid": "52d2ff38-6437-4a81-835f-391c3bec7cd5", "comment": "Malware payload (Quakbot)", "value": "21b74ecb9ac9c6e3e22cfaf171be353c", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275104, "uuid": "8567f41b-a8e6-472f-9025-5b60cca7e8d2", "comment": "Malware payload (Quakbot)", "value": "13970db4675a4a91a4018eb53f104b6e2b2d84a168b4d2d1410c26e36b7c002b", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275104, "uuid": "0fc892e0-413b-4f9d-b0fc-01212a0c418e", "comment": "Malware payload (Quakbot)", "value": "e42cc509411865210ab726116c9579f14b805c4a", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275104, "uuid": "e55cb004-015f-44cf-bcd0-9d7eff3c9b8e", "comment": "Malware payload (Quakbot)", "value": "12fd3332bc27c0417b025d0ae424cfe8de4360adce91c247ee1833c8cf6073dbc1934361124f5dce8afe62544976b0bc", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275104, "uuid": "9dce792a-ef5e-4fe1-b30d-d5a084a59005", "value": "T16904E11266F545E5EFE07BB24DA3971DAA2BBE27E212035F4BB56A2D4D60300DC04B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275104, "uuid": "e10ba939-f46d-4dae-839a-da5f47146a1b", "value": "3072:haA0YRw9/WITtTWR7IbNzvL1aEHuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCb:Ba9xytedL1jr4iERByz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275104, "uuid": "99e2dc92-9835-4f3f-86c3-52d57c121676", "value": 181416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275104, "uuid": "f804948c-d1af-4994-89be-c19c36664e92", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275104, "uuid": "2e1acbab-3da6-4159-844a-46b70f148d8f", "value": "ComplaintCopy_35162(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dddfc-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Conti)", "timestamp": 1675256249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256249, "uuid": "f3a379af-e148-4af5-863c-a746653fadc0", "comment": "Malware payload (Conti)", "value": "8d27d0c897ce21f1036bf659fc663cf2", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256249, "uuid": "1d5d69cd-ad94-46d8-a8b3-5c20d494734e", "comment": "Malware payload (Conti)", "value": "139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256249, "uuid": "8002eec7-f7fc-44e9-be2f-6cc0985c8200", "comment": "Malware payload (Conti)", "value": "afe3d0fb48092aeca4dcd3989a076e87fdbe69b2", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256249, "uuid": "f54782c6-5c94-4915-bbfa-eb8b88f698d4", "comment": "Malware payload (Conti)", "value": "c25464a95b6a24ef1fdf4a982f4fc6b44d6241dfde887ece01a298480019b1e7a6dd0a91e666c1104327446fbadfea09", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256249, "uuid": "8803c7b7-6c5e-41a0-a3a4-abbf8cfa473c", "value": "T156046D05F24D9279F5AA283026F97A7254B9AD30638FC8FBB7C14E1406606E17235FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256249, "uuid": "232be92c-d097-4302-8b8b-cd6972b7fd1d", "value": "f5346a7d2508fd5976d3449f3afc971d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256249, "uuid": "16b29a46-61b4-4ace-b08e-692af4f2a914", "value": "3072:/gq2DKdMbv1S/n6rHBJK3V9LBSLrKa+HQXvMES/D3Yw7yZyYpEaI:/84X/19LUPMcMEw3kTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256249, "uuid": "28817048-484e-4b39-8d1d-36dc042b61cb", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256249, "uuid": "6833b5bd-cbd2-42ab-be2c-e4a614866fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256249, "uuid": "7df1cde2-618f-4b6a-b465-8de408ab8b8c", "value": "locker.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7edc7f-a255-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675272198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272198, "uuid": "add66525-b732-4db9-b097-a4c6ed66f3a1", "comment": "Malware payload (Quakbot)", "value": "f2b83aefd06c3c9eec23a1067cf87dec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272198, "uuid": "29c6810e-74d0-4e54-855c-3bd09740a259", "comment": "Malware payload (Quakbot)", "value": "13bafaf82142e8016269e9d2c2f430589f33217d61b7da8336d799d13db5d6f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272198, "uuid": "2055ad91-239e-451f-95e8-499910671c30", "comment": "Malware payload (Quakbot)", "value": "7fdd4fae87cd800e308802cee98d70c381bfece9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272198, "uuid": "4c029d64-8f4e-4e4c-932d-3dcd2a4d37cd", "comment": "Malware payload (Quakbot)", "value": "3c05362e0e219634323b2961e4d562bdeb6a1a0aafab6842acfdd91bde39c465fac77d16c2f1b78e405de37299ce21bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272198, "uuid": "afe341ee-0e49-4528-86b3-5c3a61284213", "value": "T172D48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2D29DD139D1B64930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272198, "uuid": "a2604d2c-98c4-49c7-ad48-d4252d73fb4b", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272198, "uuid": "e8209620-52e1-40bb-a88f-48f854893c13", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTx3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1ttJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272198, "uuid": "378b873e-a286-46e7-87be-71c171468375", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272198, "uuid": "0c658f88-5339-494d-9166-86a8565c95d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272198, "uuid": "ef563b80-d1ad-4b48-8620-675b2a2e95d4", "value": "index1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1610aa0a-a288-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675294088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294088, "uuid": "d3c1803a-002c-474a-9d25-ae5eb752eeef", "comment": "Malware payload", "value": "ac587b5b4097961095092ffeab37a521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294088, "uuid": "f089dc7c-6aa5-46cd-b968-04aa757478c4", "comment": "Malware payload", "value": "13de3773e47f64561afcb53a17e4f396a54a607021d05d72c0d8a54fc68d734f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294088, "uuid": "8fd94c52-d4b2-48c4-b80a-6d7b18b6bec0", "comment": "Malware payload", "value": "707481e758e4fbf4e6ad3bb2987d519e039d8cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294088, "uuid": "7ccd2637-aea4-4e64-a3a4-f71311933a3a", "comment": "Malware payload", "value": "c66fa2190fee853f27a57d9392d96f2f867a4794f8bbc5075b706d290a20bf19aac2aa468258b00cf10a3094652d392e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294088, "uuid": "fec094d5-0179-4ac7-9f01-700582e7e877", "value": "T19776335339F88FF6C68602B3CDC18EC381FDFC6A9A529877664B49248F6DCA94D05427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294088, "uuid": "2fae3d24-2823-454d-83ff-a8e61c0b326d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294088, "uuid": "6a42412c-e6fa-4eb9-baba-d857e6d2352a", "value": "196608:91OQD6rCgTvl7tg3QlCDNg/pg2giVEzt4X:3OQtIlPCDS/pn3Ezt4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675294088, "uuid": "4519d2d2-da02-437e-aea6-6c572b8c5a30", "value": 7632550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675294088, "uuid": "49f6a8fc-a565-40e5-820e-df6062e652b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294088, "uuid": "37f6e9c5-8b90-43f8-af6a-8fb475f1df60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d02b31-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263726, "uuid": "216a13dc-392a-474d-8aff-4274c6939cc1", "comment": "Malware payload", "value": "62cceb9799df73395796b28182df6c4f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263726, "uuid": "2b6fbc89-d780-42d1-b8ea-97471df65922", "comment": "Malware payload", "value": "13e5b392701041a85ebc009f8e5429febb56b6879b789c66351e6e4945ea82f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263726, "uuid": "9a22016b-bb50-42ce-bb61-3114a08260a2", "comment": "Malware payload", "value": "6f1739facbc6833add22d2537ed1e28493857f39", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263726, "uuid": "adbc6d05-8948-44d2-bfb3-3f1ffb21e9de", "comment": "Malware payload", "value": "0fb3257c24a43cd00b7f3fb5c5f93d5f94e32faf261289dd9661085b748d6acb0c9f3735f186ea5ead48e4f1558add71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263726, "uuid": "b8465f6f-fffe-4a1a-8e60-6020508d845d", "value": "T1BB038F5AE79E0264CF950277671B1A88AAFDB33EB3105471346C937433DDC2E426A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263726, "uuid": "c8e16fbd-21d0-4a6c-8812-c3e8e4a3822b", "value": "768:ZFx0XaIsnPRIa4fwJMGf2B613WlctV3PEbWd6HgE21i:Zf0Xvx3EM56WWV/6WQHgEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263726, "uuid": "e397ed36-c0d1-492a-bd69-ad9b1b1063c3", "value": 39053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263726, "uuid": "e8b8bcd4-6ce4-4cd0-a5f6-4a46b6275698", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263726, "uuid": "fece322a-5be4-4c33-aa9d-29163cc46322", "value": "ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0f57c5-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675265320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265320, "uuid": "ebd59d78-4605-42fb-834c-89cf41e56487", "comment": "Malware payload", "value": "63253ce47d03a3674f68a4605510234b", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265320, "uuid": "a9c26cea-ff7c-4745-b4b4-f622794e39dc", "comment": "Malware payload", "value": "14872981701d4af9459d57a841a5691631c7e36b4af998fc52cfc5efcf1bf780", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265320, "uuid": "c7259895-c97f-40c6-9f11-7a7781d29594", "comment": "Malware payload", "value": "8c85f9e388bc35aaae50d800e6519625130c4ead", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265320, "uuid": "f2076786-d6fb-40ee-88da-1102248fddfa", "comment": "Malware payload", "value": "b1b2d5d43d478bf72ec9fadb71354f699b8b54a01b4aaa3374f9b6c78483ed4660cf139a7076f079ceb2b980ba3d78ae", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265320, "uuid": "ff504025-b9af-44cc-87c1-bcd400af6f1c", "value": "T11304D11226F649E5DEE07FB25DE3471DAA2BBE27A222035F4BB6662D4D64310CC0474F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265320, "uuid": "cb6ed3b8-054f-46f5-9857-6b7f01ad79b8", "value": "3072:2aA0YRw9/WITtTWR7IbNzvL1ae8uWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCb:ca9xytedL1Hu4iERBoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265320, "uuid": "7425c994-3533-4d56-9b2a-cb3a52652b3d", "value": 179826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265320, "uuid": "26ffa3b2-2205-4c78-9438-0422b51363b1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265320, "uuid": "c76c3944-6fca-4ac7-bb83-4fa874461956", "value": "ComplaintCopy_80528(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883fa926-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293421, "uuid": "7cdfbf92-12de-410e-b0f8-9d924524b99c", "comment": "Malware payload", "value": "f411a89cac7f06b6a61b80fc588f3d5b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293421, "uuid": "ae61f639-2267-433d-8a26-49495438667d", "comment": "Malware payload", "value": "14a18669187494ec0541e354ac471bf4727c28667de20c10d964846b9f325e76", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293421, "uuid": "87868f7d-6f01-4a60-950e-989c708a2b35", "comment": "Malware payload", "value": "38d8eb9e08b77507ec18cc469bf3aa3e1795e7a3", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293421, "uuid": "c12c6272-3d8b-4234-a54b-d1937296917c", "comment": "Malware payload", "value": "d295e5f1cb4a4dbbcf20a4740c5c0d0b90b2a78ed4d0d0bee3f16f0dee94311654674ff29afaea43e74a79c20c8a0996", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293421, "uuid": "2995d6b6-2e7b-4df6-bc2e-dc5f11c5435f", "value": "T1BC34F2B12CEA4DC8C14C42BC55C87845B4C6B6FBCAE62C67FFDD59A2DF04822269E5C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293421, "uuid": "b8f19766-4877-44e4-bde8-c481d0883cf2", "value": "6144:XFyHORTaqFGnAmB6z+HLkLF7Rwipxaupsthbdi:EHRqlmsR9brsthbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293421, "uuid": "4b697533-3044-4b3b-83b9-9a6491622c6e", "value": 233026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293421, "uuid": "7a525015-19de-4e83-ba1d-56199cb42372", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293421, "uuid": "ff4723a1-1647-48f2-8e56-e93005184043", "value": "323U8219-4 LWG Rev A .pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1ba2e4-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675211742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211742, "uuid": "a62142a7-462b-4269-881e-5846ac19a302", "comment": "Malware payload", "value": "b94374cbee7171f94d2ecd028a820f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211742, "uuid": "fc427a23-d447-48c2-ade5-9950fc4a36e3", "comment": "Malware payload", "value": "14c8c5ac89a618c61bf9d338a061ac9138dba8f251078a384e4a72b3c94bb284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211742, "uuid": "d237d69a-be9a-4fa4-8ab1-d4fd8a2bdae6", "comment": "Malware payload", "value": "793387f5dc499f7d8620ae88c21d4719e6886dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211742, "uuid": "c8a908d6-d07f-4d7e-9972-3a47f3e7d951", "comment": "Malware payload", "value": "9b9eee9f2c4d3a459698dd7c0ca58bc8448cff7169735905f876221e0670f9bfff2260c3a6aba41b21fe7fb8fe6d039f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211742, "uuid": "aadbe7d8-6658-4e1b-8cea-2079cfbf6b5e", "value": "T1F6747B18F7C6C1F4E986857C0DA67B3B9A7C464403157AD3E3642CA3ED712E2693638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211742, "uuid": "60d5dcc1-7a9a-4256-a208-bf5b19dd5db1", "value": "c494a1f3c9328d5cedfb51957f1e1e61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211742, "uuid": "95cb8af1-53ff-48a6-81db-4bcfe540337d", "value": "6144:6UAueOYyT3sU0oSath3yW2AFltqaPsrD+7hG827/JYwGzzs6d6D6OSP8Nip:6tueOXT35ldltqaUu7h67/JYwGzdgY8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211742, "uuid": "408a5434-bdfa-489d-aa90-825c0e078a7b", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211742, "uuid": "64e62074-b474-4be1-ada9-960e1dc6118e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211742, "uuid": "fbb91c69-00ee-4664-9cb3-fe05e0ab536c", "value": "SecuriteInfo.com.Variant.Zusy.404518.24027.15847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5216add2-a220-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675249521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249521, "uuid": "983bda00-f2e0-43cb-92b1-3f5643898ca7", "comment": "Malware payload (Loki)", "value": "5d7f2446eead507f0b5477d8dd8a0a3f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249521, "uuid": "694faed2-06de-493a-bb01-cda88f8c25aa", "comment": "Malware payload (Loki)", "value": "14d6e05410e3b374b1d63ed82c5af8aec688563d56fd59f7851467ba2ef3548d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249521, "uuid": "fd6869d6-bd89-4b95-b6e5-1f935e948e94", "comment": "Malware payload (Loki)", "value": "ee29484d82ee67dfb6d221a5975264a4c0580222", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249521, "uuid": "27761244-95e4-4293-8fe8-6d3a38df1ba1", "comment": "Malware payload (Loki)", "value": "169a001a82ba6408600e03b99ef2e312b650bf7ab1e45d149930334b4ecc05daa37bba35f2a2106dabe1beca33622091", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249521, "uuid": "41caa201-fbf6-4c39-be51-6720ed17c2cd", "value": "T182023B38558908A3E79389D2A59F7E4992B2F0B7DFC69E40432CFEB406C7A250F1F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249521, "uuid": "d1cbf734-f00f-4a65-95e4-89e995f1ac05", "value": "96:ymEjR7UABGk8mn1jF9/aGv+0KF6+tlwdtOklO6LP6hO8uwmewEJmmXB:YjuVk8MT/t+0KFZwdLD/8bmuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249521, "uuid": "94ccfaa4-1b20-4a32-984c-9afc8561513e", "value": 8944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249521, "uuid": "c1fe6f8f-0777-4596-ac34-72f25c590817", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249521, "uuid": "10edd007-7c89-4eb2-bc1b-7b8aac85fdca", "value": "IN-066.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e497607d-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675266947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266947, "uuid": "8af801c1-4cce-43ff-9fc2-6fc92d3dd7f7", "comment": "Malware payload (PureCrypter)", "value": "6f97a3f9d8c88ac5ba01fccf033a66aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266947, "uuid": "f9174fb7-8629-424e-af7a-0eff0eb90c86", "comment": "Malware payload (PureCrypter)", "value": "1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266947, "uuid": "99b569f9-f142-48cc-8d83-bc5539e40a24", "comment": "Malware payload (PureCrypter)", "value": "5152b20ec9d63e9decb5a17ae652ebd105ce0a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266947, "uuid": "e4288a9d-51ba-43da-a411-0e1bb260ffbd", "comment": "Malware payload (PureCrypter)", "value": "b1d9100142035559113742b406b267ad4d2c5c947803c8527588e61c21c6a6d0217bad7f7fb937c3041242eacfce79bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266947, "uuid": "030533a7-9283-4745-9708-66459229214a", "value": "T195049E1BAB544B33C52B6BB985E747753230CC819F8B5F06A6E46D397EC63C27D0A188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266947, "uuid": "79305c6e-dfe9-4db5-ab4f-86cefe941e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266947, "uuid": "773ec8ee-923c-43ed-802c-759562e53b51", "value": "1536:pc9URWzKr7PhuuUpV7+5JTiy95UuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRcC+R:ppWaxa7Dy956S2j4xnsvXtPdSae1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266947, "uuid": "a5abf633-36f2-4df0-952d-87e49a1d5e12", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266947, "uuid": "4e4a4c8b-abe5-429d-97d3-60b5f14ceacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266947, "uuid": "6dbe70d7-ed1b-4316-a220-c047529e3248", "value": "6f97a3f9d8c88ac5ba01fccf033a66aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30590fdb-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282106, "uuid": "0aedd9e9-825c-44a3-9813-8df7fdb97ae7", "comment": "Malware payload", "value": "396bc10eb3aae03b62d48b2ff54e25d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282106, "uuid": "779e454e-d7bc-4727-80c6-320a3b49ea9d", "comment": "Malware payload", "value": "15099e19882a6920a378bf1243d7d53468183720fd68ddbd689b3f251cd46c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282106, "uuid": "2d85dd7a-2c4a-453b-9bdd-96b19756f623", "comment": "Malware payload", "value": "1ab9dbe381a11cc9e66773131acdf331b236f323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282106, "uuid": "31a52dc9-7035-4c04-9a6b-f2e0b7b7ccec", "comment": "Malware payload", "value": "880d78a17f7026711f99b6e8874b875902d0a6ac5c4f1f6fdce10a8c07f2d6f71f9d3d2ae71054d19db291ae7b516f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282106, "uuid": "19849365-6783-49ee-a1bb-24bfd37a6cfa", "value": "T18405F63E297757D6C334F93186E18420B6EEA1823713E96ADDE61AC14F026C2BDCE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282106, "uuid": "1738e828-e5dd-42e0-83c6-10abd86fba2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282106, "uuid": "da6c2fd2-21bb-459e-a88b-c293e203b1d5", "value": "24576:osdtcjseHKNTn7tunA+/kSvQMfmBm8T6ocyfvLf+q:osdmOX6o1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282106, "uuid": "1fd53cce-c934-4711-adb8-a653205194a3", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282106, "uuid": "b6f033c3-d171-4905-8ec1-b8ac9d555649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282106, "uuid": "7e056c55-402c-401e-8609-15bc9a3a6e8e", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66bf3b9-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675239355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239355, "uuid": "77ced1de-6ee2-4822-905d-3c8727a0c33b", "comment": "Malware payload (GCleaner)", "value": "9e92a874b5296acc781345afd2bd0ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239355, "uuid": "1ab82b7b-ffd8-44be-9376-8aee6b039f04", "comment": "Malware payload (GCleaner)", "value": "15ccd4955339b86e93bb216c79be44f7d7482e9f523599a58bbecb20521ecec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239355, "uuid": "d34ca4dd-590f-4a5f-ab17-58dda3ab8758", "comment": "Malware payload (GCleaner)", "value": "8a1ce9085fe3f75491d141931da6ad7e21f719aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239355, "uuid": "79113f9d-570d-486a-a1c3-9e6aa8a496ab", "comment": "Malware payload (GCleaner)", "value": "d99e5e9b2f6deaa8a4fe9d967f80d4611430b9dd65125c31fd3c3faba8865878ff53bfe32a14182f5ee4b64e58845e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239355, "uuid": "59e34fca-63b1-426c-ae83-ab6071ba708a", "value": "T1FAA5231BA5F5CD31E2636E745A51C1A36BB75C49283D821235DE3E4F3BBA2C2AD09343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239355, "uuid": "df0cc144-5e7e-4444-bf9d-bd33ec64c462", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239355, "uuid": "c0cd2c45-eb14-4fec-8c09-5984954e133a", "value": "49152:icPLnQtAQvvg2VPmNK+so2fseaYqCWno5qWUgDAXqs3JLCgv2MR:XPLnQCQ3FPmNts5UeaYqCXUgDAJ3lv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239355, "uuid": "a319f183-865d-4e9b-9027-f55cd891a2a4", "value": 2199630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239355, "uuid": "d38f2632-8b2d-463a-80f7-7e009e243c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239355, "uuid": "cf829b09-40be-4d6f-98c9-74706e817e75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94b9d36-a224-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675251493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251493, "uuid": "ea9c4d90-2f69-41d9-a709-358d3bebf05b", "comment": "Malware payload (AgentTesla)", "value": "1e058e452efea43d9bee0806f8b5e7a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251493, "uuid": "f7ad406b-1e9e-44b9-be7f-90145501efc7", "comment": "Malware payload (AgentTesla)", "value": "15e40e9d4bbdc21c3f7e3dcfc2c430dad22ce79ad0395960fc563523b4b9d978", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251493, "uuid": "ace4a861-4eb8-461b-b7ec-4537d94358b6", "comment": "Malware payload (AgentTesla)", "value": "5bdc3565eb43c4ce9a43d521b4d8a7b7997f30fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251493, "uuid": "f461ceb1-8395-4172-a743-36e6b142683b", "comment": "Malware payload (AgentTesla)", "value": "b1ed6d0cff316f64434163e8c352113568e70972461e887a69cf7271f56f747acfc958133d8c9876ee7a6141ad69b52a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251493, "uuid": "2d0c9cba-eb2a-4517-bf27-95e5fba055d1", "value": "T126F4331DFD8672EBE5DAB709C1DAF8FD62ED301904B009D848499B21EEB066076D8DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251493, "uuid": "ad185654-6bff-48cf-96f7-3bc48e090013", "value": "12288:ljwC8vjzTno1ic1yn/rRsV82cItlgDxQuF1hmeHrBsfvOGBfjpkuorEg8l2XSvmf:l0CqzE1icA/rRA8RItixDmCNQ3lkX8kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251493, "uuid": "c59b87df-e3c5-4fb7-81cd-a475e147caf0", "value": 769605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251493, "uuid": "8f9ca5d7-2b11-4abf-9a84-658970aef7a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251493, "uuid": "8a1b2cc4-bbde-4f3f-8105-4f2d26bb0905", "value": "STATEMENT OF ACCOUNT (SOA).PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf032ad-a24d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675269080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269080, "uuid": "394618a8-8d82-4dd0-9518-87adfa5a1d77", "comment": "Malware payload (GCleaner)", "value": "2e4e08bb7df118d52727f3b15530eb7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269080, "uuid": "5a47cb45-eb23-4941-b67a-be5261e4353a", "comment": "Malware payload (GCleaner)", "value": "15f64c8605e2dfda7a293c644720db32d37e19e085f3395e4a12f9f7c824d22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269080, "uuid": "148fb4da-835a-4c58-8e4f-d7bbcaf00546", "comment": "Malware payload (GCleaner)", "value": "e72c416cd094f8b8aa75c79d4628a77cea17b61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269080, "uuid": "8c460002-5f66-4d87-b7cf-7c3fc64536ba", "comment": "Malware payload (GCleaner)", "value": "6f3b497486b7c8f137b2edf950a7def5af626f99207320d352704415b6e69153005e6fce448fc002246c835cbd0a66da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269080, "uuid": "0f3a8a45-a428-43c7-ad42-f70485cbfb6f", "value": "T1A5A52335773DCD36D0C259F05C20D3776A28BF99246E621364E93E1F7A3E98A280C61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269080, "uuid": "df6a835f-e07d-49b7-8405-d86828e67ec5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269080, "uuid": "4d1be55c-8d13-489b-9066-929cd4886ef6", "value": "49152:icPLnQUdWfWczAO0KXpMJv7W0wJ2y1Cz+WvF46czILCgv2MR:XPLnQfRzAO07C1RW+CFCzAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675269080, "uuid": "88969cb5-1dd8-41ff-92fe-e26fda81cbe3", "value": 2213318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675269080, "uuid": "8b718d98-30d5-423d-90a1-5c1d1b4f8f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269080, "uuid": "99077d97-3b1b-43ca-b6ad-ce9c99023fa7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b366419-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675264193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264193, "uuid": "1d9bb803-ed85-44be-a6b8-76e4e949af31", "comment": "Malware payload (AgentTesla)", "value": "5e71c52ee5512b4fd7d1edcb54786176", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264193, "uuid": "d8510124-de7b-4cec-98fb-fa049849abc0", "comment": "Malware payload (AgentTesla)", "value": "161f0a7f4d86ad64c0788a98828ef55db21b0634415e917ea88d490c473aca63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264193, "uuid": "c4da570e-d6f5-4989-8450-be4225c7f244", "comment": "Malware payload (AgentTesla)", "value": "f605140652ab002e95600a1bb92d0b0b831152fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264193, "uuid": "8c81bded-0fe7-4d6e-ab27-9c99185a1e24", "comment": "Malware payload (AgentTesla)", "value": "e1d7509f27e6d44ae9594bd5c29aee7349cea67e6b4703d3cb7f45d3d184765b23597e64367ecdbdc4a597640edd9db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264193, "uuid": "b090df15-cb53-43a7-99d5-426c6ef5313a", "value": "T1D7F302C07BC519D6C95FA230484341100671BAEFFB83A26671DEB15F19B33C9A8BB297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264193, "uuid": "23161696-6994-45fc-bb10-1565d1f931ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264193, "uuid": "89eb21dc-1734-44eb-be02-c35a29122dbf", "value": "3072:N/FVAIsGbwarlwFLlUMeKO9XBJcoDhVND3x5mPuHUllCdgYdqnyI:ZDAIsmS7Bc9x2oPND3WllCdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264193, "uuid": "f586c2c5-c784-415e-a359-5a4df6188066", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264193, "uuid": "891c1a0a-8559-49a1-8e53-8d7d2e659048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264193, "uuid": "e8f7f0f8-34ae-4111-b88c-ae932c466938", "value": "e-dekont-20230201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c199a994-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282350, "uuid": "437d7b65-f50f-4647-832d-f92a0865fede", "comment": "Malware payload", "value": "d785e46b0d269b0578dcfd1b90375a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282350, "uuid": "ba0fd280-4c92-4b4f-a688-32d178d3b0a1", "comment": "Malware payload", "value": "164df1aecac769eb2d9485abcb776f9ee55fc1e297c5b8b2bc50009e786d41b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282350, "uuid": "695bd179-fe3c-46a4-9743-dc510cd014ec", "comment": "Malware payload", "value": "d1c4a196f24f0659c29fb05e99e690c87bf6d673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282350, "uuid": "bf504127-842d-4bb8-9913-53190cf2a6bc", "comment": "Malware payload", "value": "3e73bd3cca11c1ef0d7039c87b1223634a4dabd76bcdb5951dd4932f6e891f3236144f463c00f96815b668963c9648aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282350, "uuid": "378072b7-33b5-44cd-90f9-fd692c7727b9", "value": "T1EEC18401B3E81336EDF34B75ACB373801274B26269538F5D69D0625FAC163954A627F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282350, "uuid": "5c4f933e-e591-49d5-a61b-fa235ae5bce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282350, "uuid": "a5cc6c4a-59fc-4115-bba4-0be5e7c5bde9", "value": "96:673zsN+JBcMAiLt6NkIJmaI8RP4e/kvHxNezNt:oo+MOLtErRJcvb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282350, "uuid": "3d851345-85d5-40e7-a76e-3095557244e7", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282350, "uuid": "bce3c491-9588-488f-b5c1-b4ef3810fe84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282350, "uuid": "8e39fb07-ae45-4526-a617-98949dbd1b82", "value": "newsoftware-tester.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c31951-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675267241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267241, "uuid": "feb2bfc7-7f67-4659-84ce-bf7af3028eda", "comment": "Malware payload (CoinMiner)", "value": "693a7346d849b198bd25676c42a4f081", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267241, "uuid": "00508ac5-753f-4a36-a4f6-2dcbad7a8e08", "comment": "Malware payload (CoinMiner)", "value": "165c3d7d3dc86dca618fea2808bf7257f8c07b8262104171c63146d69cda6ab3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267241, "uuid": "4a977d98-7704-4a6f-92a6-f643ed9f4aad", "comment": "Malware payload (CoinMiner)", "value": "029655f2bdaa3fb8db8d0a7a60864e6690cc8752", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267241, "uuid": "653339b1-6061-40f2-96b1-52a526d2fd26", "comment": "Malware payload (CoinMiner)", "value": "640dd2358936641f09c388e08c4821db2933e5577e7294abda32499137fc24fab6655360d4d94ee0395aaac7d0ef0380", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267241, "uuid": "df7317dc-2166-4c97-86e2-c4789125b954", "value": "T1FAF5E037B3CDC824E4806D3CD6895AF157527C68FA9B1AE73BC0BE09B5395E42852BC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267241, "uuid": "ea370a49-1def-4818-9b3e-5082677f5474", "value": "c4b54e9f51c40d59a295c0bb153aa7e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267241, "uuid": "5faaf46b-cf5d-4698-9781-5ab58f4c2e8f", "value": "98304:iMPqay6hBCzSZKEAQ4EjUqXwEl1OQPBkR6YT1fx:iMPvy6h0SgzEjUqXwEPVPBkl5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267241, "uuid": "def07a44-ebc7-4db1-b901-26fbb9f83e5f", "value": 3573248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267241, "uuid": "c10ddc26-8224-49ef-85c8-b1764596cf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267241, "uuid": "84251a5a-4d6d-4ea4-bf1f-5bc32cf2a3f5", "value": "693a7346d849b198bd25676c42a4f081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e470651-a21e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675248736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248736, "uuid": "2d270ddd-33e0-4b6d-8e40-d0d42fd4a6e4", "comment": "Malware payload", "value": "10b4157098d1a77d4aa5c1ed04832bb0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248736, "uuid": "8562f5db-7a97-4a6d-97ee-7f6a84d5876c", "comment": "Malware payload", "value": "17a527d0775a1ed283fca5d23ffd01fe657309d3e28011c29faf6b6558435590", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248736, "uuid": "f0c96aeb-87aa-458b-9982-17f45ca2e3cd", "comment": "Malware payload", "value": "63171e027a9f53dba53b94c6ff03b6f168ef44e6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248736, "uuid": "d20f0c7c-65e4-4af6-9459-f2498ba44056", "comment": "Malware payload", "value": "542954d9fa3dbd05ccf13c78a4fcd1801d451c254b8bee83052a5037671cf093b3297bc3244efa20da9a300798787bf9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248736, "uuid": "d1b95eb3-8e4b-47c7-97c0-6e45bd6d288d", "value": "T14902C084CB430E09E5C3E3E79BD1D9AE8627A4E1F8429D25BE1353EE058119EB0FD904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248736, "uuid": "8d3f4753-a284-4610-8c31-25f3b9c25792", "value": "192:GgMwHKzT4j8UMkKf15qD1DrKmlWbLE70dEphap1IZT4:GgMwqnUptAc0dsa8ZT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248736, "uuid": "59ac7452-5ff6-423e-95d7-afb20d2a37c6", "value": 8808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248736, "uuid": "e3ec0646-2e2a-47ab-a282-bced92d08320", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248736, "uuid": "b9a8ef88-d545-44a1-b156-46fe3ccfab48", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c2b04c-a202-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675236638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236638, "uuid": "b5b61d8e-0faa-4940-8330-1025bd96e986", "comment": "Malware payload (RedLineStealer)", "value": "37606bdd942dee25aa86e7db81f99989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236638, "uuid": "c7a35dcb-18c5-46c2-852c-e260c6519514", "comment": "Malware payload (RedLineStealer)", "value": "18462c2005b53bab1b5417eb71b3b810eba511da0099785a04a020c34ec13deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236638, "uuid": "baf3bed6-3a7c-4de3-acf8-a72c7681b274", "comment": "Malware payload (RedLineStealer)", "value": "d8be1e5c8c047aca21827bcb7f8e39828a6d98c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236638, "uuid": "4544ebaf-c52a-4829-bd21-404a45bb517a", "comment": "Malware payload (RedLineStealer)", "value": "45c0191cad377e2512198ca5262e83c20f735a26ac4945751ba94423859d2455668048b30bcb9d34da3bc9d973a96c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236638, "uuid": "4176181a-5229-4902-836d-dc9ff4a5ab9a", "value": "T1237401327A90C172C7AB54704820EF99B7BEB0311B79962B7B54266D8F702F16739317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236638, "uuid": "7b51e134-f516-49df-8145-6b56f753a174", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236638, "uuid": "229aeb52-be65-4d52-b319-c566a0b55cc8", "value": "6144:hSfOfDGL4tzfbktgmgH0VqICw4Ft4jPgrHu9zb:hS2LGEtz4tgmgH0VqICw4FarJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236638, "uuid": "f73f6c32-e5f7-4a7e-95cc-6a5675c1681f", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236638, "uuid": "83c997b6-2f74-4ee0-9d82-2a723b42e241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236638, "uuid": "a7a9cb09-18a5-4dbd-8436-def539ccc042", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f5c5e9-a277-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675287112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287112, "uuid": "5eb5660e-51ce-4bcc-ae9b-da04117735da", "comment": "Malware payload", "value": "4dccb64c91a68bedd0f77ef3382ba496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287112, "uuid": "86609481-1ec8-4c39-aef2-eeaa35efe5d4", "comment": "Malware payload", "value": "188075755aa397ac88493711ed6c13ef706a2b2f9d748bbda82321f2c4870188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287112, "uuid": "3a12dda1-6850-46d8-93b9-58558bd595f5", "comment": "Malware payload", "value": "f4553943e232c3c6c8912e8d348410c3e8eebd44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287112, "uuid": "6b8c8e3b-cc1b-4c8b-8278-234b0d369ad7", "comment": "Malware payload", "value": "9bcc84c13f9e29c029f2eb150f1a61694ad9ff9e0fd6de062706c5b219701989b62b72479f6482ebcee2155724eb6a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287112, "uuid": "cacd620a-88d4-472c-8c61-a8ed3ab7742d", "value": "T16DA5333A2D798936C361AAB45913C2225B775EC5246C931378FE3D2E3A75EC2BC08347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287112, "uuid": "83d33d32-94b3-446b-9176-26d7b920bd4d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287112, "uuid": "79adbb1a-75e5-4474-b0cc-854c9b46bbb4", "value": "49152:icPLnQo60UbWq8r81AvZmzHDRyxvTD9dgzWCNLCgv2MR:XPLnQo60UL8rTZeDRqvHu7v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675287112, "uuid": "09b4771b-07c5-44b3-8706-ff9ff43e1028", "value": 2187958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675287112, "uuid": "34ef37dd-0d96-40a8-9d16-f73959f0bf70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287112, "uuid": "55c7fa3f-7224-412d-b730-9057c3c0f780", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809939d7-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262484, "uuid": "26f8d289-3704-4194-90ee-b8502fd178bf", "comment": "Malware payload", "value": "c35f06c736e46c45ca173a13ca16a7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262484, "uuid": "dee5964b-093e-49a2-be9f-70c21f30d071", "comment": "Malware payload", "value": "19de4117a61dad5c37ddfc0e0e59b123a81a0180c68cc946c9f95ad9d72a04e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262484, "uuid": "20e0f5fa-ed45-4554-bced-8fc394f53f8b", "comment": "Malware payload", "value": "d087dc4bd85ba4d24549acb59c7798ab3ad6ff50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262484, "uuid": "92e53999-ad53-4558-8ebd-8d3796ae778e", "comment": "Malware payload", "value": "9b65a7759a750df428fbb4a84c8a7892dd5b1f506560fd0181ab5186e563c0ff2d3d8f56654c626974b2baec6f9a23b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262484, "uuid": "5ee41cd5-c78d-4f77-8454-a567d82eb48e", "value": "T110256AACCDFAA24634782CE445B536D68CAB272B5C5D9D282514421C3E40EF8FDBE71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262484, "uuid": "d581963d-609e-4429-af15-30eb9a001b60", "value": "12288:C7oL/6cAYnS2S4Bqe69SMXPmHYsp7eEBo5EnmsH+9MHCAZDRhs9jQRVC2QAPJSLG:C7y5A+x69SLYOjnmsH+9Mi64SR85LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262484, "uuid": "4cb213f7-3e99-489b-8149-b7637a6b617c", "value": 1034519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262484, "uuid": "b43572c8-75ae-4fc8-aee4-9dd589d234af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262484, "uuid": "2efe1f40-3905-40f1-b269-7ca316bb152e", "value": "c35f06c736e46c45ca173a13ca16a7d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c78ad1-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263750, "uuid": "b3173819-02da-4354-926f-7858f562dae7", "comment": "Malware payload", "value": "a9082a2d2366c1bbb911679b4292869d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263750, "uuid": "cfb8f470-5882-4d4a-9690-383230af3a41", "comment": "Malware payload", "value": "19ec7e7f9181a67f3571435811163ba3442e1eff65455cdd559ee4c8e757a419", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263750, "uuid": "1ec122cb-6866-484f-a15f-04ac197c23e2", "comment": "Malware payload", "value": "ab1087694cf5cda56a509fab931b5e9f3ca63e79", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263750, "uuid": "f5a388bd-93e4-4bbc-88db-bd4109d82255", "comment": "Malware payload", "value": "0a65549403f946554cc6718883548e84825bcc6fd9c049e02812791881a818c5e993a8807cf6f9570908c0b15a6babf9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263750, "uuid": "d108f53c-8e06-4fc5-bcf3-577247cc4e48", "value": "T14E53082EE34F0965DF55A7BB034A4E4905FCB33EB28540B179AC973437AD82E466287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263750, "uuid": "79e8ab77-e4ed-4c20-b35d-250bea901763", "value": "1536:7s168kbTJOyJ+jHLmp8LqJHyZFAksR6viCo6tEwe01F8up5x+AYrw6E0:g168kbTJOyJ+jHLmp8iHcDsUiCo6tEwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263750, "uuid": "6bf7b691-419d-4df1-b3ea-d7cb6d2357cb", "value": 63988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263750, "uuid": "080b21fb-8dcd-4002-92b2-102e07c1b238", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263750, "uuid": "21b9783d-5e0c-40c2-af00-680031ed5c00", "value": "Quote to supply iss-shipping.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defe1d22-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675262213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262213, "uuid": "89a2d4ab-224a-44bd-8b3e-bc011339713f", "comment": "Malware payload (RedLineStealer)", "value": "56bdc64b3eee515f104a791aa20a21d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262213, "uuid": "02dd789a-6d26-4413-8032-a88e8ff11a7c", "comment": "Malware payload (RedLineStealer)", "value": "19f2539486d7b7a3c3c5f2e81851ef4220cdb5adb95778d1b7464fdd2b9f506a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262213, "uuid": "2b15a2ef-2b1c-4a05-9935-459acc23de4c", "comment": "Malware payload (RedLineStealer)", "value": "73a51bd896d4fed399e7d7b61c6451a63b859a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262213, "uuid": "6d98ff53-0f7a-48fc-8803-51e3e8f599c3", "comment": "Malware payload (RedLineStealer)", "value": "db06b8026110fb8ae7df08b7dbd22bc3abf808c4ea7192472ae7c801e7cc8f1f06902a803826a53379253d4947fb893a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262213, "uuid": "892e77e4-6a21-4bda-8fc4-22a456bdb79f", "value": "T17D7402313D9CD073C96625746520DAA4ABBDB030757A598B77AC0AADDF703D0A63A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262213, "uuid": "a50f5ebd-2e4e-406a-9869-87d82bd84790", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262213, "uuid": "b5e28e6c-f21f-44de-906a-6e8317713735", "value": "6144:TW8VP8GLrfpAJn2GxgoL0LCNfP4GapzzSqpdGzZn3IkH:TW60GnfpAJ2og+noGUzSqzGFn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262213, "uuid": "ae91aab8-ec1b-4d99-aa78-3fa049ddef20", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262213, "uuid": "07974e62-cbd9-470d-ac6e-e2896dae5214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262213, "uuid": "b71845fb-2a74-4588-9bb4-f4962fa86824", "value": "56bdc64b3eee515f104a791aa20a21d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc783f00-a266-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675279791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279791, "uuid": "9ca052f5-4790-43dc-a774-e3384bcff885", "comment": "Malware payload (RedLineStealer)", "value": "591dd75a6049a3ae71de34494e48cd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279791, "uuid": "bc61e0d6-e888-4a65-978a-d26d2795b8cd", "comment": "Malware payload (RedLineStealer)", "value": "1a9a354ac3db19bd7612c5f9edf667f5586c7cae211ec5a1ac75c30641a30578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279791, "uuid": "1cf4ec3b-396a-4861-95f4-7c4d75a5d74e", "comment": "Malware payload (RedLineStealer)", "value": "acde50f20902dc065a2100db29c31fb9c6dacb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279791, "uuid": "1b393c3c-cc4e-48dc-8b57-abbf46b0a897", "comment": "Malware payload (RedLineStealer)", "value": "eb777c15f3a4212d67747183d422a39f30da53cce41584057219e25c5155ac9ed8e01dfb8065ea92b17ad5312847196b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279791, "uuid": "a86fd931-506f-41ac-bc00-49fff6f4b186", "value": "T1CA74F13379D0C872C5A619305D30EA91EBBEA5312C358553BF983BAE9F601D1633A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279791, "uuid": "52a6c55e-e65e-4983-99e4-85b0bfe0c1ab", "value": "69de700c621e1f34213ac69f2c7b5cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279791, "uuid": "9ea8b8e8-0b96-44b2-a526-cd3a6524bc3a", "value": "6144:IbwoOoLfaeT7UvLLW3IoLccO+o6sxiEGDd22t2gc1XnBrJRLQn:IbvPDaeT7US3PFOD/xiFd2ZRnBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279791, "uuid": "29b5ea4b-653d-4275-a993-d4b695a5c816", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279791, "uuid": "da369e80-86c0-4c49-80f7-366872079207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279791, "uuid": "989b9320-2e24-4e12-833e-20bf46901149", "value": "SecuriteInfo.com.Win32.TrojanX-gen.5906.5645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b264137f-a23b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675261279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261279, "uuid": "e83878db-19e0-47bc-bc45-32772865f340", "comment": "Malware payload (AuroraStealer)", "value": "8be316ace6f4c4d501fc27cbe2558871", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261279, "uuid": "a5d05ca9-0608-412c-a7ea-eef9f414bde4", "comment": "Malware payload (AuroraStealer)", "value": "1aa500d0e87c1ecb35553db91c8b96029ff89feb1a4c0fb06b6c0238700d83b6", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261279, "uuid": "8574b2eb-7507-4ea2-bc67-7695438f1442", "comment": "Malware payload (AuroraStealer)", "value": "c4a2cd32b90a4d3fca1328cc10dc0d9996d9dded", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261279, "uuid": "39031df6-cf19-4c73-a36d-0e9cbabcbe0c", "comment": "Malware payload (AuroraStealer)", "value": "655616392bd5b0573656b05d28e8fef2df1e143b5e3cde3e153cd1107ada86cb711eece0fca497c97476650f96b7d6c2", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261279, "uuid": "88abda6f-d900-4916-9f9f-aeb63e08c741", "value": "T14E07008C329036EFC867C532DAA92C65FB50F4B7832B8307951B01BA9E5D997DF540E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261279, "uuid": "53ebc959-881c-4211-98ed-8e5a934ea58c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261279, "uuid": "7d3affd1-5bce-4931-8302-69fcd3db1e24", "value": "49152:mwXXV7ULoZ67ys/Twlsqjw1fbVrhVugEpwPxGkYyLw7y1wV+nFy7rNIznFCyT5jU:moFU1f1SgnGXd7y1wVmFdT5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261279, "uuid": "dad9cb84-0bed-4974-b762-8c383ade755f", "value": 18374656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261279, "uuid": "90e674d9-3cd2-43f3-9ecc-9d23e39ddd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261279, "uuid": "09453850-a8da-4364-aa6a-35e8c2b31f5c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d422d5c6-a23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675260906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260906, "uuid": "5c737892-c664-455c-b055-a6502ca7cc28", "comment": "Malware payload (Quakbot)", "value": "e64839d5ad542e22f9562ea492080e3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260906, "uuid": "c4b6dc51-a3e2-4b91-b986-9f6e79223b67", "comment": "Malware payload (Quakbot)", "value": "1b1a6b891687bea71774e3f1776b73fee79602f960eb9cae891ad2c5acb277cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260906, "uuid": "cd2e5ca7-f3d6-4415-a6f4-da80291c0095", "comment": "Malware payload (Quakbot)", "value": "0ebcef14cd6dd4b91ece3af089b46eb0d8b2944c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260906, "uuid": "b01042e9-d03b-4b64-9291-26d24542f7fa", "comment": "Malware payload (Quakbot)", "value": "b0b781052bc16cbd2e58630b90508b5da7f1fe41b614c39663e0f61400a0eb4ea6ea844efde537dc61dd483c6b78fc33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260906, "uuid": "d9f63186-d812-4208-94c5-5daa6e0441d7", "value": "T1C8D48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2C29DD139D1B64970A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260906, "uuid": "4ced3efc-a70b-46e2-ae41-2d70717e0366", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260906, "uuid": "8c3aa831-4dbe-4269-baca-a61849b442ec", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTe3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1tyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260906, "uuid": "a1795eeb-ccbf-47ba-99e9-2f11c6f4caa4", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260906, "uuid": "a00266fa-c51c-436f-9272-a63b542d9e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260906, "uuid": "bc6c47f7-e1ba-4d45-90c4-27f28e514b2b", "value": "17129.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce0efc2-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nymaim)", "timestamp": 1675211744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211744, "uuid": "758c9a2b-46bf-4fc6-867d-4e4fc4aee125", "comment": "Malware payload (Nymaim)", "value": "7c496269f47a7f70eda00796259c6748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211744, "uuid": "59103a33-403a-444c-91cc-7457a9c9ae5a", "comment": "Malware payload (Nymaim)", "value": "1b290acc235ab72f506078ee6c0e0ca7f0141d4375b7568624d0b73c29a8632b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211744, "uuid": "398256c7-a537-40ea-8ba3-fb331f846a7f", "comment": "Malware payload (Nymaim)", "value": "24c27a6d932c5b4c43508d7fb916ce429fadd2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211744, "uuid": "9da1a2ab-9f5a-4c64-9b2f-1f4d7dee3da9", "comment": "Malware payload (Nymaim)", "value": "0412173fdf7f741c6aa1087ec2da2826dbb9a8ad45783c769b80ee7fe61c54400e96af339306b1ba696d7012e2f87277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211744, "uuid": "ca0d2c5d-b94e-4937-9e3c-80a24aed4217", "value": "T14EE41217A8879B81CA6C9B33D86E1FEE3EDB443401B4F832539064B6B2F55F14D3A256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211744, "uuid": "c4275f5d-c47a-4968-90d0-5c6d18f4ca91", "value": "6454e523b41ce4606c4d59e3eb617c48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211744, "uuid": "77c3e2b1-1690-4709-9aab-c5139a6fdf7a", "value": "12288:/Dgts0ZgBzvgbkj1Nrl0BJggq0nCZm8FH7plvhE892yX6mIZ9:sts6gBN1l2BJg+KmQ7nvhmu6mIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211744, "uuid": "b72f3c42-2222-49a7-ba3d-3d8c5c9e471f", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211744, "uuid": "f29ea2a5-67ce-409b-a3c5-fd563218156d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211744, "uuid": "41c348e1-fb11-4f2b-80a7-f96295a0d965", "value": "SecuriteInfo.com.Trojan.Agent.DSBN.2549.4743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e553ba23-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675261794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261794, "uuid": "e70f94ce-fdc4-454b-8916-43a6a2aad376", "comment": "Malware payload (PureCrypter)", "value": "5828f5213c4721e4118b3e57388ff2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261794, "uuid": "c4420f34-5ebd-4638-88a2-b4fb3d4cb336", "comment": "Malware payload (PureCrypter)", "value": "1c1198c6de9cf636d4dc103add73a59ba3101ae38954f20f0ec6ed9b8c563dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261794, "uuid": "18beb2ac-b92d-4e92-91d6-bfa76c3f2560", "comment": "Malware payload (PureCrypter)", "value": "6737cd48c485ed00f64d56f2996cb0a4b3e16db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261794, "uuid": "47666e02-3b1e-4aef-8b5a-edb24b528c91", "comment": "Malware payload (PureCrypter)", "value": "e9c415634a9d03b20349a6b5f422d50d525ee22885ab61dc7f67162b90eff59f61fd04ad7ee55811120115570bdad028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261794, "uuid": "178c0569-f782-42df-a3a7-bec93d25ed85", "value": "T19FE1D711D39C8377D9F64BB6DCB26392863CE7239D539B9D1880C60EAC56B988660F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261794, "uuid": "4cbda03b-01a9-4949-8ffb-1edded08fa86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261794, "uuid": "4e2c827f-be71-4272-a78a-610e35abbccb", "value": "96:wUUIQg0soU3QSQKCJdsYB3TtmXdtEkdpBxNbFnU:wUUIPDQdsYF0tzbHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261794, "uuid": "9ac917a5-55b2-4f4e-8963-23c84fd179e1", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261794, "uuid": "6cc0096b-636d-4107-a250-cb1533376051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261794, "uuid": "308772b7-4d73-479a-8739-f32f4facaa9d", "value": "Acwpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79f1b64-a27b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675288830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288830, "uuid": "1c5b139e-0426-4cba-8128-c6006948b33b", "comment": "Malware payload", "value": "fff89c3564a9c5d9420badc557034e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288830, "uuid": "187794aa-a590-4e0e-8f3f-a2ba105d6b2e", "comment": "Malware payload", "value": "1cfcbc0c699c863f7d2305a4c61b047372a0a4792c70f0f4d9a7dea5f07f1554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288830, "uuid": "4abeffc6-5a50-42ef-8a97-864b6b9e4928", "comment": "Malware payload", "value": "8c3e3f84b4f5d286bcf3ad737363625e0dc962aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288830, "uuid": "d0f47412-8057-4c23-9235-1a9c9e99109e", "comment": "Malware payload", "value": "59f75a912d00bf3a06b00b651ff69ae5b5982f95c974f252fe5c6e2e58aafc459cd9c537b932eb1446f430005a705957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288830, "uuid": "77cef349-21d3-47c1-aab3-aa38c262ef75", "value": "T1F474013175E0C073C9A944714824E5A5BEBEA03209B9969B7B5416EDDFF03E07B2A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288830, "uuid": "5b54ecdf-7411-4733-a9f0-40bb317f7d4e", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288830, "uuid": "ca513e28-0766-4572-a340-1cc4c14687bf", "value": "6144:p3Dew5L6sT6NNOTGndDXgZyZLetF+ksdkb3big:p3DeA5T6N4G1QZyZLerhsq3bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675288830, "uuid": "55585335-ee9e-46d7-850d-f4fb4f7d4fd5", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675288830, "uuid": "ca82d9b3-c309-4b35-99e2-c348059a0f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288830, "uuid": "e31d4df4-2e1d-4003-a5bf-c14c623b681b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c24f4d-a239-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675260127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260127, "uuid": "af36ef06-d130-4ea5-8a0f-e14e8928c087", "comment": "Malware payload (SnakeKeylogger)", "value": "e4f7bd4b831c7ee627e4b703e80215a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260127, "uuid": "5055bba3-c870-4a51-94ef-cea6a73c1a35", "comment": "Malware payload (SnakeKeylogger)", "value": "1da8a820643459015205f97eb9b7abcdb173ce87bbdb74da0b79e970bbc32fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260127, "uuid": "addfaf3d-aa59-4665-b186-07fc1ad744b9", "comment": "Malware payload (SnakeKeylogger)", "value": "1d4dde893cffac035e1827a4b94bd797c37c7220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260127, "uuid": "e1c1da17-8534-44c7-8b17-588dc4db235c", "comment": "Malware payload (SnakeKeylogger)", "value": "edc4bc41093bc98d990ff5b6a3ffceb4b64c0c26eef1226195b85d75e9227e4415d4d463c92494d8cc0f70048b83b8c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260127, "uuid": "63a40b00-6e75-484e-bcd4-ab077a5a9c82", "value": "T12444124972D4D477E2B30A306F338766A7EEA6070965421B33A09B3D3C31691F62F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260127, "uuid": "1715a901-7424-4aa8-8be0-e5e30e9aab5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260127, "uuid": "38d10ac1-885c-4df9-88b6-baa5cdab6fa8", "value": "6144:vYa6zT7aXn2amReGdkNwUGyY2FPtRu7gSJ9SxSO0Ry91CCs:vYZAn2/dkNwUGeP3HUWAWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260127, "uuid": "33c2cb43-867a-4294-8912-8ab14d2f3b78", "value": 271612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260127, "uuid": "df6befed-e316-40d8-b8d2-d185f1a7099b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260127, "uuid": "b682c0a7-a8a7-487b-a961-97152aa200d2", "value": "RFQ 800070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3862dba-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261791, "uuid": "81b68966-e96c-4c5d-b307-d2a5f9eb5c7c", "comment": "Malware payload (SnakeKeylogger)", "value": "5ee61a8a8dcd52fd26125e478bdbdd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261791, "uuid": "30b3f4be-5ad1-411e-80c9-4ae31d8d3225", "comment": "Malware payload (SnakeKeylogger)", "value": "1e743ec80b16cb881f0917b18dbe1bcf11b60f132a20586e5b75c039708cec53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261791, "uuid": "cbe7b1be-8fdf-4c8b-9058-4c439c75f6bd", "comment": "Malware payload (SnakeKeylogger)", "value": "8e4a48118f16df5f534d02e4f3481efda4aa9719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261791, "uuid": "a4c77a8e-12de-4713-869d-69b7989a0569", "comment": "Malware payload (SnakeKeylogger)", "value": "9b0ec9202dbd209bd4aa983c25410bb9795f8ac895a0d7585570a89cdd478d3b03c10179f05d7d1a75320faec061e5d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261791, "uuid": "f403a563-1ba7-4294-9d42-7579ed45a6ab", "value": "T1D9F4CF9C7210F9EFC913CE7789642C24EA2064BBA30BD703A45716ADC94E696DF152F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261791, "uuid": "d8f76295-8cb6-4af9-a493-6a472f4b081e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261791, "uuid": "62c4af9d-8caf-4660-85f5-058847e945f1", "value": "12288:wz3ZO1eVnWeh3ih9HhtHr9uGKqg9c8H+6B/j1tLbrJCHoh6OAT6jJAL6WDvosrmi:QVBYThtHggg90a/j1VJbV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261791, "uuid": "b91bb6ec-2f72-4093-8485-647094d920d4", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261791, "uuid": "792e3208-c100-4b3a-8c1d-234889998e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261791, "uuid": "55d242fa-0b90-4731-b679-b857592ea39c", "value": "5ee61a8a8dcd52fd26125e478bdbdd2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb72aba-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675264248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264248, "uuid": "c7ee7f43-03df-4565-bcc2-4c89ec641c74", "comment": "Malware payload (QuasarRAT)", "value": "fd5dc5461bebab38ad35bad2bbfb41d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264248, "uuid": "adf742ef-ad7e-410b-9ae9-a1020b3dfe05", "comment": "Malware payload (QuasarRAT)", "value": "1e9bc828337c181856fcfcc0ce23bfe3d1d226a4b1b16b3766accdea93b9065f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264248, "uuid": "4dfeb079-0877-4bc5-b4b5-6732815ad607", "comment": "Malware payload (QuasarRAT)", "value": "a9f322933edd6d3c2caacf461e572cf7e17e5f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264248, "uuid": "d75ac2b0-7e40-4dfc-80aa-de1706814ce3", "comment": "Malware payload (QuasarRAT)", "value": "b214ee1f7f94f40db49091bdd3ab8c3f97f1366f8a94fbca9bb1a464b9a2056313b29cc9cc0011ef3ca05b1afa55e71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264248, "uuid": "73a272dd-ce8c-46a3-9d08-8c863821b867", "value": "T11C85F011A6CFC0B3D16E3D39812AE610252B6DFC3E147209639F7994FEFC44C9D2A669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264248, "uuid": "8d6b7423-acbb-417f-88ef-45da15ad5679", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264248, "uuid": "ed65c6c8-eec8-4559-a96d-3908d3bbea4b", "value": "24576:TNA3R5drXDBDQfyDv/+NEE8VbWPMaCkN78JZRV1O4jqHdSdfFjTxjgSqiEZBm+x:+590knxVbWUaCw8JZ31zcYdfBTxVEZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264248, "uuid": "eef5ce4c-bff5-4a4c-a7f9-2b3647326b3e", "value": 1752268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264248, "uuid": "faf995f8-9257-46ce-a78c-39071d996cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264248, "uuid": "80070aec-4181-4751-8969-49d140d9fb08", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80faf4ef-a21e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675248741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248741, "uuid": "0b4155bc-7f23-4a70-8e4b-f9100aa69beb", "comment": "Malware payload", "value": "dc7f46e2ae5f604cc6ac4a6dfe596423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248741, "uuid": "7069ec45-8c3e-4649-831f-fe3f03b0ec06", "comment": "Malware payload", "value": "1ea7b6f180cc035a9bba3b7e637ecaad82fca366151046e3c5f8f3aa041c64c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248741, "uuid": "c18de85d-dc4c-428b-9697-1867419def45", "comment": "Malware payload", "value": "07c7001e83d849510c1ca2c39ce67e3ae14a4a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248741, "uuid": "85be13ed-c0e3-4a71-9b95-1831d3caf722", "comment": "Malware payload", "value": "7c1087d53e87d8978a56ff4c356d4877014922dcfbc8ac7e6809e3579d56b364d2b17c087a7e7223bcd78712bc866c8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248741, "uuid": "72bb7db9-5bc4-4747-b762-bf62f847b384", "value": "T1F682F9A842DCD323FF6D1BBD94B162C34BB2B6736801FA5C788CB09929C634581A571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248741, "uuid": "7c4d054c-7ce9-417c-8220-b9e718fbc0f9", "value": "384:n2WZbVxZ4gddXpjXq1qaS3lZHok0NGHISSNdRrTQL3:2UowdNXPcpGYcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248741, "uuid": "1829314d-3ee2-435a-91bd-1cceb81172ec", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248741, "uuid": "3e4e5f3c-6b4d-436c-9c4e-125af53da564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248741, "uuid": "510edfd2-0d60-4877-9d54-2ce4ba7bbec7", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809ee356-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293408, "uuid": "12ef28e2-740c-4455-a52d-aedc35824ac1", "comment": "Malware payload", "value": "496009acf18b3a25530a29b54fdbfac9", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293408, "uuid": "b7c049e4-6d5f-400e-a76f-6ca0d7e8da10", "comment": "Malware payload", "value": "1ef9f9c74b5c0ca4ddd6427a5f6667dfbb5fa023e3d4bf897abd8f2a10b1febd", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293408, "uuid": "50046324-aa47-42c2-addc-b1df71c519e6", "comment": "Malware payload", "value": "0a0c774887529fd6c90eef179cf82dc94beaaaa2", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293408, "uuid": "7be54b7c-88bf-4561-aebf-8cd8ebc538dc", "comment": "Malware payload", "value": "5acd40dcdb1bc3bbae7c00b5d5e7eb669cfeb6702405efe3fd7b1e82d5faa9aa26af74be8783f2766e99dda4300c8052", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293408, "uuid": "0faf9fcb-1776-4a3b-a981-4de700d01659", "value": "T1E362CF0D28902408E568CB79F76A22B9FF6CB2D3EDFC00E4513EF21B1A55C177E565A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293408, "uuid": "251250c8-17ae-4cfb-867f-3534d24c70f5", "value": "384:eP5uqkYp71s11RD4PVt7xLnMbFoztJOdYntqCWLjbdmV996kYm:YgVMPRLMRopEdktqVf5mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293408, "uuid": "5ce67f59-491f-4beb-819f-33e7b287d646", "value": 15941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293408, "uuid": "33fa630c-891a-4855-9bcb-ecdb3ac585bd", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293408, "uuid": "5aa14992-2c99-44c7-9989-a4eb7334f15b", "value": "1ef9f9c74b5c0ca4ddd6427a5f6667dfbb5fa023e3d4bf897abd8f2a10b1febd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846f5ea1-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293414, "uuid": "0a5a29ea-05d3-45d1-9030-e4b93fcac50a", "comment": "Malware payload", "value": "00a67ce778a1cded9bd9c36dc15f65dd", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293414, "uuid": "610554c3-f698-4c77-9e3e-87eaaaaf8bbe", "comment": "Malware payload", "value": "200d8cce504f67b0210f60733e51f097d9832396eb7d2dca05dc02ebd1610a17", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293414, "uuid": "218030f9-c066-44a0-be03-9f067aeb4540", "comment": "Malware payload", "value": "3260d741b8aa8d71d0262e202063534fc7e56f30", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293414, "uuid": "eb58262e-d7b3-4c62-a5e0-7499d1346202", "comment": "Malware payload", "value": "af3bf09bb6eb89d03d3d7fd098214beda4f9e44de1cd68c327a4ab05d578dbde1535c85e477784122f40c057c5058197", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293414, "uuid": "8b942295-e920-4ef7-b69e-750ce1366264", "value": "T16624F1F174D609C8C68C827868C47855B4C6B2F7EDE60C27FFCD68A2CF14CA6699D981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293414, "uuid": "36abd0b5-da97-42bf-87d4-6c77786e113e", "value": "6144:kOukHORTamwuBnKTZqnsxe8vvdJ1t79n+MDGhHRcvN:2kHROnmPv/1xJFqxcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293414, "uuid": "58ed3465-bfa5-484e-b4b2-15fd5569b9c4", "value": 227501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293414, "uuid": "e2e1211e-367d-4876-a157-41c62c824bd1", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293414, "uuid": "333fa1bb-6f31-448a-9caf-ce5227d0c257", "value": "323U8219-3 LWG Rev B.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c370da2-a1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675226721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226721, "uuid": "28e8567d-e219-41b2-b9c8-ac2cc146db98", "comment": "Malware payload (GCleaner)", "value": "fac54eb02395ee05d262b507340ae169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226721, "uuid": "2d5bf143-834d-4191-9ac0-67dae39494b8", "comment": "Malware payload (GCleaner)", "value": "2025bd319016341b94e4e211395bafc00b8cfa8a214ce2f701330fee6507c3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226721, "uuid": "1debebb2-7c5c-420b-91df-16f23a8b8117", "comment": "Malware payload (GCleaner)", "value": "1b2f6895589d5feb8a6c3b67c7f600d3160c906d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226721, "uuid": "a555d587-869a-4033-8e5d-6e8c7bcdb714", "comment": "Malware payload (GCleaner)", "value": "b205ede616fe78e38e4d17fc302d2692e52b6050cabaaeb098c7963da90cbb94a0f6175d3fa3455cf6368be4ef5e1a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226721, "uuid": "e2f5347b-fc19-4a81-8ca9-e5b33c9877ab", "value": "T12BA533615724CC32E1E0D139BE15C011ABFAAF46363DD2023AE53E0F367A5D3AD0D65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226721, "uuid": "862e0ab0-86ca-4781-b9a7-26d23465905d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226721, "uuid": "fbe02ae4-7c08-4501-87fd-d53624d40f1e", "value": "49152:icPLnQjT5JCzYM/CG4PoGChwptHVmtoGH+t5Va/Lj0cAiG+edLCgv2MR:XPLnQZJsjGChwvVmPk5KP0cgPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675226721, "uuid": "58239b11-e9b1-4423-a625-efea2010e735", "value": 2228643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675226721, "uuid": "d4e926b7-5519-4caf-9891-141caf03aa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226721, "uuid": "3897423f-ed49-4cd3-bd0f-9b7626e723df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6187fe-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675266937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266937, "uuid": "2814a0ee-7dab-4fa2-bc33-d5f42cec98c3", "comment": "Malware payload (RedLineStealer)", "value": "f249bababc15d8bb8a09ea7c13774eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266937, "uuid": "10799863-9dea-440e-9699-2aa123c523a8", "comment": "Malware payload (RedLineStealer)", "value": "2025c9a02ac18e0c591c9594f3d64632623833d9abef45bcdde4c93be65cc5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266937, "uuid": "065beeab-e3e1-418b-926d-21e12cdb7ce6", "comment": "Malware payload (RedLineStealer)", "value": "38b94e0fb9587246d0944a5161f6ecd129914a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266937, "uuid": "9272284f-57e4-4d1b-b6fb-504a156902df", "comment": "Malware payload (RedLineStealer)", "value": "1b257e85f2ae6f2c1e234535233480815a67fe2e11ba0795d1b9fb99db9c391c6ccd4abc12b2c16fb2d93027180aeea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266937, "uuid": "cf9be4c2-2c28-43d1-a474-635d66c6ec7d", "value": "T179A52312F9D2D8F3E5211D325A19AB52B47CBF200B249A5BBBC82F1ED5780D1F234667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266937, "uuid": "15657826-83c3-43a5-8f76-7b98474a92ff", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266937, "uuid": "2d24eccb-7f75-4e5a-bbd4-8e56d6c51ed4", "value": "49152:V5ODGBmTwWRAUwWRmI6aVqu7GFKzy+OqY3xsuKhAH33CG5:V5i84XAPWr5z3AqYBehAnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266937, "uuid": "302c3cee-5536-4910-93d7-c2112180384a", "value": 2257479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266937, "uuid": "697c1328-7bc4-44ad-96bd-17f15a95de88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266937, "uuid": "fd047ab1-6238-48e8-91d6-7c653a3c1610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5b94fa-a1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (OskiStealer)", "timestamp": 1675231605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231605, "uuid": "d0b400ca-993e-4650-87e3-0b71e0a696fc", "comment": "Malware payload (OskiStealer)", "value": "ddee3051b544961caf086b496a1335eb", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231605, "uuid": "04909e4f-c48a-43eb-a45e-741de0009b0a", "comment": "Malware payload (OskiStealer)", "value": "2082e713282ab51284141b3dbd96f27bd7c27dec371c800f678916a1719bbb83", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231605, "uuid": "5b37dee1-6c59-4fb3-a0e8-8607b9e42919", "comment": "Malware payload (OskiStealer)", "value": "94a0b05c3599648dfc7f4a0f89ce7fa0f923fd26", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231605, "uuid": "1c822e92-8f56-40cc-8fed-8cb85b346f1f", "comment": "Malware payload (OskiStealer)", "value": "63ba3a7152a96525bab0575b83d1d81c19ec1abd88316cad0bb2e790daab9d858256028859e2c539a5c9b010d3d72850", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231605, "uuid": "f4464d46-2489-4a0e-a29d-3ac365e74e49", "value": "T150146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231605, "uuid": "4ed43bac-46d8-4d0c-bf86-7dd1ab7fb0e6", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231605, "uuid": "955b5b13-f121-49eb-80f8-c3e3b8d208cc", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIM1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNl1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231605, "uuid": "652f66e9-0c33-452d-aa61-4e4414d1bf5b", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231605, "uuid": "1aaf2d74-1624-4949-af5b-be237be67174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231605, "uuid": "85bda962-aee6-44e1-a3d1-d9edbcc8d7f8", "value": "2023-02-01_ddee3051b544961caf086b496a1335eb_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd30d100-a266-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675279793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279793, "uuid": "6729f6c6-57d4-4d4d-986f-79e4ec0e58fb", "comment": "Malware payload (RedLineStealer)", "value": "e0b75df6a7bb685a583f660b432412b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279793, "uuid": "191958d3-ff0a-48bd-af71-f6a43b15cd86", "comment": "Malware payload (RedLineStealer)", "value": "2092daee7f4e0137f6295f3a4c8c4e159a5b5ab2da70d51c89ffe83a41d2a6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279793, "uuid": "3a91ad0b-6f28-4984-af24-e6377a1fd456", "comment": "Malware payload (RedLineStealer)", "value": "724c076622a94c9b836981570dfe9fc9cd58557e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279793, "uuid": "308eaf77-cd56-4841-b600-63be9692b7a8", "comment": "Malware payload (RedLineStealer)", "value": "5348a9fcc815fd80f41a11e811362eeea48d29620e7050541286e931d84b35fe320fe61926bbd2534bd838cc632daf5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279793, "uuid": "6d97d925-96c4-432d-bed3-6f07d77cf352", "value": "T16674F132B6D0D073C46B45341D20F6527BEEA532187999177BA50B6EEF306E2623B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279793, "uuid": "7bdf82c4-cab3-4ca5-819f-3d2354f61999", "value": "69de700c621e1f34213ac69f2c7b5cd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279793, "uuid": "6377620d-4e2c-4f96-9caa-0c35bfd8f5f5", "value": "6144:9bgQsy6LA1PHGHweck3o8WcEQd+a6tMcmNx9eSNske:9bK9IPHGGkWQstWYSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279793, "uuid": "8cc74519-1b2f-42f1-8860-e0657146475f", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279793, "uuid": "f0b178a6-cfaa-49de-9244-3f98e9dd71f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279793, "uuid": "394f3fcf-4e36-4fd7-8c0c-392a58a91570", "value": "SecuriteInfo.com.Win32.TrojanX-gen.8765.4069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08643d29-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675265289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265289, "uuid": "da806a1a-d1aa-4037-b22f-c878e96bc561", "comment": "Malware payload", "value": "7a5a05054fe50e1354840693b2f0e430", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265289, "uuid": "413b659e-9015-4872-9660-71d85860ab3c", "comment": "Malware payload", "value": "215c5b5c3b1ae20b73798732cd53039b6cf867e044e3e1ceba49191634434439", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265289, "uuid": "98162b80-7245-4c51-a4e9-21acdb2b14da", "comment": "Malware payload", "value": "5ea0ecd9c172dd18e2c41c984cab9ab66d888cfa", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265289, "uuid": "70afdbe4-17cc-42f2-a305-ed9cfa370519", "comment": "Malware payload", "value": "3ffe883cbd47a5a564a833dcb186118917939761c8c5c48282fd91ef3cec2e88a4b5f24d5bee5a7e381be1739a0772c5", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265289, "uuid": "b9769b97-c095-481e-8c61-c4bfa1e78c32", "value": "T1BB04E11226F545E5DEE47BB24DE3971DAA2BBE27E212035F4BB56A1D8D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265289, "uuid": "1fad5ba1-9190-4126-b5d7-9a1748da16fd", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1axbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCC7:Ia9xytedL1MEw4iERBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265289, "uuid": "ef46c441-5cb1-402c-93a4-091af4c0dd75", "value": 176246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265289, "uuid": "71f3d23c-6d2f-4fc4-bff8-1f7ba835cdc7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265289, "uuid": "9fb9f17f-5023-45ec-b08a-5141431946ee", "value": "ComplaintCopy_77433(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcd721a-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675240337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240337, "uuid": "2fc7f3b4-7914-4bb9-b5c9-f47d765ae330", "comment": "Malware payload (RedLineStealer)", "value": "5bf4e4122fcaaea414d09d2e1f7d0ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240337, "uuid": "63ac0715-d26d-4108-92a0-aba29d7c9095", "comment": "Malware payload (RedLineStealer)", "value": "229484c313e746b213dd8a5450d9287c0ceaab277da8e5e4b0b75b7d57f363ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240337, "uuid": "e86f31a8-b85a-4ca4-81dc-8d613e1308dd", "comment": "Malware payload (RedLineStealer)", "value": "9b6ca28a4cb07f0feb0b452247e81bcecd7e8138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240337, "uuid": "631ce0b7-e0d2-4469-ac52-449092bea923", "comment": "Malware payload (RedLineStealer)", "value": "2290396e44fa9812e065df3414399fc587f2524dabda702e994914a252b938058e473455afece54eacb1b9b23fe76453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240337, "uuid": "1ff54f57-1511-410e-9991-d42d702cd247", "value": "T18974F132B590E031C56340F06924DAA5AABD79312876945F73A51F7D8F732E0A7393CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240337, "uuid": "4f6d3db7-4b22-4670-b840-e8caab9be5e7", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240337, "uuid": "d7448a96-248e-473b-a0a5-8b7ca3d16a70", "value": "6144:L6wD8tc0OPH5vrLSERtYrgL6Ae1hZ0Vm0tkzkFiXKsCYWLYbcT61oUe:L6JtcJPH5vructYrgL6Ae1hmVm0tkzkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675240337, "uuid": "998471c3-b3fb-4bbd-9342-e837208a9277", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675240337, "uuid": "7fdc1434-da6c-4099-8da2-a1b535ec1464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240337, "uuid": "3ee2bd20-e836-47d9-8777-dc61bfeac9c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0b02e1-a1e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675222369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222369, "uuid": "e32e081c-b283-4213-b07e-94e4ee9d85ec", "comment": "Malware payload (RedLineStealer)", "value": "8a99a69aab606f768af29ed38f4a9ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222369, "uuid": "4c8c7c51-b820-4347-b815-d4ce0f72bf48", "comment": "Malware payload (RedLineStealer)", "value": "234683db8d7e87066baa0610a3ba6751e09bd4a5cdb585007d5672610cc2485e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222369, "uuid": "434b87a7-c846-48f1-8461-759ef7ef6a2d", "comment": "Malware payload (RedLineStealer)", "value": "ae25503060f9de186a79a3a3b5731c6d80e0a87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222369, "uuid": "01ab6be9-b71c-42d4-8ea5-d29a788d31fa", "comment": "Malware payload (RedLineStealer)", "value": "f98a8adf8b700b631c2fe65204f0c4f5ada310e5b7846aeeea236d62a61d23568e1fd51572b1efabb1c3b387b83dd045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222369, "uuid": "2e3ba1db-6f60-4d40-a62b-c673a74425cc", "value": "T16484BFC27AB1BC62E9328A319F1EC6F8751EB9424E097766121BDBDF15B11E0C9E3350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222369, "uuid": "74a12f3b-8bce-403e-9d90-446626717df6", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222369, "uuid": "79d77ac8-1da6-4041-a5b6-2e5563926e38", "value": "6144:A1TLPMmwwRni0heo2E292Qm0hbhmqMoISfD8M:ANzVwwRnSo2E29gc8qM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675222369, "uuid": "399343c6-27b0-484b-bbf2-7d6a43dd90c1", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675222369, "uuid": "f288e92b-18d1-4bd8-9189-5b553fe41f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222369, "uuid": "f406b4aa-74f6-4ded-af33-4b5065c1907c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a955460a-a1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675210583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210583, "uuid": "af3d712f-a4eb-4a32-aca7-16422e9ffa4c", "comment": "Malware payload (GCleaner)", "value": "b56c5074d4f48c5c4c4916f04f7885bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210583, "uuid": "641de9f9-6c91-4710-b3bf-1c401ad443ac", "comment": "Malware payload (GCleaner)", "value": "2413963f7d32e161e1bf5cff55422d57fdd1c4695c8555e794786d572581833a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210583, "uuid": "31cd917a-ca02-44d3-90c6-08afc7551ecc", "comment": "Malware payload (GCleaner)", "value": "44cce4be9b9a6441e9a3f59615e060d773ffc82e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210583, "uuid": "4a5f59d1-bd94-49da-ab32-1871f9ff32e5", "comment": "Malware payload (GCleaner)", "value": "7ad0810858bcad4459505d48c8c58630a385e388b102b5c79167025b3859237f5bf31ca60295cd56c123eeeae24d6c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210583, "uuid": "ede28826-626e-452f-998c-3dcf423956e9", "value": "T109A533A090709476E723EB72B81FF453BD612FF669ED8369311CA4CE9F2B583050AB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210583, "uuid": "2649e4d3-5c23-4563-9877-8f49bc59b408", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210583, "uuid": "9dea6cfc-5719-40a1-891a-99eb53f79be6", "value": "49152:C2xvRS6Wx2Gy+NH4vGRDII2M77LB0Lp3NxXswvjpW/pLCgv2MR:dRRS6BGy+2+RcpE7LBc3NWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675210583, "uuid": "6e9e015c-e26a-4f38-88f7-b2dc7a5670df", "value": 2192051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675210583, "uuid": "96b1ef28-65e0-4ae7-8518-63237320d6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210583, "uuid": "062ce6c0-350a-4a78-a473-5be2f14946d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b4701d-a26b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675281985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281985, "uuid": "3c4b1872-fe0e-4434-9b6f-5cd1d65558cd", "comment": "Malware payload", "value": "1031f7f6ee923fa952dbe18807039570", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281985, "uuid": "d19448a2-6297-49b3-addb-467efe71d88e", "comment": "Malware payload", "value": "24277b308f5f5d2154a648564965df5153921a2b66e3766223732f7f9cfeaca8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281985, "uuid": "235e17f7-b019-4a1d-8bde-86bfc530c1c7", "comment": "Malware payload", "value": "01a144e221c3a67b4bdc2ad3662a682b66d4dd4a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281985, "uuid": "c0875f67-a5d6-4671-8138-b63091e952f1", "comment": "Malware payload", "value": "6c155093ee0f66c89a69e4ff2f533f91decbfe70b622dd9d9c6668e202fe24f149f189dbcdce086989447d378213b797", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281985, "uuid": "38f48ba0-9fa5-4c68-8474-96f587cf156d", "value": "T1A276330176D42A59E4E46278C6D6C3BD91207ABB9FF54CFBB328B5FA28731D4652020F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281985, "uuid": "adac68ad-ce3c-4cdc-af87-94f1e5a5651a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281985, "uuid": "97bec2e0-248b-4b45-86de-c60a4b662eb4", "value": "196608:pbZpm896G7CCcWhF4Ps71GyFoQRC79BHDTZ:plp+Ps7wyF3gBBnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675281985, "uuid": "f7ed4c24-84ba-4f62-93e7-3e9341d4e714", "value": 7566336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675281985, "uuid": "80084006-f77f-4156-ae0d-d111ef43881b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281985, "uuid": "78d09759-776c-4cbd-ab5a-3b4a9708657b", "value": "WEXTRACT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889046c0-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675261639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261639, "uuid": "5a610fa2-7bd1-43f4-a9eb-13890a8d11dc", "comment": "Malware payload (GuLoader)", "value": "fc6ae69175a3b839356a285e8917cdcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261639, "uuid": "65bfd393-3159-405d-8a2d-57c4864471d4", "comment": "Malware payload (GuLoader)", "value": "242e3afa42a4b6ecbe015e0d0a2786c42a24167e05a12f380f6e63af24d8c4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261639, "uuid": "ce56818a-8d87-4180-b3f0-62fb7f8d1ff1", "comment": "Malware payload (GuLoader)", "value": "4df6d0bc48af8c06db5ff8bcd32d8797e6748d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261639, "uuid": "2d52d909-c968-4d6f-aa11-21b73f4a507c", "comment": "Malware payload (GuLoader)", "value": "ecdf5191ecf8710d01f44cdbb605f1f628d12f7062b38f5e4da470c0ec694f9dc6396b46de30efda8bf37a4c101d48a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261639, "uuid": "4d060cd3-f613-4ac3-82c9-bf47e082b0ca", "value": "T1AD155B9437B0A4AFF097487645183E986E3C705363CBE253927339C49A0D6FBFA54DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261639, "uuid": "65af1ec1-5016-45c5-b71d-50a73730aeec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261639, "uuid": "3a6746cf-d53e-4a49-a415-b08eded5a51e", "value": "12288:hSaE8R724XFHQOGYiFd07AKcSv8hvtFr8z9i7+pv7c4N34X/4pBFB5r61KAspot4:gP8RacFwHUxc1hvfr8zw6R7c4N34g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261639, "uuid": "31d00ffb-70b5-4a65-8212-8f8593c2defe", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261639, "uuid": "c9beec37-eca1-4ddc-b459-51e11ae042e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261639, "uuid": "0efa9c4c-030a-4a1d-bad6-f54976b9846f", "value": "fc6ae69175a3b839356a285e8917cdcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99648481-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267250, "uuid": "28d52634-0e4d-4b41-8cbc-1f8879ec1820", "comment": "Malware payload", "value": "a59d5bfee7531715a8a8621761f948e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267250, "uuid": "bac28c8b-01db-4dd9-9d1c-3b14953894bb", "comment": "Malware payload", "value": "247042961d849375d7dc8b9379ca8ce195b6f39bd79fa6a1201e5876ad030dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267250, "uuid": "325f8490-00b6-42c9-8aa8-046505b411ff", "comment": "Malware payload", "value": "39cfa3756902a4702fb3a4cc9a509c263685e2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267250, "uuid": "9cdec044-3d73-4b6b-a75c-1cb214ffc42a", "comment": "Malware payload", "value": "1f4a5dcb39b2fed7b3cdf93fd1c935f54ece590790f45ca1d176a0b1e0bca3cee9f3776dc55027863dc30a9401cafec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267250, "uuid": "774e5d92-9005-44dc-a054-05cf62380c87", "value": "T137036F10B7F41025F3B75F70ACB646852E36BAE17F75C94E8508048E1972EAAEE79313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267250, "uuid": "58f4056a-011f-4957-a7f0-e9cda7423a9a", "value": "768:BBVWhcNrUecSUmuCvhVAnsFlbNLqbIWWt3RkYUhNu:DVWhcNrU3SUXOf9L+IWW9m1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267250, "uuid": "951e0788-e2e2-476c-a8ce-55ddf39abb9c", "value": 40618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267250, "uuid": "40ebb058-046a-47ce-b85e-0147c3d9f497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267250, "uuid": "114496b4-640a-41fa-8567-1790e24421c0", "value": "a59d5bfee7531715a8a8621761f948e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ea4168-a214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675244293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244293, "uuid": "d0c5dd3e-6c31-4d02-b2a3-32e9881bc5d4", "comment": "Malware payload (Smoke Loader)", "value": "9fe2adcef7a2f730aad399f8e59cac1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244293, "uuid": "ba61552a-b135-4d5c-b396-a00c8038565a", "comment": "Malware payload (Smoke Loader)", "value": "249e7af90d6545e5adcb9d26d56d679f9b6a08edbc7c8287588c38667c092587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244293, "uuid": "efa3fb64-b2b7-4b04-be07-c925e4b6dcbe", "comment": "Malware payload (Smoke Loader)", "value": "2dd152d74b6733ace2a45c121964822cda39ba20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244293, "uuid": "a615cc5a-e645-463e-9800-5c637d98756e", "comment": "Malware payload (Smoke Loader)", "value": "7cfde8631d476d7ca3bd4698cafb10f0ef60e3d31c72c02f9a727ede01d4431d0ffe8dc4b222a36c9733915339ffb5b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244293, "uuid": "25015664-ded3-4cbc-9582-a796e094dc6b", "value": "T1F134DF3139D8D032C5A794306920EAA53B7DF933593969177B981B6E9F302D12B3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244293, "uuid": "64f6134d-0f49-4b47-8d96-dd7a977fe20c", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244293, "uuid": "45550696-e368-4ee7-9a45-6aa8f54fead7", "value": "3072:8WEGkf/+oN3gga6LJgWQg5zb/iImHD7RuTdNFj2zIxPCPNFlN+vXi:8WE9Jgg/LJgpw/iR7RmdNFGIuvlsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675244293, "uuid": "8669b9ac-d0b5-4324-b7fa-5fe37d555fd0", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675244293, "uuid": "74397342-7904-4a3c-a19b-74e6c7b65d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244293, "uuid": "8af08598-03c7-444a-9cff-419b77e1e157", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64f539b-a282-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675291807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291807, "uuid": "be57647b-3560-46b1-918a-afe49efbfa22", "comment": "Malware payload", "value": "23517a40c8a5aa93f140f0d21316fb0c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291807, "uuid": "a8be86c5-8a2d-4cb0-9a7b-20713b05c53b", "comment": "Malware payload", "value": "24ce0f898f50c676a40942454d0b148bdbeac2842e4d2061ebf3b40621ea513d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291807, "uuid": "162c3bd0-6be5-4cdc-98ee-28fc3035a960", "comment": "Malware payload", "value": "6f608cb8c1bb962560fd75c0f8baa3136cfbf0b1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675291807, "uuid": "0e1fcca0-490b-4637-986c-f0a829752594", "comment": "Malware payload", "value": "f0c78e9aa0518d97f652e73d6db98be63e0b16a6ba53e2b59a81892ae0089b9306a1ceda0e5815f41e0b0c240a2fcc39", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291807, "uuid": "29384563-25b1-42ec-9a3a-33d8a50a3620", "value": "T126C433D4AC2E010D47F253F86ADEF4BE6C907C51ABCE45740AAA19ED647039583FA6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291807, "uuid": "138656a6-5b18-43e9-803d-cbcfced6a99a", "value": "12288:0/N+jbXEq/Uhmjh7mTyhqPQDflnJo6Vl4kavR:gITX/UIhKuh6ODo6VleR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675291807, "uuid": "65c8969d-a407-47e9-9695-65c01e4c0987", "value": 587707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675291807, "uuid": "24700f44-309c-41c0-97fe-72a18215bf26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675291807, "uuid": "f75db840-9dfe-4ef7-9371-cf323aee9499", "value": "wask_ads_pro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15598bbd-a243-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675264452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264452, "uuid": "421d37d8-867a-4684-84ae-495b6326bb46", "comment": "Malware payload (Rhadamanthys)", "value": "8789111803c66a2b22f4aa806da72ff0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264452, "uuid": "1c9039fd-ccf3-4a0f-82d9-a152330f25ea", "comment": "Malware payload (Rhadamanthys)", "value": "24e55c417d3c9985dee7bdcbedbfd2c865e502fb9582fd18d520318287960e5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264452, "uuid": "a3096d61-02ac-47b5-9567-c39f41affa2a", "comment": "Malware payload (Rhadamanthys)", "value": "8378670494f2082948f639c9de223a654a0d0586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264452, "uuid": "08aab533-9fc0-4736-9bd2-3b7d0fd4cb5f", "comment": "Malware payload (Rhadamanthys)", "value": "ffc36b1078acadb326d4f23086f3b40e596885df805519a7d5bf5cb90518a45e62b8e70fc36bb8b38f6641d8b358d942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264452, "uuid": "c6f75cee-27d4-484b-9190-5f44d3da354e", "value": "T12B54E0327A90C0B3D5AB15786820EB957BBEB5311575958B3B981BBE8F302D1673330B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264452, "uuid": "9c6b3e92-0f1c-41c1-8753-1c66e1ac1af6", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264452, "uuid": "6854729f-1445-4181-98bb-cf2357fe4ab9", "value": "6144:HqmGhGLqGoeheRtaWGJUWV25YQyLKNqg:HqfcmGomenaWM32cLKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264452, "uuid": "700b437b-98c3-44d5-a059-586a479412ca", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264452, "uuid": "ba6adda1-ee42-4209-b5d0-7517240619e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264452, "uuid": "6f651d4d-8e60-446d-842f-4dc1469c0bdf", "value": "8789111803c66a2b22f4aa806da72ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fc0b9b-a1e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675222154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222154, "uuid": "e6fc064d-a365-459c-876a-7c3a9c75434e", "comment": "Malware payload (AgentTesla)", "value": "577fa8c1e92ebf08182247c415340ea2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222154, "uuid": "68dcbf88-1d88-499f-a898-d950bc51f09c", "comment": "Malware payload (AgentTesla)", "value": "25a0d8eb4c8716b0b1dc5d5f04d2cbd3f130026ac25482aa5ec6a3d4ba8c194b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222154, "uuid": "8ec4b093-9c56-495a-ab87-47234cbda7b1", "comment": "Malware payload (AgentTesla)", "value": "93fcf426b197baf75eb998c2a85ad62066352d7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222154, "uuid": "b282786a-833f-4e11-91e6-9fe088d673d7", "comment": "Malware payload (AgentTesla)", "value": "302cb5dfb2693dddb89ed932dbd13be68f56fd309928c7b602c2f0226c50f2f67d6193cbc356a470bfd2db66199a93b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222154, "uuid": "9fcda926-9bc9-427f-89ff-52ef5bc55bf8", "value": "T114054A8137B15462F1DB05B91028778C1E3D740366E6E2669BBB79C49703AFBF298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222154, "uuid": "51e60881-2c05-43de-8d6e-3b5f23373e56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222154, "uuid": "5dea4d0e-2d54-4e39-814c-f52179736f70", "value": "24576:0eLa9r8jAq/+nhRPX+dlC0XjZa0w6R7c4N34:0j9r8jz/+nPgVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675222154, "uuid": "8d09809d-b609-46a6-806d-dd1f88fff522", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675222154, "uuid": "c5475e39-41ba-4208-aa27-23b4aeab0c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222154, "uuid": "a5bf0c92-fc90-408a-b5df-0b13d6e355d3", "value": "SecuriteInfo.com.Trojan.Locsyz.720.16264.13765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389ec8ed-a284-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292428, "uuid": "7eb8faa4-7fe7-487f-a234-ff18774a6a1f", "comment": "Malware payload", "value": "ab7eb7190896ca75b85e464f08d57c4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292428, "uuid": "25cb506f-265f-45a7-875e-85ba3dc23665", "comment": "Malware payload", "value": "25d6b082ec863db33a1109e2e40ef550d1a6ad1c5d18c879ed82a4f685da03f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292428, "uuid": "90c6cead-f464-4526-a2bd-23cfadb10f7f", "comment": "Malware payload", "value": "a2195de05c62a843df3a128bcb0bd9caad699f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292428, "uuid": "735fe078-de03-4f8b-9814-dee41305e9bc", "comment": "Malware payload", "value": "c546bdbb1aa5a10d3e195de0c3dc92f6578e16cf79d39b478703ae02827d703aba68a4f307a02fc461c306e19fe3d206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292428, "uuid": "573e774c-63a6-4d8e-b9db-d635aab5ac8d", "value": "T1BFA533153A3ECC33C1951BB84B15D766ABB6AD3010BDE70169FA7E0F3B3D592680E246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292428, "uuid": "5ca9e260-72ea-4a94-8e9e-702f5043884a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292428, "uuid": "96880ccf-d472-41f9-bf95-17822073430b", "value": "49152:icPLnQfilGX/P9v+zeWHzMw1FYA4EJ/LwxVTlWpsg6viLCgv2MR:XPLnQfiA/Vv+zXTMwVvNyTMKg6vKv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292428, "uuid": "22fcc1c8-b97f-4f1e-b104-4acf9808063b", "value": 2225617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292428, "uuid": "4c1bf270-f989-4878-b0e0-b1e82241e40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292428, "uuid": "d759e96d-9238-4dce-b0fe-78ddcd7ddb70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef2ae7-a21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675249264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249264, "uuid": "9783f39a-5e7b-4009-924b-eb2b44384a1e", "comment": "Malware payload (GCleaner)", "value": "773a0eb076c1eb4ad39e9579b4068e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249264, "uuid": "c0437e3a-d93c-4897-b331-fc75f13c1026", "comment": "Malware payload (GCleaner)", "value": "26766b81edc3b4ff51d1c71ac0afa21fc8b37f8ebc69f78bba43e6e22c11bf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249264, "uuid": "5003dd5c-9798-45b6-be25-96c67a6e8626", "comment": "Malware payload (GCleaner)", "value": "1b10d0044c29aa1668ce7d7cc48c2f8d84d4404d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249264, "uuid": "7a07e4a1-89cd-4dc3-9185-74b6616a2772", "comment": "Malware payload (GCleaner)", "value": "aa58a0342b1772c05eaf399b05234772847cacf384e5e655ea7d40710ffa7f03fa46e62236c0a014392d6ff337a00c83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249264, "uuid": "b0449ab6-9d14-41fe-aa10-08c66ac42b6a", "value": "T13DA533047A29C837C262E77D8F32C0749A759E0C26EC660691FF7E5F6BB62971C0D252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249264, "uuid": "c17dbc6c-d0ea-402e-be45-db987fe18d69", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249264, "uuid": "4ead94bc-3dc8-47a8-b2a7-7753140672c5", "value": "49152:icPLnQWF6C6Zy6RofAD6e0qluEQok1NV3BA7QySc+LpkOicLCgv2MR:XPLnQWt4RooDbuEQX1WQS+W5cv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249264, "uuid": "eb977fb9-039b-47a6-a318-cb5227f7da8c", "value": 2239746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249264, "uuid": "29b9f824-b3a1-4807-9bbd-a3bfdccb450b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249264, "uuid": "fcf59595-319a-4eb5-9883-470aebc75d49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667663b2-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239248, "uuid": "05430040-2636-44ae-950a-bd5fb939095b", "comment": "Malware payload (AgentTesla)", "value": "cb6900c4f33b2d6dd1203ea3e8708a7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239248, "uuid": "918b241d-7388-426c-a9ed-851feb2b5ed6", "comment": "Malware payload (AgentTesla)", "value": "276574fa4b322be974458f5875f32d5998caaa4800f00a013519c9901ab995ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239248, "uuid": "ef08b709-52b2-4db8-84cb-ecc68d8e8d98", "comment": "Malware payload (AgentTesla)", "value": "3593a84dfca9c916dbb7baf9dd614f5d24e6f530", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239248, "uuid": "fbcc8b42-c916-4ad9-a72e-cac243d319ba", "comment": "Malware payload (AgentTesla)", "value": "1cfd61c50036298089cec8ef5d35099cec7c5dc20625a57e164d6c6cd0c1518281f5eb5fe6f12733a343ddc75753a9e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239248, "uuid": "9a8b9284-7341-49ac-916e-a79f61e9a7a5", "value": "T1C805498137B15472F1DB05B91028778C2E3D7403A6E6E2665BBA79C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239248, "uuid": "c0b55e0a-5fe2-4aa8-92dc-62e9e5365319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239248, "uuid": "6e2f33ee-253e-476d-aabd-046d198500cc", "value": "12288:teEatS9gKII1R/jzAEIfoLFg6x/rdUnhVvRuar8z9i7+pvhc4N34:teEat6sdvoO6gzvEar8zw6Rhc4N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239248, "uuid": "7e0f6bf3-11cd-49a8-8bc4-d74f9d89c6aa", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239248, "uuid": "e93212b6-98d4-462c-9a81-dc4b9200acb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239248, "uuid": "cf007303-6537-47f0-b703-e2b7e845a852", "value": "TKHA-A88160011B.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740df22d-a230-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675256450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256450, "uuid": "cbc171de-d190-4f0e-9601-a419ef0596b2", "comment": "Malware payload (GCleaner)", "value": "8a5d0866644bb0948f6170cc3959f8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256450, "uuid": "86c4d55c-3764-49f8-a90f-c191fac151d6", "comment": "Malware payload (GCleaner)", "value": "27a1e9a7a6d01b9b58178a25a55dfcf9b7a6be8a6b923f0a5f2dc51d96f76fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256450, "uuid": "4fa1086f-d482-4cfd-b0aa-9a121a47554f", "comment": "Malware payload (GCleaner)", "value": "d971b4ec65a3bbf990f38bc2f60b21f4f363691c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256450, "uuid": "9e95c2b6-676e-46e1-a2ef-41d324c6474b", "comment": "Malware payload (GCleaner)", "value": "76a14afe9fb8577a1fd2d4a8e90a68fa9493e07126621bd76f9d645e0a5c3b84ae406899ebac731e37d35c3bf82ad053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256450, "uuid": "79965dc0-4639-4a8d-8f1f-2327a878cf09", "value": "T13DA52305A7BEC435D1827AB45932D631AB65BE6164BCD11220EA3E1F3F3D7C32D0D626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256450, "uuid": "7315bbce-b118-40e0-932e-fa308705b885", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256450, "uuid": "3900b1ff-f9ff-495a-b548-9234dc02bedc", "value": "49152:icPLnQX23B/QIAz8WbgZsZMlnvtTsy0af7qiVZ7hyFXKLCgv2MR:XPLnQXYQrz8WbVOlnvlDj7N7hyFXiv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256450, "uuid": "63ed41fc-1d8b-4116-b3c9-93127e21e23d", "value": 2215586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256450, "uuid": "5115ab20-1b81-4579-9030-7e4a4802582a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256450, "uuid": "4ba18321-e73d-472b-9ad6-e7dd3b30c4b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7695e3-a1ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675228579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675228579, "uuid": "f2245513-1839-4a12-adc7-2222e6c0866d", "comment": "Malware payload (GCleaner)", "value": "1fa9cf7f3c570cb0eafddce30f072be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675228579, "uuid": "e315b052-bed7-46ae-83c9-d38981aa7aee", "comment": "Malware payload (GCleaner)", "value": "28309ebbd0c7c8b4df922061e987cd004987bbee510ff1d5ab2003a4d12c091a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675228579, "uuid": "f0d6d9a5-8fca-4aa8-b38e-9df18dc15530", "comment": "Malware payload (GCleaner)", "value": "3f591e126a7b159eb65572b4d7fa255ab5b73b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675228579, "uuid": "3fdcae07-30ab-4825-8b45-cc821e65d99a", "comment": "Malware payload (GCleaner)", "value": "ae1ed01a0f5fea41c74bf1c9091f25cdb00909eddfaea6f755524fb0e5900d6601c58ee707f7a9b08f4b4a4fd834a4b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675228579, "uuid": "1a911e9d-6ed7-42a2-a07e-5febe806df18", "value": "T17CA523972DA0DD71D3A2D6B84A20E3312F5AADA5347C972275FEBD0F3E7F2816844508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675228579, "uuid": "d4f33132-0703-4222-8b67-05c76f4f294f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675228579, "uuid": "fe13d331-f513-4f49-a5e9-51df69cb566d", "value": "49152:icPLnQnuOJnrh6Jl9/xfQD1fy7Ibjo1OD+ww5rIbAdZ1DtekQDzLCgv2MR:XPLnQntxgPHID1a6joO+ww5rrXDtlQTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675228579, "uuid": "56edf5c0-f1ca-4024-99b5-c9b2859c03e5", "value": 2267294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675228579, "uuid": "4c51e1ba-d5bf-42a2-9846-f958de82fc8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675228579, "uuid": "08b19829-287d-47a2-9bd0-55f9da833c41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9d64ce-a21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675249161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249161, "uuid": "23e6d74a-28de-4b21-80b9-390847704571", "comment": "Malware payload (Quakbot)", "value": "14e10643eb6346b995517d1c1a6de52d", "object_relation": "md5", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249161, "uuid": "06470eda-0636-4508-95b8-8f51a4eb3cdc", "comment": "Malware payload (Quakbot)", "value": "284f0fabbdfc1172cb1cbf74473321668c4b31789d93158669f6735bec124817", "object_relation": "sha256", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249161, "uuid": "00dfc7d1-9405-4659-92c9-22ae9e022851", "comment": "Malware payload (Quakbot)", "value": "e902c68a65b38eb099289b890f055c60d2733010", "object_relation": "sha1", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249161, "uuid": "99c90996-e35c-4270-ae2b-0f484eb277f2", "comment": "Malware payload (Quakbot)", "value": "c9248a1f3bbe501b4d2fc48dfe08b8aca5644f156f89f426959a6070280cf586cce5552613af5c281ed7952f291b6fcd", "object_relation": "sha3-384", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249161, "uuid": "087f90fa-e836-4d98-a892-a4abfa0125f7", "value": "T187E49D01EA4399BACD5713718263F72F1739E7A0A43ACBCB999C1C29DD139E1B64D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249161, "uuid": "74b76f68-ff8f-4440-be39-12fdd13e1043", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249161, "uuid": "34bb43d2-7f4a-4c32-b231-b604c847d9c4", "value": "12288:ubjQRl3iZwl3JBrySD9CkkqC28DWl0RJK2LgAN4c1DZx+vaPpsnRlZ3+u:uHWZiZCCMCkkbRDeSjcjc1DZUyBsRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249161, "uuid": "53598b25-6e1c-4290-8bf7-6c15f264b57d", "value": 683740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249161, "uuid": "1876bf22-ce5d-45f5-9926-0dae211c5995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249161, "uuid": "e7c6b52e-0ded-4e92-9f2f-c8a9b7c1950f", "value": "d.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0ab12f-a21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675247206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247206, "uuid": "3af069a0-4780-4506-a143-f957cccc9553", "comment": "Malware payload (AgentTesla)", "value": "b06f55091555151a4f4215cac7bd7b82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247206, "uuid": "58ee22a9-9fb9-40ee-9f94-4984074365ec", "comment": "Malware payload (AgentTesla)", "value": "2909f932a6f647ac8d95a885334d15cf2985246ebdf45c3bc3cc23d64e5c32f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247206, "uuid": "14b7dd64-9aae-428b-98ff-407f76bed187", "comment": "Malware payload (AgentTesla)", "value": "b9dbd9de0e042c80c72b76a298062defb25e6ffe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247206, "uuid": "972aad55-1696-4509-b7eb-94dd1e6d5af5", "comment": "Malware payload (AgentTesla)", "value": "b492c502e69d9f144d7497e4dd858cc2772a5e6864ec6b8173278828b8242c1ac9f63cdf18570ccaa262ceed363f3a9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247206, "uuid": "ae10685a-1ac1-427e-b3b1-8e61ccad4ddf", "value": "T1BD02CF4E8C71879AE447C57A59AB2807B24D77499ED7BF6F4D0030CA3D598220978D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247206, "uuid": "f1826f2b-11fd-4325-8145-ebf84098ef53", "value": "192:mC+q83lAfxDcrdoNEOg3d9kWGueg+FzOWw79cFHk0MQQK:i+VKAWGueg+ORGjMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247206, "uuid": "337c52ab-6944-4b40-b50d-ec80322294c0", "value": 8834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247206, "uuid": "da8a3bf1-ce53-470f-bfef-4b2987006ace", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247206, "uuid": "24cfeea4-0a3d-477c-9887-bc3827ecd8e4", "value": "Shipping Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6900529-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675267407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267407, "uuid": "eba4f8fe-6e2b-4b75-b39e-b686c3970488", "comment": "Malware payload (Loki)", "value": "2a45eebc00d98a43296c014c333c5c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267407, "uuid": "00dde55b-82ac-4f15-8bec-dda445fb67e1", "comment": "Malware payload (Loki)", "value": "2a1e3d8cac1bc3a9ecf929736afce96f3af7eef91faacf66af7e3511ef072cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267407, "uuid": "b5d15962-2e07-40cc-9779-acd09cf09423", "comment": "Malware payload (Loki)", "value": "0e66d646e6f6f7edf03182eba2a8d3e17edfb053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267407, "uuid": "3c43081e-ca00-4cf2-a906-ae96215b84c7", "comment": "Malware payload (Loki)", "value": "2f465bfe3361665fb0aa42e7edd490e02e2ad4bd2ed6f8bd73ad2838f51dbf98edde4c12144af1d609c499705da5f368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267407, "uuid": "434c3052-28e7-4fed-bc78-63a32a541c09", "value": "T19005BE9C7210B9EFC917CE7799A41C20EA2024AAA30BD707A05716EDC94E797DF251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267407, "uuid": "c6c60386-8c12-47ef-b442-909c89eb5109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267407, "uuid": "8e4555bc-14bc-42ed-8bf7-7ff4f436a57c", "value": "12288:EpLCVdylwnUQG7v8QgCdRMfb2A7rqsk3Weh3ih9HXAnw6Z1UIoW3/e:EQHyohG7mCDab2AXSBYTQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267407, "uuid": "b9cb1a88-a0d3-4151-94e7-bf06b93fc260", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267407, "uuid": "31e43956-4c32-4471-970c-391613701241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267407, "uuid": "1d765e95-9539-43ec-8ce6-df4ea7cd883a", "value": "2a45eebc00d98a43296c014c333c5c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8bb234-a258-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675273829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273829, "uuid": "c3b8d5aa-1f82-4c55-9ab1-387d854101f4", "comment": "Malware payload (AsyncRAT)", "value": "534a65fb89eea78cedb9a808a969519a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273829, "uuid": "f616456e-e8c6-4cbf-986a-94b4839f1262", "comment": "Malware payload (AsyncRAT)", "value": "2c02c3d704cb53f577f82caaafa36d1421c36883ba9909ff7895a32d03d8c3a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273829, "uuid": "2191efdb-0910-4ef3-813a-af592c68610f", "comment": "Malware payload (AsyncRAT)", "value": "820d9352ac3718e0a9b3bae77a5bb8b64a70e4a7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273829, "uuid": "43ccc1b6-3e75-4c7a-a2df-e3e944c4cb6d", "comment": "Malware payload (AsyncRAT)", "value": "21fddbb05cc51b184ac27b8a6e2da5e23bd17390b6fe2e0a2e7ae8ef1e77b0a436839c5170376eb17f755de9cca819cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273829, "uuid": "edb7d509-d3c7-4408-8e99-7aaa2a03bb20", "value": "T133F39D213AD5C8F9E6521532CB997FC0E2FAEE690F3188B733843A1D6E3D541C521A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273829, "uuid": "626a6c42-7868-4efb-adc9-b9b59c006907", "value": "12f12d364f5f6a801e52c9dce28d1965", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273829, "uuid": "cfa7419d-14e0-48e4-9700-f071df1ef9a0", "value": "3072:f0FHdppuOf+wMSHjnywM0vY9t8Qkh+n+kYONIaKA/lLUaB3h:cFPMOf+wMAywM0EJksn+NJ7MFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675273829, "uuid": "7a6fb69d-40fb-4d58-89da-bb9d9c08f9f6", "value": 160931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675273829, "uuid": "cefa2d0c-2b8a-48d1-ac9c-146fe51600f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273829, "uuid": "0c1e5e60-0910-48bd-9c85-217761ef08a4", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a0012f-a239-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675260149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260149, "uuid": "7850f79f-61cd-4d9b-bf5f-c0a72c65e2b6", "comment": "Malware payload (AgentTesla)", "value": "3843ec0f49b14360ad19dcb663786989", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260149, "uuid": "c853e9fa-9bea-47e5-bad9-6de203a3b430", "comment": "Malware payload (AgentTesla)", "value": "2c644e2156f1e9776434b10b8e79196e6c18c365c9f897373a8d9b60edba2dd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260149, "uuid": "bee8868a-6d69-4212-907a-790545b453ff", "comment": "Malware payload (AgentTesla)", "value": "9514931f100ee4d86e2f8df0afb4f009b1ea18c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260149, "uuid": "9c26e8b7-19e7-42ca-b3b7-1573ca933a6c", "comment": "Malware payload (AgentTesla)", "value": "88de0c7915a9c71a573ba4a81a6ea5fbe80779f14e3cec791c6f56b1807dbf24c30e5d53d336b70ace8da84efe79a8e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260149, "uuid": "ebee1cfc-9039-490f-a675-0f294b82ba0d", "value": "T1EE82F8A842DCD323FFAE1BBD94B162835BB2B673A501F65C788CB0D918C6345826571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260149, "uuid": "92b30c45-23f1-4e28-a1d2-35d7246cb6c9", "value": "384:z2YZbdBZ4g1dXhj3pttS3loHok0NGHISSNKnTQL3:aW44dF3YzpGBc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260149, "uuid": "ed4d3553-1dfe-465f-87fe-a12835b275e2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260149, "uuid": "385c11e9-b408-4369-b455-9d21e9158c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260149, "uuid": "12e030b7-5131-4792-a31f-39f3014a6a1f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74c6bdd-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675256107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256107, "uuid": "dcb9f2b6-48aa-430b-bb3f-c6cf49abb149", "comment": "Malware payload (Formbook)", "value": "c6122e61d7e063bf8f4f4a033f04bea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256107, "uuid": "68da3f19-c3b4-485b-8621-e4db75abe3e0", "comment": "Malware payload (Formbook)", "value": "2e559533511ab623c9f7a7b15990f32240d17796a901cd19f37ef2c93e5f7374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256107, "uuid": "6140c1ae-5c20-4b5d-adbf-241c8a43e91e", "comment": "Malware payload (Formbook)", "value": "2a7b2ef9b97032d3cdfb235b55da3325b484ae3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256107, "uuid": "d8adc1a9-4309-46c5-8a09-a5ea035932ef", "comment": "Malware payload (Formbook)", "value": "a0c5a2ea4b3b939af720b575d618f5e68df2f7c595110fe95897a30abdeedf765e2497e186fd37652add2caa25a7674b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256107, "uuid": "219cb4f8-3c1a-490a-990b-788dd4cf7e46", "value": "T16174E0C5F95094A5EC2D5331193ACD716A037C3D94702A1D3BCE3EBB3EBB492942A993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256107, "uuid": "634c4e99-8220-4d5b-b4ea-4f23866094ed", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256107, "uuid": "2c1c975a-b6cb-43e8-a4cb-2f87ea3d4ff0", "value": "6144:jYa6WI4jfpH60bhz6LLh7uLqzLUkOo8KdOElrtVWqCc8yl:jYx47B3zgt/nv1rtM48yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256107, "uuid": "9856dad9-c776-460d-93d6-7f9bba88a21c", "value": 359651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256107, "uuid": "9bde6990-7e11-43c8-9172-f52b256f1147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256107, "uuid": "4023dafd-e161-479f-ae6b-4be923b00cb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47ba563-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675257417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257417, "uuid": "157e33a4-8cd6-4d6e-a597-8bba0bce80e8", "comment": "Malware payload (Quakbot)", "value": "a59accf2adfd39ce3b94916008ffc62b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257417, "uuid": "3aca3d93-0bec-43a8-923d-ccb9d2123d57", "comment": "Malware payload (Quakbot)", "value": "2e698c8ff8399eaf27d2dda8fed11d151fcf4d723715468fe1dcc298ac32aa36", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257417, "uuid": "ce27fabe-2463-4f7b-8aeb-ddaab5bfb4c2", "comment": "Malware payload (Quakbot)", "value": "a8f391d4835c29df499e790bb27c3986a35bf009", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257417, "uuid": "76405184-d3ed-4704-b7ee-f3d4be7dfd6f", "comment": "Malware payload (Quakbot)", "value": "27e06312a43829c5e4014bb1c136b0b590c7e649f2aa6e1218e9b9a81b8a03e572dc6756993d5f384d23f2b2b29ac9d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257417, "uuid": "284b59a5-b696-4507-b32d-5146bd10c580", "value": "T1ABD48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2C29DD139D1B64930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257417, "uuid": "fe3c234d-9ce4-449c-bf84-9276c23db18a", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257417, "uuid": "58fccc1a-7e52-4312-b1a5-08d2a553c788", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTL3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1tvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257417, "uuid": "bfd029c5-82bb-4e99-9ac4-9e07a05339f5", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257417, "uuid": "5bcf135e-fe3c-475f-8853-a2f97b95801f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257417, "uuid": "b432a380-0427-4462-a06a-fc0f2356d6a7", "value": "51352.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a8099a-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675267346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267346, "uuid": "2528fa2b-2a22-4c49-bdf2-ffdb5bc40a1a", "comment": "Malware payload (RemcosRAT)", "value": "a74960472ab338a421fb56948e742f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267346, "uuid": "eecd03af-f7ba-462d-874f-84f0c6d1da25", "comment": "Malware payload (RemcosRAT)", "value": "2e6a8bb2fcfef5cdc29aa03bfe22b01ebe7b3f71e09ad302dec93d672d1c3141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267346, "uuid": "c5968d8f-4cd8-463c-ac79-3fa857950c98", "comment": "Malware payload (RemcosRAT)", "value": "c39bd553f3a1b8147f98056f8ea81bb6d6099b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267346, "uuid": "4aef0be2-5d18-408d-9d01-855d86fd69a9", "comment": "Malware payload (RemcosRAT)", "value": "3417162b1fcbecd86b2ad73cf4c1edaf87ba65b02119cb0638f41a8fdeb88fca9e51a087fe4326da888e3b1d56d73704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267346, "uuid": "4a8dace1-69b6-46ed-a106-a06197ce9e3e", "value": "T138D4E0423350D743CD6FF2B01C56C8DA656FAC34E5A9A58A27A07E0B1FB91B1CD1EE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267346, "uuid": "1337008c-e548-45a2-b780-5081a2cd43c5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267346, "uuid": "3417bf6e-459c-4a2e-b302-81a1474b8d9b", "value": "12288:b7EWNDJccwIWYh7jQ4+ngZnz/B4WW3nVVP7ntr9+E78MNv1z2qcNjRtBnMAr8+:MUlyYtjQ4UWz/B4vT7CE78YvjsNfC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267346, "uuid": "40cc50f6-c612-457b-9862-a7592c9531a2", "value": 634879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267346, "uuid": "41262d74-6d58-4827-b943-607ae78df761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267346, "uuid": "3ce16038-0441-4470-ace9-bf8fa1afcee1", "value": "a74960472ab338a421fb56948e742f2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76efe6e5-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675267622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267622, "uuid": "0ce2441d-d672-484c-9af4-162685166826", "comment": "Malware payload (AsyncRAT)", "value": "416111b00225448d637271b38b2ced81", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267622, "uuid": "f36701cd-a1b9-40a5-8d3c-5a303b7e0a1d", "comment": "Malware payload (AsyncRAT)", "value": "2f55a4df8314ecf86a36a38bb76af6f4663ecd0b02639c3c071247c93054f8ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267622, "uuid": "56d95bed-765d-4516-ab9d-d9e8a1ec4e0c", "comment": "Malware payload (AsyncRAT)", "value": "31cb7553da6fbf930630cafac8a8c99286970dc2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267622, "uuid": "46d8610d-70a8-4004-aa4b-7ac03e081357", "comment": "Malware payload (AsyncRAT)", "value": "37a7793d2c281714fc5929d3576c5084004eb9827c8b3b82b381d08bce4fdee2ed5a26d3bb3664db9bd2de7bb6d0e689", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267622, "uuid": "f1d5e93b-d979-4c04-adec-3fb37d00ed91", "value": "T15993180B56D879EEE02B9B735E5B9F4EEA78B9536C09CB052221074F51621CFF203D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267622, "uuid": "44acc8e2-403c-4e08-87aa-18905282d849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267622, "uuid": "bbca7d0f-e36d-4b9a-96da-08587a50d37a", "value": "1536:EUZggcCkPhSyuTns+fGTMlTx96OSX0BoW/fqlaYNbgv3qNusyEDKKVO2ui:EUigcbh5+uIJ7TBo0SlacbgPqNusyEDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267622, "uuid": "c58aee23-d67d-48c2-b9da-ae79b3c365d6", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267622, "uuid": "91cb986e-96ed-42ee-8994-064869e52922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267622, "uuid": "4ecd415d-5f59-48bb-a49c-f0a559325f8b", "value": "416111b00225448d637271b38b2ced81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dc5642-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262255, "uuid": "56016c5f-6687-4993-b663-b76ba441dc76", "comment": "Malware payload", "value": "4124698c563ce74cd8e13dec8f362a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262255, "uuid": "8d96901e-cdf3-498f-b32c-5230c137ae26", "comment": "Malware payload", "value": "2f7e6502b1a1ad25e92ed82353183628e701035215aad3b9362c9e10ceef2c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262255, "uuid": "03902502-ccb5-415e-b626-4d744f5d660e", "comment": "Malware payload", "value": "70825c3590191d5e7c9d78f5d6b5d6413f59612f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262255, "uuid": "2edb7b0f-c42a-47af-a6b5-af35cf985849", "comment": "Malware payload", "value": "69999e93f70278fc9fe13af5205e2752aee789a032023821a7a793cb75cd53e36ca0c05fe67af80d8007aefeae42e3a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262255, "uuid": "a401661b-0fd2-40e3-a358-ee01ec628aae", "value": "T18E7633B072F0547BEA064BB2D281AED355AACAA4CF30495B334B4D2DAD1C6CDE02D55F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262255, "uuid": "c8df0e1e-f364-4e0d-bced-a4cf7de5251d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262255, "uuid": "19b6bd5b-7e50-4a07-9ed7-9a36b6e7fcab", "value": "196608:91OtQiWAf9eZZjWepDAmqozOyep1vZGRp:3OtQi39KPeLozOnBGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262255, "uuid": "7e7a8cb6-11de-4d5c-ba42-b1ef80da92fe", "value": 7589426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262255, "uuid": "f196381c-807d-478e-b5e6-094a19eea1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262255, "uuid": "128e5bb0-8257-49b7-8092-ff111c9d731e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb45bf7-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267229, "uuid": "13fa98a3-ee8a-49c8-819f-bb2b7469087c", "comment": "Malware payload", "value": "7d44f54d4f68f800143be77969869690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267229, "uuid": "960503d1-a0de-4cc3-9c8f-d63015d76c18", "comment": "Malware payload", "value": "30045003134b57417c5cf80aeca219f1d62bf739ae1b65e71a4b814d0168e7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267229, "uuid": "b929db2b-d5c3-4b70-b2ca-1e37c630283c", "comment": "Malware payload", "value": "e7d153a0f44e05efeab78d757db56c669055302b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267229, "uuid": "5fabb9d1-9884-465e-8a60-4b854d945fa1", "comment": "Malware payload", "value": "3b088b5e7b506bc53f47944a00bc2e655666d7981fe9ae3e08211a0e0c887eb72c9023263a713e1b05268bbea6cd4315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267229, "uuid": "09332c85-b093-406c-a6a6-15e61541dd52", "value": "T167C5331607888A3CD9DD44BEBDBA6B04B4B59D4C4B97C75F9856F2121E00DC3B7EE20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267229, "uuid": "71ed407c-e8d2-4f86-a2e3-dac1419baf99", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267229, "uuid": "f5a071a0-e7ba-4c20-afeb-b2b293ebe4e0", "value": "49152:Er/3LYMVX4DtcZtAdWqX1HUMKi3G1VxPcEuryzPWZuaNUjpj7EwvsQURQj:STYKi3KtVxrusPWoJDsfQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267229, "uuid": "f0269fd2-ff81-4a80-bd09-91b3fbf62528", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267229, "uuid": "7353a95e-9f9d-47fa-a31c-51f8ea5b6193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267229, "uuid": "152e8631-8cfc-4b21-9a2b-678245b4e640", "value": "7d44f54d4f68f800143be77969869690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1debc138-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675239985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239985, "uuid": "6fd9fdf8-86d1-42df-a0a2-02e88a0dc878", "comment": "Malware payload (AsyncRAT)", "value": "280e79b75c74e2449baf87a246927342", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239985, "uuid": "4fee0d14-8eeb-4858-8721-483971930434", "comment": "Malware payload (AsyncRAT)", "value": "3033956fcd540bc6d9f64fe4bce35b626deb627f7cc8394c19d1e3c07485ef61", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239985, "uuid": "4a6883bd-5c83-4112-a58a-83c72574dc35", "comment": "Malware payload (AsyncRAT)", "value": "5b5376e5c25f25d65ba2717908ca0f559a0f0446", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239985, "uuid": "ba9e8d90-38f2-4eca-a4aa-84a0e8ed1c82", "comment": "Malware payload (AsyncRAT)", "value": "f0d4c61737fa8c10b18efd05a0b47c5b30ee55cddea59c734b0a27e34b67014fbad966e5c948d48854f3d06fa551fed6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239985, "uuid": "f107c923-40f9-445f-8b99-4f8237e745ab", "value": "T1503412F94927FE8EEB7E59C1906C16426E689EC74A341230EDC42413B57A320E779CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239985, "uuid": "e9c56381-e2d7-4c86-9a96-b81a3b647214", "value": "6144:dKWuABY4W3vLv93KN4bwG0CehURoxNRHyM3:dKlIYu4UG7axWM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239985, "uuid": "276a8663-d511-4153-b12e-55ef6efadcdf", "value": 231864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239985, "uuid": "ea27e1a1-c5ee-47a3-916c-701fbec7d312", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239985, "uuid": "edcdad23-4ab0-4a15-9f8d-de8729e2a8b2", "value": "corrected the terms of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e038d95-a1d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675216900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216900, "uuid": "b8a5b2a5-c484-4610-9ad8-42c533775b42", "comment": "Malware payload (GCleaner)", "value": "985475e913065cc9a2bc2130f74d8c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216900, "uuid": "1822ec16-df02-46b7-81b0-a1d1ae80d3a4", "comment": "Malware payload (GCleaner)", "value": "309bb21a0544bad1d7f4389ffda2d36bf3ee0aa49155980cce24770923aa839c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216900, "uuid": "5083fed1-7864-44b4-abf1-9474860004d9", "comment": "Malware payload (GCleaner)", "value": "5c874fc7825ba86ee8ec3304f2d299cb8e6d23b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216900, "uuid": "9cd17082-6bf3-41c9-8e64-7d94308c8054", "comment": "Malware payload (GCleaner)", "value": "1c6737a009baf540b7253f94850894681eac85b18d29ec29189421dc5b000e9625c0779a5ed308b79a92538e852f7c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216900, "uuid": "78b757dd-f59e-4499-a474-b875b04fd114", "value": "T10AB533C1B9C19E3BF08B5BB14E656046DEB2BE5A30787004A25DB00E177F2D0696F79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216900, "uuid": "479ab0ba-3d6a-49a1-a5a6-79f9df56a37a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216900, "uuid": "ac466ab7-81a8-4dad-b622-8225ada1960f", "value": "49152:C2LOup1Nkjq3VEysTrRh/iO58/6lL1hY8VQuWRtUfBRC/LCgv2MR:dRsj5rph6O58/6XC2QbUybv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675216900, "uuid": "f9c547e8-03c6-4930-bc06-5e122e93c0b9", "value": 2352971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675216900, "uuid": "f72ee043-66e4-406a-8209-f0875a141c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216900, "uuid": "7cd69567-765a-4b99-a50e-01eaa6bd21ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1cc2ef-a1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Lucifer)", "timestamp": 1675233192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233192, "uuid": "fcb34772-1562-4891-a121-834320fff733", "comment": "Malware payload (Lucifer)", "value": "0bf02d9be8c6fb7cd541e76ee2642936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233192, "uuid": "052519c4-79f7-47d0-a888-313484828422", "comment": "Malware payload (Lucifer)", "value": "30bda717bf07aaef3baa922796e930d9936854ed585bd14fc5a2c269d190d02c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233192, "uuid": "01d016df-9ede-4bce-b60d-cc0cd2cd4915", "comment": "Malware payload (Lucifer)", "value": "4869aa1d383316f38cc7d031082b394441b72239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233192, "uuid": "2407e621-f08e-40d3-8e4d-133f7c369588", "comment": "Malware payload (Lucifer)", "value": "b91e97bab23aa40067fb1e680157285d723310c2c88771ba636950adf6c4d2d44589e53073a61a35e5dfd5a2233e2909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233192, "uuid": "ac9f585f-5c43-4505-b7fa-347c45eae681", "value": "T10354E4136ADCBCE2C035173037BB97E0D72DED602AA2C95E53C00669DA7C59375227EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233192, "uuid": "08a81257-3a80-402a-8d9b-fa94355feaf2", "value": "acc1dae16c9c9b7abbb2ff60602f5d45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233192, "uuid": "35ef691e-0c35-4ac2-bb05-8108ed430b5f", "value": "3072:L2puuPYTfM3y5+rPXQHbTSOZqt3JLGCFvm/l8npGq01jsDpeVmQy3OkhK6fpa2AJ:LjZo36+rYHpDCHnbIsDQVApufunbIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233192, "uuid": "bd14a99e-1948-41cd-ada5-10f59298f836", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233192, "uuid": "632934ce-1ff3-4dd6-83b9-c5b3722e22d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233192, "uuid": "2eed3c05-071a-40cc-b0c6-d48fec749d45", "value": "30bda717bf07aaef3baa922796e930d9936854ed585bd14fc5a2c269d190d02c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d501fa64-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239004, "uuid": "1ff40769-0e95-4f15-8583-f588d0d88e7c", "comment": "Malware payload (AgentTesla)", "value": "c45abef209a00f25542fcf54c75fb900", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239004, "uuid": "dde71664-66b6-449e-9ec7-b7da5f846469", "comment": "Malware payload (AgentTesla)", "value": "31103a139dd91fcbec5e4f5b66392602de969dbfba2c5ea90ad7dbbd851d9f26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239004, "uuid": "1abab935-a213-4a1c-a5af-c4ff980ad7bb", "comment": "Malware payload (AgentTesla)", "value": "1977c0dbee721ebe1fb4c0424b39633995de3ed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239004, "uuid": "f218774c-a0d6-4576-95d0-63cae9ea6f1f", "comment": "Malware payload (AgentTesla)", "value": "c322c4bbb8611dcfe36efd5bcdf3002b18ef2a1f82613efcdc41a31d937c21e5fab52f2c7fe30d51ebe205570f3e24c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239004, "uuid": "2c21bc94-2655-495a-92ad-97b82ecc92c0", "value": "T1F462D008C1B74755C039AF3838E4AEA2360AC8FEE167567EC61A5420CA4C7DF60D4FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239004, "uuid": "be9e9a7a-6d81-4b09-aecc-8fd0c211488c", "value": "384:aQSQeOKzK369ok6uD/cP1DN6a0uzEKssY/HuZLra:aHHOKzK369ok6uEP1DXEkNra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239004, "uuid": "04f3f780-fe29-4283-af53-8d5d90b9cc09", "value": 15952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239004, "uuid": "04d979e3-cee3-45af-9fde-4f4342b6d48c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239004, "uuid": "ad006798-681f-48af-b4d6-9dc23b4ffbf2", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f890b775-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675279006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279006, "uuid": "917a67e0-d8da-41d2-b3a4-ee0f47762c03", "comment": "Malware payload", "value": "716a1412237f3e773659814748ac7b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279006, "uuid": "d0c0c73b-431b-4170-a139-d2bf68309b63", "comment": "Malware payload", "value": "3121afe89ffeb87035b4a1e030847dea8cef7dcbd8a3e35149e3c68cbdc0293f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279006, "uuid": "f395b298-1dfa-4d5f-ae81-b92f077ea623", "comment": "Malware payload", "value": "6b587d8f5ffbe3a386983e5a3b231db4cc480cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279006, "uuid": "d4ba34d7-c057-465e-b9ff-68810dd92912", "comment": "Malware payload", "value": "635e4f9ad2a8d1bb83c7686ea1a6e14741a6e049bd506acf6b03da4a944a98775ea1fe8afb0127e228e32a8b292c1d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279006, "uuid": "b10fa5cf-8dc5-420f-86eb-3a031f48eca5", "value": "T1807633217CE64C79D1E314725D0A27E5E5F88212472188272BFA7D2E7F6D7C6C28938B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279006, "uuid": "37fbd279-bb20-41d2-8d47-cc6a11dce1ff", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279006, "uuid": "62d22d28-44a8-4269-90ec-9b277ab38860", "value": "196608:91O/XYdx1paOMNNi/CtJGQn8L2thLt9cKJ:3O2ngOMNUAt86fLt9HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279006, "uuid": "eb960a73-8182-4c81-9673-6030c5c12744", "value": 7608358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279006, "uuid": "032708ba-ca9d-402d-b0e9-80eb8aabe157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279006, "uuid": "48725187-6b1e-45d0-b189-ae313c4ae6ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb033e4-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261838, "uuid": "2db6cca1-c1a9-4d48-8dfc-094d75b2f8c4", "comment": "Malware payload (SnakeKeylogger)", "value": "1305f958fa05e99677d391ca125ef00c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261838, "uuid": "1a61dff9-6eaa-4968-879f-af5745c75f22", "comment": "Malware payload (SnakeKeylogger)", "value": "317e7fb654d01b558848d3ca8f7e79c05959c3abd167ff6c4df5aa99061f4dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261838, "uuid": "679ad728-3fef-4dfe-af36-ea9286dc182a", "comment": "Malware payload (SnakeKeylogger)", "value": "1dc577b2757cc7f45a7a7c3595595a033f2f498a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261838, "uuid": "7e05c670-5553-48ad-8e92-0ee6eaee0004", "comment": "Malware payload (SnakeKeylogger)", "value": "01f554f5cc13c58146f85b0504fcaa30dd36d8576337f0659320aacedcff60b67bb0c732927c1a5fda8b41219af2b14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261838, "uuid": "d7202f70-6923-4e77-88f7-610b25040835", "value": "T1054412542AE2E17BF8B222385D7C68311F96BEB255B09B1B53302D1E7C32744D62E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261838, "uuid": "f57489e9-275a-4f88-b279-c195bbfa294d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261838, "uuid": "40bd541c-e6a8-4bd7-ba8f-b6554c9904a9", "value": "6144:/Ya6ckDpWD5QV5A4+/B9LPTpFRpUsUlOY+KBLMm/cS4mtP:/YikDQDT/B9LTTQsUUPQMUcmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261838, "uuid": "ced798a1-8140-416e-8539-e4c96d268ee2", "value": 272243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261838, "uuid": "6d3aad4e-771c-4965-ab3a-dff06af7ecfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261838, "uuid": "43aca737-a7bd-4179-b598-488d75674cf5", "value": "SOA_pdf_document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8dceee-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1675267199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267199, "uuid": "c7fc01d5-91db-4b01-8ea4-3d5fde992d48", "comment": "Malware payload (Fabookie)", "value": "0969347ddffa5d71567cf5952256c07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267199, "uuid": "c212b888-c203-4b06-b688-251da9785a43", "comment": "Malware payload (Fabookie)", "value": "31c8c0fd8c0cd0d48fafaefcefb04ac3f9fa4f29a42df4a7e125d87364754a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267199, "uuid": "3c614c7a-2761-4e2d-a978-07a3985afc07", "comment": "Malware payload (Fabookie)", "value": "178146b99cff91c93414575c571140532e5698c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267199, "uuid": "7470d1c5-a873-4c78-a7bb-b3f2d7a10766", "comment": "Malware payload (Fabookie)", "value": "6c54b6c681d5c01ebfee74b6f5b666b2a785567d118d00e9c6ef9a25e2dcf43fd5e395bb7caff4532b1995d4bc920dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267199, "uuid": "9e1f1719-38be-449d-88b2-b1305c26f837", "value": "T1C1739D23B5D1C473C847417558A1CA16A7ABF93147A9C5837BEE0B8E6E303E02B3B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267199, "uuid": "bb1a5da8-b3d7-4fee-8b9b-fd7c18ad6800", "value": "78347e8ca7a80658201c5366a8b9706e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267199, "uuid": "1b8c41f6-c98c-4307-9505-be701e5f2a7a", "value": "1536:3vAkGoo+bH/J027ZKxyafwhHCC/mq1ktG:3vuWbaRgaYtX1ktG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267199, "uuid": "282bcd23-4a14-4a62-b69a-d6f4272ec555", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267199, "uuid": "a505b246-85cb-4534-832e-0f6cc32e0759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267199, "uuid": "07df66c6-25dd-4f85-88c1-a5861ef909b0", "value": "0969347ddffa5d71567cf5952256c07d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccf76bc-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261834, "uuid": "ae950e2c-e8c9-479e-8209-f7cb4e35a3d7", "comment": "Malware payload (SnakeKeylogger)", "value": "95cd7fd7b92c86ab3b9a121b30ba4765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261834, "uuid": "7766d6bb-de05-413a-8b6c-26de1325a79f", "comment": "Malware payload (SnakeKeylogger)", "value": "324c3680a1522f4d16471daf7537cfb9e280bc8f71ab5e4f4d39a89789cbf112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261834, "uuid": "d4086113-d6a6-42b4-8956-5c620e7768f4", "comment": "Malware payload (SnakeKeylogger)", "value": "ea487a12bf6733ee6690cd9f50e67770c5efd730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261834, "uuid": "9bbc8e38-5c83-4ace-a28e-1982a51aa1ac", "comment": "Malware payload (SnakeKeylogger)", "value": "cfc152342635ce37b58e48c1a548ace7aa801e6543a46357fe2c124470b174a3d9a3b7a444cae3d0a0d3837fdba3563b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261834, "uuid": "7b2d5ad2-5030-42f2-9c9a-23a3d5750058", "value": "T17CE4026A42788FD7C96943FA71F014252B301666F093E7480E9AB8D5CD877F08E3B967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261834, "uuid": "53ee8498-2963-46d5-97d7-a6544f78c581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261834, "uuid": "880420de-609f-480e-842e-40e619fdbae6", "value": "12288:fsJ4D4od1L6YIh2hJzfGdb9stn4mAD5Weh3ih9H2A:fsJ4sod/k+FfQ+t4jBYT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261834, "uuid": "33f16575-7fca-47ee-aaae-ae5223c7c7a2", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261834, "uuid": "5786a6af-d915-455b-bf30-c09fd48f5046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261834, "uuid": "35f1242b-22dd-459f-b90e-85389a6d075d", "value": "Gs3xAmDdgBgIEiK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fba7f92-a252-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675270912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270912, "uuid": "df0a10dc-941a-401c-92f4-7f8e1eb3c249", "comment": "Malware payload (TeamBot)", "value": "e401a15ea8319f97d7c841b36a7d360a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270912, "uuid": "ec61dee9-6a1c-4408-ab51-f0dd9253d843", "comment": "Malware payload (TeamBot)", "value": "3276669b4a62b475a3a15319f258927ad122d185f16b8f91f0f2916c921250a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270912, "uuid": "889dfb10-6c93-4a8d-869b-ff562006fc0e", "comment": "Malware payload (TeamBot)", "value": "747ca69f14a032af1303825c2ad9af61ceaecdc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270912, "uuid": "d724e22e-0a3b-4fc1-abec-ce3db20d1201", "comment": "Malware payload (TeamBot)", "value": "fef3f63d785d1550aeb9f5c47347219d92bcf01b169847572b5d1f0458163bde7dceaca58beb990a55618a4b9dd4d0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270912, "uuid": "b41eca3c-f3cf-406d-a78f-2794080c400f", "value": "T19E24D0227A80C072D8BA15705830E691BFBD75334579981B7BAD1BBD5F302E1633A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270912, "uuid": "38c34532-b9c7-4d36-b866-69dae9ace8a0", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270912, "uuid": "5bb06111-85d1-470f-a15b-04e9db05184c", "value": "3072:qH7v6cz9UsBL9SwXW4B5oDqRs/dFgaEQgkRCy7gmaOb3VrUi4j:qHjeeL9SwXNcqRs44sy7gWUi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270912, "uuid": "93d723e6-e3c4-4f03-8f32-c1b8c42594eb", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270912, "uuid": "6ed7107d-96c8-4050-998d-58831024d32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270912, "uuid": "78811289-50cd-4fed-a60f-b0824b7b284e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6884c85-a224-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675251381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251381, "uuid": "f7bbf42a-483c-42d0-b8f2-172f67ad3c70", "comment": "Malware payload", "value": "27f33819d1abd51174693895d3fae452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251381, "uuid": "5b89eacc-f649-4b10-ba9b-0047a9c7324b", "comment": "Malware payload", "value": "33888ade62249829d51b2b3416f21039f1e5616312ebceae21f22778d56d2f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251381, "uuid": "a713b5e7-885f-48fa-b80b-f632c0d09324", "comment": "Malware payload", "value": "1148049cd70be360643c0f312482dd6ba0f0f6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251381, "uuid": "a694e2f3-bea1-44c4-92f9-575541a0a9e6", "comment": "Malware payload", "value": "c4c39f68d1cd8a4dedee4cfd0802292bc510504c65d4ce216767f677defbb0060942b30494e4cdf95e762d7c353ca143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251381, "uuid": "7ee9cd5c-4d4b-45bb-8c88-c04d7e06425e", "value": "T18776333738DAD977C3A0A0720ED51C9FEAF1C29487045AA7876E8E5C2E3D752DDB2411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251381, "uuid": "c229d886-d4ef-4857-b540-5e47b521a243", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251381, "uuid": "b8c90d87-f6fd-4193-b048-813a4684c993", "value": "196608:91OFP26WTnTEcRjrEAW1mBAT/ctKtkCoRp4ivShvBM4bo:3OMTf5XWsBATaf4J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251381, "uuid": "df52370a-cc0c-4de1-b6e8-8d890a4b274b", "value": 7649436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251381, "uuid": "684ab96b-70f7-4e46-b9ec-694acaa708f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251381, "uuid": "b7d51d62-e0cb-4fa2-a83b-f3f5ce157dee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f577dffe-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675256238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256238, "uuid": "2e888d69-888d-49a3-b4a8-e5cbb644683e", "comment": "Malware payload", "value": "e73cc4e24c2f3764396af8a759b4e18c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256238, "uuid": "90c43b6e-b129-4a5b-b865-d460afdf7af4", "comment": "Malware payload", "value": "3438fecdc4eadecc659f39c4ae06964c9fcfdf57339f6df62ff1829ed171b38c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256238, "uuid": "25d676a9-c327-431b-a8d6-f1b1a1e9834c", "comment": "Malware payload", "value": "73eadd39b181a122a198011ea2aac2df6b0d3d85", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256238, "uuid": "909c4b86-68b2-458e-9187-acbd8b988dac", "comment": "Malware payload", "value": "15f3fcad6eea5330149f9907af13ae6f71e09615cc31f977c9a191e0d9a885a4cc27ea74bac75714234c6cc0b569a7b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256238, "uuid": "af2297ef-201e-425d-ac48-1982e9868228", "value": "T11F83124399E29644BBF095FD525E6D12C50B6C4B9A70E7F1B0D7739C206320F48ED86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256238, "uuid": "28a96827-32bc-48d1-bd6a-d0fe9ba9e02b", "value": "1536:nsVBZ4tKV66LY1jAlJTMXtiSY0dKsnCgPZTlEJkIz3CrDElroc3tadCmHgg+Bu+a:YZ4M66LYqTMIeKMCKTlEJkIz3CrfsaJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256238, "uuid": "63e72654-e7e9-46f8-9644-ad833d324c9b", "value": 88187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256238, "uuid": "6eab533d-d1c7-4bd7-b5f2-a46e2b7c34fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256238, "uuid": "c92d395b-474f-491a-98ae-fda1c78dfafb", "value": "locker.bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8897f5-a256-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675272762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272762, "uuid": "9e098577-5f9e-4721-837c-3ef391c1be2c", "comment": "Malware payload (GCleaner)", "value": "245f69b46db6dc4a3c7270d96a689785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272762, "uuid": "a0c25fbc-0948-4e18-8d70-36a1abc9aa40", "comment": "Malware payload (GCleaner)", "value": "3469a2a65039f4ac5f829f8d37e2b24a39a37c155de28864844b5be6209ad034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272762, "uuid": "3c852953-2902-4814-9a57-7173e479a2eb", "comment": "Malware payload (GCleaner)", "value": "eb3f8573672c4f2716f223f4efae02958fb545c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272762, "uuid": "c1ebc3ad-58c6-417b-8c41-783aaa6da2fb", "comment": "Malware payload (GCleaner)", "value": "f8d400c6bddbb343f7a2b988f04161b9692dc5abdeb95ec168c940ceff9fe9b515aa53397ed3f16e6551ec4b8cc0aa66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272762, "uuid": "b81016ac-0370-43b6-b2b8-be964ab360fd", "value": "T1B7A523952A3C9972E3E1B6F85D01C332EFB9DDD13439624275F63D0B793E292A90C606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272762, "uuid": "e8dc9d15-94e2-48f6-8764-b9a70330d158", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272762, "uuid": "a9b43697-ceb8-4a52-9241-b99274fec687", "value": "49152:icPLnQl1JC7SyLyiRb13Rm3oxLmte1XjMjr6LCgv2MR:XPLnQl1JWJL1ygme1XAj2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272762, "uuid": "e04b4182-35c0-4ed8-bf21-d6a728d78909", "value": 2186758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272762, "uuid": "c36ebb5d-ed9f-42c7-bf2b-6b9f41b3e42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272762, "uuid": "2c8f6643-7aa3-418a-80c0-527789532781", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967ef45e-a246-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675265957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265957, "uuid": "f1bc0c54-2cfc-491b-a741-5a1f79112c28", "comment": "Malware payload", "value": "e5967a8274d40e0573c28b664670857e", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265957, "uuid": "9762a3fb-5714-47fa-ae37-a7a937209179", "comment": "Malware payload", "value": "3504e40c6a3cfdd5fa084250cf488cf9d3fad763f3c327ad4d99cf08be328cff", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265957, "uuid": "e736c5a9-6fb7-4825-8b1a-b249e85c6ec5", "comment": "Malware payload", "value": "2d351c44d9c7593eed224e0015c571440f010c8b", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265957, "uuid": "f8a642ea-d5b2-46d1-9959-bf880bbdf9df", "comment": "Malware payload", "value": "7f74d44eec1b0083fef2caef3ac6a4652c5e8541b48a29b822704c26004cc85d287c1b9b84f9db9a3e43ffa178c02d8b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265957, "uuid": "5080c7a7-7381-4af1-b234-f2d577156a58", "value": "T19A65AE3A8AA7FDEE732C280484081D530C48372756A6465CED5B4BBD3EC9621DBAD5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265957, "uuid": "11d3b554-ca4b-46a6-a9f6-6ce48de56c05", "value": "24576:O509Gg1wDNJ+RR2KzMyFQ1Z4QmdPBMT5xUanIx+kK84Av:PG4vB7su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265957, "uuid": "0a11df03-7a0e-4cc6-9b21-f24b2bd87798", "value": 1501338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265957, "uuid": "138632e9-dcc5-4747-89ef-8d9fc959e431", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265957, "uuid": "61b33045-72ed-4595-a6d1-d9a97e0e1e8c", "value": "Factura_Deuda_423534.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b021888-a252-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675270877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270877, "uuid": "589c050a-4d3c-4816-a539-3776552053b4", "comment": "Malware payload (RedLineStealer)", "value": "f8d226f85c19f4551284098c8f466239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270877, "uuid": "ff238502-d16d-4d93-88a5-0634fbd099a2", "comment": "Malware payload (RedLineStealer)", "value": "351be308edc12e6d8bb913fc5b8ec121b62916fe5d1c67bd3141f0e5606f771f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270877, "uuid": "6759faa3-9182-4fca-96d3-6cb31afb5edf", "comment": "Malware payload (RedLineStealer)", "value": "8722d94321c4fc9a1b964a80e1c606305c66b8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270877, "uuid": "24caf69c-7694-413d-8722-37a787d7bce5", "comment": "Malware payload (RedLineStealer)", "value": "3b5451f2d3d2253105732299963c8ee4b3ef7d5b985f0e8e8191c0918d74e9f156fbd2b090312f857c019501c0bd87fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270877, "uuid": "9a92cb4f-49d2-4db5-9f0b-75522cf0c3e1", "value": "T1897402327A90C072C06754749C21E695BBBEFA302675981F7B581ABE9F302D1673B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270877, "uuid": "fed77ec6-b35f-4311-9bd1-5d4cd722d426", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270877, "uuid": "93edf74b-deeb-4f3d-b9b8-87a34a7a04af", "value": "6144:OHLpAYL2iyvCgqxhFtIwSgQIvzFEh4YJuVPNsdLtkU:OHLyYCiy4JIwtveNJraU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270877, "uuid": "f14bab2b-1bd7-4807-a064-35d9166ad2bb", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270877, "uuid": "61c9597c-e84d-495d-bcf7-94ff38da7e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270877, "uuid": "df385d26-821b-4f77-9d8f-800d84e7a930", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c24493-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292898, "uuid": "8c3ace66-a3db-4c9b-8a1b-ac33f0d67369", "comment": "Malware payload", "value": "6a5f6e9aea3997f62df50de3b7da5dd0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292898, "uuid": "6190f4a8-7115-478c-a0c9-4ed4885b5d0f", "comment": "Malware payload", "value": "3531f03ff33dc02b868d4eef0b60e4a3ecc5d6839599a35bd5222c7c54ca2c4f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292898, "uuid": "7a0ebac5-c3ba-4eab-b7a7-50640d0bf006", "comment": "Malware payload", "value": "1799c398510d43dc8183677f37689c701e357c69", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292898, "uuid": "27bd0c99-249a-4527-8318-d70f11b881d9", "comment": "Malware payload", "value": "7832109e9d8cd2421a3ce3616d6dff3432019bb238777c38518aa4513a31485e179f9083d1821f6a5ec84bc6b20d25f3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292898, "uuid": "850ecf15-b85c-4132-87e5-982f212438ed", "value": "T165363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292898, "uuid": "49abd238-0c04-437c-9936-da3e692d79ea", "value": "98304:jv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXD:jvpvFa+g8RWLdPk/84tCEr0RtNiC5eS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292898, "uuid": "497a337a-d4f6-4642-95c1-034bbeaa00be", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292898, "uuid": "3c2125e6-5685-4af0-90b6-8eb55c39e327", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292898, "uuid": "45cc839f-5a44-4472-8809-0e56400ef86c", "value": "3531f03ff33dc02b868d4eef0b60e4a3ecc5d6839599a35bd5222c7c54ca2c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973bce20-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282279, "uuid": "7a14660a-6bb4-4875-b76b-1ff1fad0be1c", "comment": "Malware payload", "value": "b7a0ac323688a7a6038fa34a1fadca68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282279, "uuid": "5cda758f-7aa1-416d-87f8-22fb46905f02", "comment": "Malware payload", "value": "354aad74d3dd8c8f09d5faaab5b643db2ff873218e74e5b606014f975f921f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282279, "uuid": "0e1fd1d5-3fd1-4836-813e-482ed7cf579c", "comment": "Malware payload", "value": "93f6817622bf0d8d4261c122bb9c12c3e55cd4c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282279, "uuid": "39a5ab62-9dcc-4019-bff6-c763351eeade", "comment": "Malware payload", "value": "92991c95b6e056861b84c49ba583a19c90dd8af03a1aea4c2bd6166da7c400249983d3f721006793e6b3dcb2e324c3f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282279, "uuid": "0f426139-8b3e-4991-9561-41e447e3d70a", "value": "T12F9357566A9F509CB744D52308262CC7D8682FEB0DE1C925DA373B1C8C18F835DFE266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282279, "uuid": "dfc0c1e0-b230-4bf8-bb09-77660849afef", "value": "908e67f8b0160bfd82132ad8738bb56b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282279, "uuid": "bd5985f5-f5fd-45b5-9d33-c4c146cbb8f6", "value": "1536:dzfMMkPZE1J7S6/PMj42VJEY4ujMepJtANuOAl0QQsIEySYndfcN:pfMNE1JG6XMk27EbpOthl0ZUed0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282279, "uuid": "ff0c2f69-a352-4110-8123-61bfca0dce3b", "value": 92290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282279, "uuid": "dc1d9e7c-fb4b-472d-97d5-566fce8750b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282279, "uuid": "f717f59d-6e4b-41a6-9a98-b33f71bca230", "value": "cmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834a8438-a1f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675230706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230706, "uuid": "612fdf1a-d781-4844-8c55-b7b62d87e870", "comment": "Malware payload (SnakeKeylogger)", "value": "f39fa9ca70c1acce62be880ee713e8ef", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230706, "uuid": "ead04423-2210-4d77-983c-825e4ea1d767", "comment": "Malware payload (SnakeKeylogger)", "value": "3590e97c8e6c65becfce92c63e164a2c808e7e9cb366cfc4c8ff76d7cc28a831", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230706, "uuid": "15cc159f-e8db-438c-a54b-c73298f89b0d", "comment": "Malware payload (SnakeKeylogger)", "value": "0322f8b96aa93a7ee08533caac82bfdc89f660c0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230706, "uuid": "2a6a15f2-f319-46b9-ae3e-2a4d6b89e122", "comment": "Malware payload (SnakeKeylogger)", "value": "068ffda0c36abf9d66bc15105be9a7b8aded47bcf26b5ec3e7e0302a418619394f6fb3c5fb275b761597bad92a8669d0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230706, "uuid": "e9e895c8-0e1b-4069-bdad-f2014119d9be", "value": "T1ABF433FC36C1184453ED2325073BAEB84DFAC28C65384B570ECB6181E7AFA64E68DE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230706, "uuid": "037c8751-6e76-4de5-97a5-5e02828c06ce", "value": "12288:BML7nvXmvR+hfBScVzn8HrDTUpU5HiiElrg2dFZI6ARIN2JmGbh3mv/IQzwISMIF:ImvRgMknUvQsMzfILRIVJ8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675230706, "uuid": "232458d0-71e9-47c0-94e3-e03cf3be1c59", "value": 794736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675230706, "uuid": "6052f189-4f26-48b9-973d-6f8bda696501", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230706, "uuid": "c0b9c5df-af53-48b8-bb19-75b7c49b7810", "value": "macintosh.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffa758e-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263718, "uuid": "59fbf25a-8c34-4b9f-b7ab-2b3b2b940354", "comment": "Malware payload", "value": "6daf6989daa32f5fa2491924a9ef4f3c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263718, "uuid": "834e4ee6-7860-4563-ac60-df714d971fb9", "comment": "Malware payload", "value": "35a3f2335857ee9d094f3942adcb798f2add86ff6582539448da24cd47cc9070", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263718, "uuid": "7eee4942-c9d0-497b-a2a4-a2fa2645452e", "comment": "Malware payload", "value": "724b8db880e69da3cc899d0dbd488dd86c91a86c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263718, "uuid": "769abef3-5878-47d5-a5a6-7668955cf9ea", "comment": "Malware payload", "value": "b07311dc65a334df7c0677dbf9374109b38c52b862bab8d1166b246182f0424ad5368dcf40fd3b2604140f2d440ccd91", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263718, "uuid": "171bdb61-252c-47e1-89f3-9426cb245662", "value": "T1E214AFF0779099D2EA9E9BD7D5596D9D1336217BEDCA208C0046FBCA29B73408E0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263718, "uuid": "e35d26c8-4543-4c06-8842-55dfbefe8802", "value": "3072:1O5PBRC0+vwOQdZZG3DbMSVmFR7ZasFmk:1OBBRUvwOQdk0SVmfdfmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263718, "uuid": "a1faa23a-6cb6-4cf5-8578-21634a09efee", "value": 194023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263718, "uuid": "f78a59cc-69a6-4407-90d6-14abd9271bd4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263718, "uuid": "0a4dd856-0df5-4fc4-abd2-ca1ef887f895", "value": "SO-23010028, dated 31012023, for TMT project.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d8918-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675279115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279115, "uuid": "3526c86f-2e6d-4b2e-b38d-bf28acf3cee3", "comment": "Malware payload (Mirai)", "value": "ae08ba3e790704ea739aa87b3149ceec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279115, "uuid": "d9e135f4-6cf5-45c2-850d-11196d2493c2", "comment": "Malware payload (Mirai)", "value": "35f6293f01b4a5e9106a76e9651ffb27c3c38e4b4435c8623e1120087f2a7ccc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279115, "uuid": "a461d28b-0402-4163-b58b-26923b7ab390", "comment": "Malware payload (Mirai)", "value": "82b3dbd30ac0e040d577341346a207adf53b1b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279115, "uuid": "f183a4fc-06dd-4e70-873b-730f4236feaa", "comment": "Malware payload (Mirai)", "value": "348be096f97364044c0969158ef367c16a3ed2ad543018dc89aade9af64af31bf9f472c0bab23ce39f21c42ce711e3ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279115, "uuid": "824e57c0-f6ef-47f7-b936-fe3fe8f5beb6", "value": "T184F2E1E3DEFA8B08D16D1031192FBD5F19A4C21E65BCCAD672D851D21DB8F8C312D26A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279115, "uuid": "bce600e5-502f-43db-a6da-1370c435249e", "value": "768:bxv5qWLZQM0zYICa20Otn4HWGlzXU57k/le5nbcuyD7UHQRjr:bbqj9zroefSnouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279115, "uuid": "a9642f75-ae0b-4823-975d-bbf976083539", "value": 34964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279115, "uuid": "ec6f4f88-e7fc-41e7-aa9f-fa095585bf22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279115, "uuid": "eb813f7d-edfe-47ca-9ce1-084faf5a10a4", "value": "ae08ba3e790704ea739aa87b3149ceec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6c2e6e-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675267333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267333, "uuid": "d881966b-6a0e-4312-8440-625da50f01fa", "comment": "Malware payload (RedLineStealer)", "value": "a8f18d7d46754d99114033f6ab8ae8ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267333, "uuid": "0244f8f1-c8df-4a04-9fff-1a4e2636f935", "comment": "Malware payload (RedLineStealer)", "value": "36efb15bd298fe2741289d17e27646da556ec5b703261c42162d3e25c21da861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267333, "uuid": "1d341fb7-d2ed-417e-9a58-8fb53ec85f8a", "comment": "Malware payload (RedLineStealer)", "value": "ecff0c7db93b5d38794de083321b397e2c6514bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267333, "uuid": "501cd554-ccae-469a-9275-ccbf546475c1", "comment": "Malware payload (RedLineStealer)", "value": "7f5f1582bb885a6c32cd14f2b4b718cdc6b4190fa9ef5ee2b3a9076361fff957109824331b08837675badc1662bbb2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267333, "uuid": "3d0742e2-e2ba-4c01-b690-31259cd32f24", "value": "T1AD74F12235F0C073D9A745715C24E790BBBDA532163A889B7FA41A6E6F702C1673A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267333, "uuid": "b5f0a700-8a34-4287-bd45-9c2900ccc6cd", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267333, "uuid": "6dd25d97-6c08-44d6-b943-406395a94331", "value": "6144:mqG6MMrpLncsk4tQwcIuAJemxl2KprJK304:mqTN7csjtQ3EnxlVpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267333, "uuid": "2f3a18ed-b8fc-4cb6-a6b5-306e2e92269b", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267333, "uuid": "726f7196-8fea-448b-a926-fd2a13f6229c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267333, "uuid": "dd78cf89-cec7-459a-adff-6b2305f0c02c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f54094-a1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675225832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225832, "uuid": "4bd63c54-fc9e-477a-938e-f71567ce7032", "comment": "Malware payload (RedLineStealer)", "value": "8586e0bb849bd1ac13d99322001c5b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225832, "uuid": "b3fef74f-60ea-4433-a11f-e9b8eb444b62", "comment": "Malware payload (RedLineStealer)", "value": "36f501220133a7fc4a107c321f5a521b63147e71ccf65bead8a397bc6bd84d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225832, "uuid": "ddd75f84-7c76-4c0f-9389-95c2a8451abf", "comment": "Malware payload (RedLineStealer)", "value": "7602d41ec6d6310f523636f08b7471a63c0405e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225832, "uuid": "997530d0-21f5-48c5-a5a3-c920156bf654", "comment": "Malware payload (RedLineStealer)", "value": "e2e9014a7ab8bfc53af8463308629ffb5cc90e80e4f86927496ef76099e59420534dbc0e474ab29aff3cb31cd2ad2820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225832, "uuid": "accc88c2-3f17-4d05-a99e-532dfd1fd95b", "value": "T18584BFC276F2BC62E9228A31DE1EC6F4752EB5424E157766221B7BDF29B01E1C1E3350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225832, "uuid": "d0b0360f-9d7c-47a6-a9c3-15f20bb7c957", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225832, "uuid": "08bf08d8-12ac-4ca2-802b-e0b25b3e6d1a", "value": "6144:m3lLfqtFeUXitZLUSbp0aCLTq5483SAHTGufT00vmqMoIXL8M:m1bApXitFzy53qXiWTl9OqMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675225832, "uuid": "d6aa079c-d43e-4184-9c45-4d421c60eb44", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675225832, "uuid": "508fa763-3f4e-4be2-9925-7b0de0ffffb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225832, "uuid": "34a14b60-9e5b-4d1c-afa9-8348a208b54d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f99b4e-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263757, "uuid": "a7c70d93-035c-4ec0-9535-a9efb5996f19", "comment": "Malware payload", "value": "950d284a9f8610c212baa453751d630d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263757, "uuid": "dc4f97db-f80d-452c-9eed-cac9f0a45764", "comment": "Malware payload", "value": "389fc462b50d21b090b29299ed3b9982f203bc94b635335253438ac907ff6fa9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263757, "uuid": "d0e2adfc-005a-4795-8eb1-7b027f45adbf", "comment": "Malware payload", "value": "49853b732d7c6a9e83cdde5a3adc01a6a906eac1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263757, "uuid": "5fb54bdd-6045-427b-b9cd-566e94f6bf02", "comment": "Malware payload", "value": "afa9c582cdff60c83bfe1bba94e2c94c8e4887be02811b2e70957a9fcb94f588af078995ee7b51d08995c54ea5921613", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263757, "uuid": "6fd36550-822a-499a-847a-16636df465d0", "value": "T179749D636952EE63E990C7707FB3D6A01353AE0679022A962653B31E6FF33C024D5E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263757, "uuid": "51511862-6d39-48ab-bd88-75aacbea64af", "value": "6144:waFJkKXiDU7woFZ+RwPONXoRjDhIcp0fDlavx+W26nAn3SOjhnid/KzTUcCIdNW7:waFiKXKxSrd/7czNWKUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263757, "uuid": "19f86701-d87e-403f-a8cd-a5058ecf93d9", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263757, "uuid": "ac9094ce-76c2-4fd9-9271-15fab5b88c7d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263757, "uuid": "b8056568-632f-4180-ab9c-025f7941bc7f", "value": "QDFRFQ 28022023 - NFB 100960.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b693d0c-a256-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675272837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272837, "uuid": "ec1fca90-0cfe-497f-acb9-6ea33848c60e", "comment": "Malware payload (IcedID)", "value": "e9f479c2af78e68b7d5c0ba7a307152e", "object_relation": "md5", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272837, "uuid": "c903b86c-0787-41e3-ae33-04799176980c", "comment": "Malware payload (IcedID)", "value": "38b742be48b426b5c89408092fb6ebdd93eefcb584b131abd9c7e3561641c3f1", "object_relation": "sha256", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272837, "uuid": "a66281f6-a7e8-4538-8bc1-d2b736585227", "comment": "Malware payload (IcedID)", "value": "3930a6a0b88883225099a897a1cca01bb253fe40", "object_relation": "sha1", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272837, "uuid": "f793cf34-4eed-4bc6-b6a3-34eb71d3307c", "comment": "Malware payload (IcedID)", "value": "4c66dd6f9111959ad3006b06b10d70d8e770af665113f5266e4ce35830c903a4bf08056f7a1fbbd5aefb23c05d7a8045", "object_relation": "sha3-384", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272837, "uuid": "e2eb0e8e-aee2-4474-b033-8768f5cd1386", "value": "T18115122B75B2AA5EF2DB72B9155D4833E639B6A1CCD5A8CE1D00D1F14C1BC0E8B1A743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272837, "uuid": "fda5d310-d98c-4727-a9f7-2110a7808087", "value": "6144:jgktMgO/XjWeZYn58USIOi1cDh5ZZ4fGA/Z1N:jPtMgOPjvYn5nncDhuxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272837, "uuid": "285fb657-2d4d-4017-b895-62969f13df9a", "value": 943578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272837, "uuid": "a5f9887f-d6de-4410-b3ae-c758a77a1898", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272837, "uuid": "eabb70d2-df98-44c3-9666-a0a96ca93a5e", "value": "Setup_Win_01-02-2023_17-10-20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bf765f-a1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675218631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218631, "uuid": "9aab2051-927f-47b7-ba65-175b1f0c8859", "comment": "Malware payload (RedLineStealer)", "value": "297f62b109402b754ccdab1937a028c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218631, "uuid": "f265b259-a1a4-4205-9d72-a2f9af9d2b13", "comment": "Malware payload (RedLineStealer)", "value": "3910840c590bf0acf59dedaef0b5e4bf20875bbe062085eff13d002b94e65d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218631, "uuid": "145a6088-10ea-45c8-bb1c-b8785a0da571", "comment": "Malware payload (RedLineStealer)", "value": "1cd9001ee2b7f0fbbccc57512d11a09ecf9c40bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218631, "uuid": "852c89e0-2a2d-4029-9611-17bd6b334788", "comment": "Malware payload (RedLineStealer)", "value": "34babcb88fed816d99a99f32c333fc2ae01a6d0dbeeb478518e6910a27a7beb7ce6249edd974079395f34dfc6b0dc077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218631, "uuid": "c9ea203c-ab49-4808-a957-0845b91bed20", "value": "T14684BFC277B2BC22E9268A319E1EC6F4761EF5524F147366231BABDF15B01A1C6E3740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218631, "uuid": "f13266d6-b15b-4d18-8283-0cc24296bb4c", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218631, "uuid": "e35c0203-31b6-4146-baa8-d96aae3b114d", "value": "6144:uXcLnw7Jg1pgDayqwTZAwgt9yO1haJ/9GsyQnqjmqMoIsLYo8M:uMM6jgD3fCwgzdhaJ/9G1KPqMKLYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675218631, "uuid": "8504b527-7727-4778-8b65-b2090161c74a", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675218631, "uuid": "9cfba752-ce81-49b9-aaa4-49a9967b58e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218631, "uuid": "86aed322-586d-465b-aa51-5d50faa86bca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aadea4-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675259060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259060, "uuid": "4f526921-e66f-4d83-8cc1-671990080ef2", "comment": "Malware payload (PureCrypter)", "value": "eff7ae696a293b48cc7932e6304bcaa5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259060, "uuid": "a0238052-695a-47f7-8221-a47c42b3cf96", "comment": "Malware payload (PureCrypter)", "value": "397b94a80b17e7fbf78585532874aba349f194f84f723bd4adc79542d90efed3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259060, "uuid": "23fc5897-262e-4ec0-b875-9d33a4753f91", "comment": "Malware payload (PureCrypter)", "value": "5c81b45d6d9c53e4e481bbac8e4edb6930f0121a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259060, "uuid": "38b59c96-d334-4cb8-85b7-74ebc2b8ecbe", "comment": "Malware payload (PureCrypter)", "value": "ebbd7b8718be85d69a3af742ae5a6d264c873cb64e2b1263387c17e15e9d7dc66a85c22cc68173406d29076d0bbc1db4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259060, "uuid": "e1d9abca-1e0c-458a-91bd-6614c605aced", "value": "T1FF74A625F0753761E84DC5F048B01DA413E82CB1237BA3C822B1390FDA6BE7D9A64D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259060, "uuid": "703dcf20-fe80-47ed-a896-aac888f113dc", "value": "96:nY7ENVgjSYPR53idqq6gD8bZYx2L0os0OlN88qGY:Yt+Mvidqvb2Ms0OlNNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259060, "uuid": "0c23d81a-1689-4ce9-b5c1-088bfa7648a8", "value": 360096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259060, "uuid": "e2744f2f-168c-4676-aa39-b552efa61123", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259060, "uuid": "7ff04ee0-5114-41c2-a5cd-18e51a63a059", "value": "NuevoXpedidoX7887979-800898.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa90d03-a1f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675231935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231935, "uuid": "f3c5dae5-d1ea-48eb-9ed3-0a25d7dbbafe", "comment": "Malware payload (njrat)", "value": "fefa26464ab8b5a8cb8b2d948a90ae37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231935, "uuid": "94dcfc22-962b-49e1-9a4c-d474774e6086", "comment": "Malware payload (njrat)", "value": "398c89ea44a9f2e7796db917c76579dcde1ad549e7b65e7c6ce301d45190ed99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231935, "uuid": "8190b6a5-fce9-4af7-92c7-124fbbacddf7", "comment": "Malware payload (njrat)", "value": "1944fc86ce754881accc9cda6155d39951359bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231935, "uuid": "0d2ca863-d761-4373-94f9-72710223aceb", "comment": "Malware payload (njrat)", "value": "35c352bed4a209f02e7f25a6f2fe658aaa4c6cee166d95e0aab84292afad65fe3eb3516a9ee964de7c77b42203b2c643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231935, "uuid": "aa9710e2-f3f2-4dfb-9938-527bc701baab", "value": "T158E207067BE94215D6BC1AFC8CB313214772E3838532EB6F5CDC88CA4B676D00656EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231935, "uuid": "70be2e93-0f04-46df-88cd-caca6526b8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231935, "uuid": "2916d0b5-b8ca-4eae-a712-753af0de2671", "value": "384:n0bUe5XB4e0XtOd/w0Q0mS03AWTxtTUFQqzFtObbZ:sT9BuUi55dHbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231935, "uuid": "61c0fbe3-6de8-4c40-b1a4-6f396319d390", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231935, "uuid": "b43f4e8e-352c-468d-a921-b19eb329b03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231935, "uuid": "6dba235a-de3e-4d12-a3fb-214b0f7ed7fd", "value": "njrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f9398b-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261775, "uuid": "db6672e7-c1fc-4dea-9389-4f44a37a1cea", "comment": "Malware payload (SnakeKeylogger)", "value": "b829ac8f09126ed54f2765c9bf41e286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261775, "uuid": "99504444-8a88-424e-a0c6-7e0cb2894973", "comment": "Malware payload (SnakeKeylogger)", "value": "398f31a15a616ea9c81594dc842f26c8a007aa2baf89b384c2c366aefe9efca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261775, "uuid": "998524a8-254e-42db-b9c8-5f39a6a059fb", "comment": "Malware payload (SnakeKeylogger)", "value": "07049df58dc59262804afc162d95b608b3231516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261775, "uuid": "caaf70e7-196c-4a01-8a4f-cf1cc5a4bb3b", "comment": "Malware payload (SnakeKeylogger)", "value": "7f8f13947e0c812ecb150e2101646af7451d0f84d84f2afa7ef099942611a8a962a7df5877c049bbf86086238318b1ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261775, "uuid": "9f0d6c10-d949-4098-9882-f5657cc949f3", "value": "T11CC4AE27ED00702AE9A386F06436B5BABA662F231A84DC1B53907F513571643F6F871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261775, "uuid": "b8242c88-c053-4f24-a6ff-819a4669fe36", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261775, "uuid": "9126e3d1-cb55-4a9d-b146-59217f5aa158", "value": "12288:GENN+T5xYrllrU7QY63YzQ0H2BAyd8d8vMdc6Y/rw:K5xolYQY63YzJHML+OEe6Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261775, "uuid": "7009a335-67bb-461a-a480-b65b19b0b51f", "value": 553883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261775, "uuid": "b581b6bd-8d3f-40f4-9dbc-aef1ce886fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261775, "uuid": "2461ba94-77c2-4c46-8bba-41373dc03ec0", "value": "Halkbank_Ekstre_20230129_075423_612150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39db5b5d-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263654, "uuid": "9f6e7351-9158-4d25-b2db-7fe3e31b077a", "comment": "Malware payload", "value": "f052b1dd8f63c9b79f4b29fc1d1e70ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263654, "uuid": "03e28984-3e63-4a6c-9f0d-6989065e3d02", "comment": "Malware payload", "value": "39fed6ff52d1e711af4f9cf278440b5e1d0b6783a938de0c8fc7e45f41f35b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263654, "uuid": "c90e22b3-7449-4f90-b45a-d37d4102106a", "comment": "Malware payload", "value": "4b107cfc992e9ce3405e462c3a0882ba9f7d7fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263654, "uuid": "eb8abb13-11ba-41b5-a7d8-5486c9fca58e", "comment": "Malware payload", "value": "5599046e91816b47a357f088b7fd0dbf7697efbb6770d11bb93147bd9eb6493095a5695ce6899e8b8e40196a4354c257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263654, "uuid": "3de7e533-749c-422d-9779-91fc6308df06", "value": "T1BE16338D2909948EE213373A174BD378CBB5AE32D21FAC9E0F858686D09DB85D73D584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263654, "uuid": "f4650b59-c12e-46df-88b2-c90a764ff8c0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263654, "uuid": "5168fd14-2f4d-499a-a948-cb9420584f32", "value": "98304:Evu+nfDbw+3PKEK3hiYIY0VdpNz7tgv5jzhyeq3meegP:EvnfDVPKEkhYYW1Kja3CgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263654, "uuid": "6bdf6efb-4516-4277-a95e-5faf9af1a4e5", "value": 4386211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263654, "uuid": "2b7ef403-5554-4c12-b3b6-39139c933cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263654, "uuid": "30a82b9e-e9cc-4ff3-a2a8-60720c19c786", "value": "f052b1dd8f63c9b79f4b29fc1d1e70ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef172686-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675261811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261811, "uuid": "81558335-ef50-4ce6-bb1c-00d24d00baa1", "comment": "Malware payload (Vidar)", "value": "404f4fa730c72aee21c8af1c63f39fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261811, "uuid": "a0af2779-b3a2-4f82-a7ca-a612a8bc5c55", "comment": "Malware payload (Vidar)", "value": "3a00b622128701df9801fb9fc2465bd33a0c3d7ff004333e9fff8f70997dcd83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261811, "uuid": "f0459456-ad28-4e49-91ad-c6047bd40c8c", "comment": "Malware payload (Vidar)", "value": "2e9be000b0b83e4cc0182ca6c892ac4f14988730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261811, "uuid": "5680ce3b-9975-4413-9eba-5ba633cf6c9f", "comment": "Malware payload (Vidar)", "value": "7075ce9f16b1b1f6ed9fe1ce5581cc67824a93f81965f4cb05f4756a89e92ae2a736cec5887f60d2e25b320c916a6f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261811, "uuid": "2976a848-bcd5-4df4-83c0-98950150c106", "value": "T1B2F4BE3D37B664B0C567507D0B708E364ABEBD310E4336ABAFC43D6A9E706906631396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261811, "uuid": "ed7fe8b5-0113-4b8a-8d37-1bf87c7c5b82", "value": "ea3425e7a35fb163de9905f007d5a0f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261811, "uuid": "eb77a7d3-dbc3-4167-841a-d55ab77fd04b", "value": "12288:j/3T66QpF7gpLPRVfl98jAfkrtXuWLtrbSrVOSYqoVJUKXBkc7bIUxaotUd:j/3T66QT7gpLPROjAet+WLtrbSrVhYqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261811, "uuid": "ff8994e1-7f0a-4cf2-af26-02280322f5ed", "value": 731066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261811, "uuid": "7d5b8ea5-3607-48a9-b74c-3307650ba196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261811, "uuid": "acfe45ac-f645-449b-a6ad-6e58128f142a", "value": "Setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57907b22-a25a-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675274441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274441, "uuid": "99080434-aac8-4de2-b0c0-8a0f2650b0e9", "comment": "Malware payload (IcedID)", "value": "36b89900c9300156d4ba6e19742c7498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274441, "uuid": "fed6af46-070d-4b33-84b9-5c9317dc04f7", "comment": "Malware payload (IcedID)", "value": "3a585be7037b0dd24dbc719e8a05d1a1502108bb6e0fea62d6b90980be75a7d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274441, "uuid": "20e42b9f-15d1-41e6-975f-1651523f3815", "comment": "Malware payload (IcedID)", "value": "2c889cf43e2b0e162ddb2ac9567b1ee3507f9f88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274441, "uuid": "306a04a1-307e-49fe-8455-43869a6624eb", "comment": "Malware payload (IcedID)", "value": "61e74ae3e9b06f9f6967ac4606a127e2836a83ded4a5c104553c5afcafe7a46ca928bea280032199161138ab9268c33b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274441, "uuid": "06ea0f5f-4006-460e-a937-d2de06742448", "value": "T1B7E43C1BF7B384BDC52FC13587A3D772A531B8294229B92E1A54D7322E20D609F6FB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274441, "uuid": "c9f819ed-c8bf-4fc0-92b1-ae1f70ddb89c", "value": "fa8d20fda6c8d5b59a65a3d61a9842b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274441, "uuid": "605546ac-a532-43d0-8f77-c4e9925daf13", "value": "12288:o41EwgLoMgUh2W2kRSkWzgVz6iW8fPmniuwiC:XEwgL/gUEW2kRSkWzgVz6l0+iuwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675274441, "uuid": "30ba69d8-4bd3-482c-9e45-abaf700e1940", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675274441, "uuid": "0b81b4e2-59cd-47f3-863d-27ce348591dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274441, "uuid": "a4dbe285-63f1-44a5-8070-5a3739f7d90f", "value": "SetupWin01-02-202317-10-18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26c66b5-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675262138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262138, "uuid": "04a72bda-08d4-44e6-a52b-72796bdb025e", "comment": "Malware payload (AsyncRAT)", "value": "0c3da066f0c04ad78849c1f4a2cfe2d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262138, "uuid": "6a1da117-8f9c-4e16-ad35-c75f42ec3c2a", "comment": "Malware payload (AsyncRAT)", "value": "3a6851c4644a95b51a0dad88d66986afca533a2ad2f9cfb9db7bb29c0164284b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262138, "uuid": "5c8f5bfe-685e-4153-a731-b261973bedf2", "comment": "Malware payload (AsyncRAT)", "value": "fe31f3b33a402c3fe908a647b15995cdd6264645", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262138, "uuid": "6363fe7a-dc56-46e4-a8ce-a203db252fc9", "comment": "Malware payload (AsyncRAT)", "value": "979dee9ecda134d24a3105a9b9e99064dc820b0f6d3e263b6af38e107853c9b0303c4e96861c1da027c17042d20a14d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262138, "uuid": "76bce905-0bc9-4ed2-8012-559f540e12fa", "value": "T1D5A209659BD01922DA3A4A35E9B09302DF31B7635A63C53EB1CC421F1FF5B418793A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262138, "uuid": "1d7918be-69be-4995-91f5-70f85e12f824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262138, "uuid": "6e770dfb-d4c4-4127-98a2-c03f92ddc3de", "value": "192:CXDgrZPf0SKeHfNRB7MGA51mS9nRuczNuczOKnxZRBZHJIYiYF8ur7azSRzdZ5:CErZX0SK05MPjZ9nf7JnThJIYiwfR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262138, "uuid": "bad41164-a0e8-418d-98e0-626e1257a55c", "value": 23048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262138, "uuid": "27adc77a-95fe-4e7a-9546-e3e7e66ddf9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262138, "uuid": "e483d89d-6591-44b8-a2f7-481ddf8ffb10", "value": "0c3da066f0c04ad78849c1f4a2cfe2d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d526e76-a1df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675221489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675221489, "uuid": "03afd020-2350-455f-a23b-341203528502", "comment": "Malware payload (AgentTesla)", "value": "b136f6d348b37f681398fbf206ea194f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675221489, "uuid": "390f2954-3470-42f8-9e4c-1232678b7263", "comment": "Malware payload (AgentTesla)", "value": "3b16d44315327d25fd7fd627bd6409b55c2e9b1af7e365842885ac901832397a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675221489, "uuid": "7aa7f538-13ac-41cd-8b9d-824f880eafe2", "comment": "Malware payload (AgentTesla)", "value": "633fa5ccb3c4d81a75c7f38476856420c912b416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675221489, "uuid": "ef5a2bfd-0b04-48a2-a269-dbc68df95831", "comment": "Malware payload (AgentTesla)", "value": "d5b90da047eb942d09d8caf74b2ad6835dcdef746748d41fe5a5b6935037c1886249e07da1da5e85342f20c1d3e946ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675221489, "uuid": "c215acd3-75d9-449b-a242-b5848293f2dd", "value": "T1F9F42321B3EC6351D6B903FEA903821113B63205A925F37E19EDF3EB2A357514590AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675221489, "uuid": "a4991c11-ca04-40e1-8a3f-580a864fbf0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675221489, "uuid": "e8cb7a48-0162-4c8d-b952-109b1765905a", "value": "12288:EKuMtEwcU3gZ+GQzjkATGdsd35j5XDhkfiWX6MjZwo7Or:Ez6AAgZbQzlGo3vPMmoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675221489, "uuid": "62431e51-cfa3-42c5-ab88-aca1f77e98e5", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675221489, "uuid": "44124fbc-ca0a-440a-b6e3-f84f8cc8a359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675221489, "uuid": "abfaf62a-b2f4-4d48-a149-7eb06624860a", "value": "Curriculum Vitae Maria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193cba5d-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675279061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279061, "uuid": "1e6ca4a7-cb34-49f4-a688-83a935cf4c9c", "comment": "Malware payload (RemcosRAT)", "value": "542291335fd88a387f2160946375736d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279061, "uuid": "cc670e96-2b1b-431b-ad37-e2980235e03c", "comment": "Malware payload (RemcosRAT)", "value": "3bb6ba885f00bf9aeca29e1ecb8d33dfedc620d63868fde4124b623218b4933d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279061, "uuid": "16ed8bf5-844e-4caf-b8ea-498f7fa58909", "comment": "Malware payload (RemcosRAT)", "value": "9ca7b8412cb6ca7b65c46aba436b5cefa55d4510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279061, "uuid": "bf843508-f50b-419e-8c75-bcbcd1b0884c", "comment": "Malware payload (RemcosRAT)", "value": "8e0a15567c62c3fa61aad743b269a4bfd0db78bb0ee540187bd5d30f5bea4ad87203515876cb93b61f694e49663f48c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279061, "uuid": "ad94a865-8563-44fe-9d06-3c3620262ba8", "value": "T15AB42355B28A82C3E591CB700E73D682A6FDE52B5475CF8F17996E2CF8236429F0D312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279061, "uuid": "2bc95fa4-35ad-4c6e-8205-30a0b4d5bdd4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279061, "uuid": "9bce5320-2edb-42a2-8992-c53d4ab10c53", "value": "12288:/Y0cEDTWPuFXFUowb0nQ+7Pv1cO38BoHFhRy+Jjh:/Y0cEDTWP4FxwOH6OsBoHnRZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279061, "uuid": "f0b2a0ea-9eb4-4aca-bdaf-d1d8f5f4223b", "value": 538375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279061, "uuid": "6b86ac6d-e9b1-47fd-a1e5-c73e98f6b37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279061, "uuid": "12b39bcb-885e-4917-a497-1a8aa62daa99", "value": "New statement - 20230138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de856a4-a1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675229462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229462, "uuid": "3cb7b037-089a-45ca-ae6d-73d0ed3d6fb8", "comment": "Malware payload (RedLineStealer)", "value": "f2943a9aafd559728e14dc0f6876e29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229462, "uuid": "c9fac4e5-0008-4471-92a2-be70e8d7340a", "comment": "Malware payload (RedLineStealer)", "value": "3c68bae455004f1911dfc97708822dba591b09018f816d0dabc2280c36565bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229462, "uuid": "4f0bf9cb-beee-43fd-8ec5-7b500b10cb39", "comment": "Malware payload (RedLineStealer)", "value": "a846b942d1b428691df17a4e3cb8b14998517b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229462, "uuid": "a72754f6-00b5-41d4-8d3f-47b7ce165971", "comment": "Malware payload (RedLineStealer)", "value": "ca3925e6d6da277e48a75ff95eb08492a95590bc24b9ffb61df84aef8b956b9efe13582ea5faa1c8158602488ed833d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229462, "uuid": "b5ccfd8a-af0f-4bd2-857b-99ed2173a1df", "value": "T12584BFC276F2AC62F922C6319E6EC6F8752EF4424E097765131BABDF15B01E1C1AB350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229462, "uuid": "1869e588-620d-48bc-8956-38d54d3a0063", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229462, "uuid": "2a3a96ec-51ee-4fc9-ae70-ea2af391ae59", "value": "6144:bXcLnw77iIh5m3xW2DRaUNiLNBLdQHi+7ZX7mqMoIgx8y8M:bMMXlh5cxW6dNg/hR+7ZXSqM6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675229462, "uuid": "7e0af0f1-d48a-4ca3-9194-de820ca4a87e", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675229462, "uuid": "9bf57c9e-18b0-4fb9-99ea-bbacd56cc347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229462, "uuid": "df250c26-470f-45b9-98f1-b7cac83c0521", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1818663-a279-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675287960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287960, "uuid": "8c590238-5ebb-4d25-8b61-5ace3cb15565", "comment": "Malware payload (njrat)", "value": "8c875d52a2ae6452ffe4d3437c916346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287960, "uuid": "44307ed3-1c8c-4ec4-b708-8741f394e19b", "comment": "Malware payload (njrat)", "value": "3c876e9284562cf9374ba6384a2073aa1043c6dd2be0b0fb9d1075ebb9a84e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287960, "uuid": "0516cdf1-b8bb-42bc-b64a-55c6d0236898", "comment": "Malware payload (njrat)", "value": "a8761f0a13f8eb04c8c43820b747340340a896d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287960, "uuid": "08859d5f-240a-473b-81e4-54c9f97e0328", "comment": "Malware payload (njrat)", "value": "7bcce5539c47d5afdbe565dbaa397cbcde41a94d1a824222d31c93eb11a4fbb5848948f4ab7502e9106bf42dc78a92da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287960, "uuid": "bac55a51-a08f-4ce8-aea1-336b3421c41f", "value": "T17C445D96B645C750E47C0932D0DBA97007B1BDC7AB33E68B3FC47A5A29321D36D09AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287960, "uuid": "c619fe9d-6415-4710-9fec-b6bd03fd47b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287960, "uuid": "2abca683-1a3b-4dca-803d-52a3f3c4e974", "value": "3072:4LbY/xvmYCOU2+GxOuyKNLRZqExzUNeFbb1EjQIsUBz65/M6If+3Js+3JFkKeTn:4LpGkKxRniIbbKBxBt25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675287960, "uuid": "c09c2ff1-3c83-4296-b236-48b599df4337", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675287960, "uuid": "19b35ab9-340f-4f53-89cc-73f32e374c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287960, "uuid": "fece0e58-8f19-40ef-89a6-34c5414cec85", "value": "HEUR-Trojan.Win32.Generic-3c876e9284562cf9374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648029dd-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267162, "uuid": "82ab8ff6-3be3-4d77-9921-aa61486d2360", "comment": "Malware payload", "value": "ed22ee48c0ee14f1edbddbabb1e7dc5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267162, "uuid": "9cc63a3d-28b7-4007-aa5b-936937e77e10", "comment": "Malware payload", "value": "3d2f71623a64d46281a96a3ed92fb0edb893e1a4798a2700ea1c1a406fd6b297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267162, "uuid": "abc3bc5a-2fed-4904-acf1-6b25165c1885", "comment": "Malware payload", "value": "02ff5032dee157839a478bfa01e059a9e268de46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267162, "uuid": "4baa63bc-8473-4745-9b18-d6a9fc72288b", "comment": "Malware payload", "value": "bd27661cfb5b971a5866eaee0cfcdcc49f2496e0922d84d8614b22a460278b1fb02ac8625f72e19ff67c9e0bdc8617ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267162, "uuid": "893889ac-b553-48f0-a45d-8ca23f6c95d2", "value": "T188C1FC415EEE50DEF227037027EA737B1562F4B2552E62B870888A589F31BD0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267162, "uuid": "df039d48-c3a0-49e0-8348-7c84239d4a96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267162, "uuid": "7aa6fe55-7738-43ea-9e63-8ad30f9f1a91", "value": "96:F7D79VSCFwxhUq3oTtiNtUqg0otntvngd3ojWrl:F7f9VZFIUq300NtUqg0OgdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267162, "uuid": "0c6ab844-ec0f-46c7-bc15-84d2b8b8f3f9", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267162, "uuid": "296f4f8d-f29a-4d58-bc69-7e5fbe848089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267162, "uuid": "11d5f58d-f860-40ea-bb30-6d71d3fa71af", "value": "ed22ee48c0ee14f1edbddbabb1e7dc5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f9791d-a27d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675289416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289416, "uuid": "059f9c4d-c0c8-4467-bdbf-02bbc1ca52bb", "comment": "Malware payload", "value": "72ca9d265c07c2f0bd6c3d11cf56ba54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289416, "uuid": "0abcb78e-42dd-46e3-b5ad-8ef4fd618614", "comment": "Malware payload", "value": "3d4c5232e237b89a42328e1b2cd25314f2c4f4a18719a769e27246b3c963e963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289416, "uuid": "e419d8c0-d8af-4939-9a70-1b0b28f556c7", "comment": "Malware payload", "value": "d097a40f688a4b1e45069a9b1f11f457ea480993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289416, "uuid": "7db8a0a7-9028-49d2-a4f1-69a1d36767f8", "comment": "Malware payload", "value": "cf7c6b35f506a0715e278760ac63c79c412e4d3cfff05df6707cb3f63047843f12deddd41851e3d78912d14731d29b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289416, "uuid": "2da20fd5-3094-45b2-bdfd-2495c9ac37ff", "value": "T1F57633357BDAC5BDE0A0C8B1DC547BCEA375E1158DBA9237378D426F2D2E280AB13059", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289416, "uuid": "a09e27cf-f186-41b9-b9e5-f5226424443f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289416, "uuid": "bb9f6e41-9df7-4637-a16d-b398652ce0df", "value": "196608:91OxinHRyQ/IvFiMkafIrd4/nxDed06cULcqO3kywoD:3OxbaakdUnN6cscqy9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675289416, "uuid": "7816fd53-d875-4c53-93f9-d755fed9cd5b", "value": 7635719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675289416, "uuid": "68ed4e56-3c22-44eb-a298-3ca53a138ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289416, "uuid": "4399ce2b-0787-4b35-b7e2-313667d2d2f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5097c6f-a25d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675275967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275967, "uuid": "19ed6a7a-764e-4c63-9ed9-eca1d05f9ee8", "comment": "Malware payload (Quakbot)", "value": "8ee03caff6a9db6c50fcd025bc31253c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275967, "uuid": "b0b44853-ce58-4036-b120-dc1959d09191", "comment": "Malware payload (Quakbot)", "value": "3d8559597d0ef5b766b6dcf128f33eb91386fd3a4bfb30609b8401714848af86", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275967, "uuid": "01fd4cf7-493b-4e96-b460-2e13e221c4ce", "comment": "Malware payload (Quakbot)", "value": "13f6844c019fb3dfcec273fdaee811a476ed256c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275967, "uuid": "dda18ccf-2ca0-41af-9217-567345f9425d", "comment": "Malware payload (Quakbot)", "value": "76b0b1eb0b043f4ccf9cb53a967172bb5cbff44d6d028354aff119ba2170f2a0a46360c050eabde723d6cd9dbb034d82", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275967, "uuid": "1ccd0e32-bccc-4697-b84f-8cfcba717fab", "value": "T1B8412594ADB7EC18C6C8B6CADD619414831E8BB3E047961FEE807F8219923E4FFD4055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275967, "uuid": "23aff9fd-1409-45a5-b5e3-5ec49807c895", "value": "24:iZOuxmCiuR9jDypCeBYPC2dQOpQ//BYPeHe83+7zSiRZLRR2sMzYQgIM9iQYj3/a:5C9/KCeWPfdZ4WPe+G+7VRMNKJjcEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275967, "uuid": "f56863b8-5199-41f0-89ab-01c3d6ac1e52", "value": 2061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275967, "uuid": "4227692f-39a8-4392-bbd9-481df3f3c9a1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275967, "uuid": "9aa1ada6-4665-415a-b92d-4f2eec2c6a9e", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa20ada-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675257132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "8f898631-eea3-4bef-948c-b54744d1bfe5", "comment": "Malware payload (RemcosRAT)", "value": "79f47ea1ffef2cbc356aaa87610d9168", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "c629302b-9b6c-44b4-b2f6-73199db4674a", "comment": "Malware payload (RemcosRAT)", "value": "3d9599c4660790e2a9ec335ff9384efb10443eae67d22925697fd30d48f87414", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "4f0351d6-bed6-4663-aabf-331aed2071cf", "comment": "Malware payload (RemcosRAT)", "value": "3dfa9f0128fbcb080f2dd22ccd5917d2d57d06be", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "8abe4da7-8b56-490c-b3b3-02214e87056e", "comment": "Malware payload (RemcosRAT)", "value": "e8d5d4687a99df77f575a27e7a72e9bc755cdb83baf9dbc9513d617848f26222cab581b4ee1ab57dfa596363a631ecb8", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "aadec775-3e30-41b0-baab-12339e81c00f", "value": "T1AAD54C271B2CECF7E6829214D5B2FC4B2BC8AF58C0082EF7A7441D699E96F4132557D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "a021484c-4db7-417c-b8d2-bd89c1a21713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "57c2d7b4-de69-418d-8e02-f336c3f20146", "value": "49152:X3VxHbk7Rv6msAP/RpWY23Y7MrKSmSejpe:Hbr/O/BO+SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257132, "uuid": "c115346b-19c5-45b5-8daa-b75b6fd19dfd", "value": 2825216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257132, "uuid": "c904db17-5754-41a7-a89b-9ffb97e38b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "2ed4e321-05cf-47b1-ae82-ed072f5b362c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d132daf-a25d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675275739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275739, "uuid": "1b108e2e-7ad7-446f-abc0-ca7fb8a25133", "comment": "Malware payload (Quakbot)", "value": "fb7023aae56fff317f65c1e8663f6a0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275739, "uuid": "b3873280-3e45-42a5-a9b5-9b408e05e597", "comment": "Malware payload (Quakbot)", "value": "3de82b2ddaafc7205365b88a5033be0260b97946dfeb10372b9d4c1db7f59c22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275739, "uuid": "4556908a-8709-4528-bcc2-2313701c72f6", "comment": "Malware payload (Quakbot)", "value": "27bcfb8e13b947d76eec119e61a3370915cc74c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275739, "uuid": "5f2890b5-7a71-4acf-b8f5-60ea21f37924", "comment": "Malware payload (Quakbot)", "value": "a907d5cb5f939e862c5f81c0030b0a0533f007e3af5f27d3fa839fd075c2255d54c2a5a72b6a7b31d425b5078af8a26f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275739, "uuid": "f0624ae4-6d6a-4bd7-a565-a4469c6b57d0", "value": "T1E0E49D01EA4399BACD5713714263F72F1739E7A0A43ACBCB9A9C1C29DD139E1B64D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275739, "uuid": "a429088e-09b7-4e55-bea1-2421cd28196a", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275739, "uuid": "991e9c90-f716-4fb9-9a95-803e0aa47c29", "value": "12288:ubjQRl3iZwl3JBrySD9CkkqC28DWl0RJK2LgAN4c1DZx+vaPpsnRlO3+u:uHWZiZCCMCkkbRDeSjcjc1DZUyBsRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275739, "uuid": "f536b4d2-8c7a-4934-a8c1-93fc59ab39f2", "value": 667639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275739, "uuid": "46ae7bf5-fac1-4d68-b330-e346f08837ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275739, "uuid": "7528722b-6691-4542-bcc5-b3f5665e62ed", "value": "index3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9e12be-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257137, "uuid": "438b4041-37b4-44be-ae07-f59b97a4ce3b", "comment": "Malware payload", "value": "5455364b437d431400267a9092d65442", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257137, "uuid": "f5b99729-ec4f-48b7-91b4-4be63f96b3b8", "comment": "Malware payload", "value": "3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257137, "uuid": "46777b25-3093-4e72-93a5-ae40bf0730f5", "comment": "Malware payload", "value": "e34ddbf5ba33ffff8beca910cb17237553f4bfd1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257137, "uuid": "0bb539b5-8557-46d1-8b7a-1af4ff0ec96d", "comment": "Malware payload", "value": "e09ec5dfc885b9ead0846cd0e2710f8fef1f6c50609de72738fbebba78522567919a0ec4195bcf0f23e9d55971c047b7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257137, "uuid": "10ae77e3-d8ad-4b6f-b6e9-14a1c714be91", "value": "T1AE545C26B1899D6ACD63ECB32850D3950760AC265573508271B0FF1FB6B29D38F366F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257137, "uuid": "af964159-13e9-40f5-94a8-2233ae3b5bbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257137, "uuid": "e36f1b12-9df2-447d-9a2b-a4e83fe83237", "value": "3072:wRb49OzAYn3a5O1mgxbnRQW1FkvHjhUfTEsS1yxrxzAycsFQ2D:wb49lQ1mgxbnRQW1FkvAeQxrxzDBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257137, "uuid": "966e06dc-8399-4b57-8ef4-abeccbbe84fc", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257137, "uuid": "2ee37c17-f63a-4b9f-b841-30e50a31bd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257137, "uuid": "edd568d6-f5f6-4c2f-b068-8ad3129f1784", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4041e506-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238754, "uuid": "95192fc0-7714-4d2e-8c82-fab113c74d0f", "comment": "Malware payload (Gafgyt)", "value": "57ba01777e7ffeddf7251e5f4a59b5a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238754, "uuid": "0e945146-e264-45f6-a9c2-8b263bd444a2", "comment": "Malware payload (Gafgyt)", "value": "3f81ed97bf6977fdfa12071e69607b1b4a5c5812cc7da6ec5709554f0bf5f190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238754, "uuid": "bbc5625f-f78d-4aa9-b36e-983a55d73b7a", "comment": "Malware payload (Gafgyt)", "value": "c16747dc010693d1d1b62c901ad99b63815cc42e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238754, "uuid": "54188237-39bf-4e85-8373-16dd3d29134e", "comment": "Malware payload (Gafgyt)", "value": "fbed41c39144a79db8c34f350543d2879c22365ad58ef8004266fc46d16594e0b5120f965f7bcb7b50e449662c587f3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238754, "uuid": "b90bedaa-d3c0-4e7c-abae-71cffa6f70d1", "value": "T141B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238754, "uuid": "ae3bb45a-a37d-4690-9c76-b10ed49ffd11", "value": "3072:R/4tNF9U4vvEKw6J73x8UmkiSFxfKxbXe:BUNFK+E8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238754, "uuid": "570c902c-9a4c-4319-bfb5-2a2c3a05f7cb", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238754, "uuid": "156001e8-1232-47fe-b0c4-58b6a74b6c54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238754, "uuid": "f15f1694-d081-44fd-8d3c-fff9aec72f09", "value": "57ba01777e7ffeddf7251e5f4a59b5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ffc5fd-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675234234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234234, "uuid": "cc043c00-ee1b-49dc-b1a8-72e70da0605b", "comment": "Malware payload (IcedID)", "value": "790ceb9320dc61a4dce587d010687ba7", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234234, "uuid": "3dd439dc-f077-483b-bf20-61ed99a80e51", "comment": "Malware payload (IcedID)", "value": "3fea013a2165df121f9e585b6379ec0aa3215510302c1afbea20d9e4276d6fe0", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234234, "uuid": "25d53254-ba4c-4a26-9080-bb571d743c1a", "comment": "Malware payload (IcedID)", "value": "dddda5ee7edee9905f5e39f35370b0ce07613d81", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234234, "uuid": "e00de5a1-3c92-4240-b49c-d9a0012e146d", "comment": "Malware payload (IcedID)", "value": "3e7dbea401f7eb9b4122d312057a914a413db2c73c15a70522b16a48f130dca18fb359cbac9354f2064c4d671c9e9951", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234234, "uuid": "618757c2-719b-49ac-87bc-09f47f7e31c9", "value": "T18BF09E1575C667F101658A77C900C9E35C5980B74030F5457829F0494F1A4E832F8BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234234, "uuid": "f3359710-c447-44e7-b5db-82fd92e5864e", "value": "12:atSKQHwh9uSkzg/0hngNlSD+KIKGpO2IS1y4XB2X:UIwhMSkE/0hgLSWolgJxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234234, "uuid": "c7c9b577-b88b-4a24-9bd2-7302828aaed5", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234234, "uuid": "084f655a-98e9-42af-87b9-e8233fd846c7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234234, "uuid": "e6218a20-9d28-4df4-8896-f01871dd2ab7", "value": "STYRACIN.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d18f205-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264196, "uuid": "4d08141d-bda8-45f2-ab7c-dc481b595e8b", "comment": "Malware payload", "value": "4423f8c50e36b2a7f12d78901d2d0575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264196, "uuid": "534d4e9b-1c7d-4deb-892d-73f41edf31cc", "comment": "Malware payload", "value": "413548b9516a8970e9863e6605116ec5e13853d259bdb33441c47c0c07944d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264196, "uuid": "1ae8d100-dffd-46f8-b4e8-a91681992c11", "comment": "Malware payload", "value": "eac2e6ed3b042297d466afe5f54f9ea4568c86e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264196, "uuid": "67c4f583-8b2b-4379-b54d-a6032f6a81d6", "comment": "Malware payload", "value": "87019894db01ea9ada4d6ebf15c999aea6afd2f8b87c378c0f57faee05d5f508f7de919ad9708bea0ffbb7f6e3ef85dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264196, "uuid": "e3cef439-1504-43f5-8c7a-b4bba442a453", "value": "T10425E73D96765ED9C334F57182E08220BA9D6D4A2703E9999ED636C00F32EC27DCE51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264196, "uuid": "aa8386d6-3f73-4c29-9fa3-330cae82dbf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264196, "uuid": "40383e81-a2b8-4e07-b42e-909f81a2a78e", "value": "24576:+TwU7mjseHKNTn7tunA+/kSDWMfmBm8S1noB9rNgWXoqhy:+TAOCsNgaly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264196, "uuid": "18312c38-e613-4eed-ae9a-42ccc1522dcf", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264196, "uuid": "b0b8c0e3-9bae-4b97-9b0a-e7c01a708998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264196, "uuid": "2bd15653-e140-4fd0-86d1-9591ec77aa37", "value": "HSBC Payment Advice_03604739066_01_02_23_T7_03.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f893c5-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675267589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267589, "uuid": "e8a361cc-3efb-4820-bfe4-e1258e6e3ecd", "comment": "Malware payload (RedLineStealer)", "value": "f6f0195ed720b27eb5ac065160c3415f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267589, "uuid": "81bb5706-df2b-431a-992a-31a1c9edb1f1", "comment": "Malware payload (RedLineStealer)", "value": "41fa0edee86cfc72ac4bb3628b3773269038ca1227fe3abe88b878e39c4fdff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267589, "uuid": "a3c97bdd-382d-48e8-8aed-b488093cfc6f", "comment": "Malware payload (RedLineStealer)", "value": "d5c1a162ab9338712c94eeb11cffa014da3691fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267589, "uuid": "d54e2be1-5778-4ba7-8b49-5a12a2ad4de1", "comment": "Malware payload (RedLineStealer)", "value": "76331cbb2ca6cddaa90b9dd8c7483c1531d5e2efbf24d5469859d2341c3ee05486c5143315d660d0958397006f07c01d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267589, "uuid": "872b415d-93ce-4e6b-8162-9eff3eef24b3", "value": "T18C74F13279C0C032C57640709934EB99B7FEB4312935991B77A817BE9F706E1A23A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267589, "uuid": "2e3ed57f-dd4c-4af0-8c3f-4b467a1020cc", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267589, "uuid": "ffff0fa0-5325-4d63-8dd0-f5f4f3f2fb1c", "value": "6144:aqIvUQ9LRMmdqzKCUIXBOJgCExUfdejYRow9r:aqEU89MmlIXBOJgjDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267589, "uuid": "22238c46-0c04-4b3f-8b51-7e8661150c9c", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267589, "uuid": "13f26fe5-f1d3-4ee9-949c-ef99a45811ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267589, "uuid": "1d4934d7-13d9-44ce-9ab9-4911eb5cf16f", "value": "f6f0195ed720b27eb5ac065160c3415f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab562200-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675259120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259120, "uuid": "191d19f5-d6e8-45b4-a326-ccd7f5f833d6", "comment": "Malware payload (Formbook)", "value": "a60e86a939aadc05535fc256edc5163c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259120, "uuid": "9d6143d8-ebfc-46a9-a4c9-81de3c513e59", "comment": "Malware payload (Formbook)", "value": "428aee241022499cbd49907635162f116e24792b117490949fa3527dc130b90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259120, "uuid": "6200dded-77cb-4786-8bcc-c418fd8f73e9", "comment": "Malware payload (Formbook)", "value": "dd5dfa51de889e30ee6de627e3b94c11c79d3760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259120, "uuid": "84a0007c-383c-4ab3-836e-846059f0853c", "comment": "Malware payload (Formbook)", "value": "c994c2c17bf50509682bf9735af134fb1af57dfc1ff1bfc69a365b60d840a46d33b201f416defa20b938ac7671445239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259120, "uuid": "a9dfa5c0-1d5d-4411-a28f-642fec5032d2", "value": "T169D423B66FB1F063DEF212338D3E949664EE6E111546CB5F23200868F6F8991CA1D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259120, "uuid": "e7013eec-4be3-404b-b334-1d3db314584c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259120, "uuid": "9b910c7c-99e5-4cca-a199-32d9de2827bd", "value": "12288:DYeaKLMI/z1JwyY7EoYZ5+s7rfP2INg7KyynVcua:DYeHrhGyY7Edmgb2J7KHVcua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259120, "uuid": "8aa8e47f-2f0b-443d-b416-88f2a622c87c", "value": 640778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259120, "uuid": "9059e8e7-4028-4e5c-974a-a4414ac4a480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259120, "uuid": "9d32fcc1-07c0-4e23-a609-0e8fed47ee98", "value": "6014853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b9a11-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675261939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261939, "uuid": "a336876f-ba64-434f-a5a2-28fca85f7e58", "comment": "Malware payload (RedLineStealer)", "value": "07379039e196629381d7035c171f1bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261939, "uuid": "b2ab1c16-d867-4810-a915-2b906903dc6d", "comment": "Malware payload (RedLineStealer)", "value": "429b2d7773bebe16d0ab8417b12021ab80215cd2f9e5f1de54e720012ce8f673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261939, "uuid": "eda9930d-a75d-47f7-a628-bd0726898833", "comment": "Malware payload (RedLineStealer)", "value": "d9f221df64db9b80a9d49796f091b90bf61bfc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261939, "uuid": "7108b7ce-4bc7-4a23-9c57-7f99d10e3481", "comment": "Malware payload (RedLineStealer)", "value": "72f8a4b6f4f3aa38e31b6ecca6ceaf3d17607753769a7f11d0c40066c3f4fe1e11e0118a7baead7f89c7c741a4dae6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261939, "uuid": "28383de1-3af2-49e5-8a5f-1de90e6d933a", "value": "T19D74F13279E0D073C5A64070A820D694BBBEB431563A4857BB9937BE9F317D1A73630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261939, "uuid": "486c4fea-1e85-4dd0-a7f2-ac06ea97a94e", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261939, "uuid": "03a97f0c-45d8-4e94-8c8d-f7c029463153", "value": "6144:SqMYD6LOFVP91Krcq2ys0xDxNgewDSdkiwM/rk:SqTeyFVPOrcq2ys0xF0GdHwM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261939, "uuid": "5e0771e8-88d8-4303-977f-0e29f2075e7f", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261939, "uuid": "280132ef-5939-4e87-99d0-3ca96e56254d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261939, "uuid": "a32bd0aa-f897-4104-af52-9287e6c2bec4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ce6be3-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675234202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234202, "uuid": "09c3807f-6229-4bce-9c41-e5ef96d840bf", "comment": "Malware payload (AgentTesla)", "value": "c4442bff6152a23ecca4ae0803e28211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234202, "uuid": "d829c541-1445-4b19-aa45-f2214b89c3d5", "comment": "Malware payload (AgentTesla)", "value": "42bf7d3068212fcc28e6642c1bd4194772639fed9e0eb6636b1c2fbd3048f2ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234202, "uuid": "15286312-fab0-4521-bd6a-6027a634cced", "comment": "Malware payload (AgentTesla)", "value": "be5bbb0591479ecf98f6780ab512f33a0d5b285e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234202, "uuid": "88aa5624-59d1-4ff3-b07a-e45613e8d0fb", "comment": "Malware payload (AgentTesla)", "value": "c665233c3b8f0c8e9f2b22a56f1512bf484e37638024113ea86ebcf65aeceeb4a951158d6cf854c21b5abda292a70d8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234202, "uuid": "9e7ec79a-9ac6-4631-a128-b33c92129f05", "value": "T10105BF11B1F2A0A3F48744B690357ECD2C20B213AA91E72726767A90671EC7F7FC47A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234202, "uuid": "04108674-a293-4927-9cd8-5727a4550cfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234202, "uuid": "fa81caa0-a112-43d8-a126-aa27bbd2e6c5", "value": "24576:eJNxRpcconBuOhjSXXkVUANWjdk0ZNwxlhdrv/gg2:FVtWq0O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234202, "uuid": "be2ac297-cf6e-45b3-87ec-083cc4d2aa07", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234202, "uuid": "12c8f844-dc6e-4e31-bf3a-980e6337a0c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234202, "uuid": "34f3c7cb-f5e3-4d01-86f8-d4e50800a1ce", "value": "PURCHASE ORDER AVIXCOM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc3b27e-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675256091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256091, "uuid": "2ed2d348-d536-4680-a2a7-2abbf0909be7", "comment": "Malware payload (Loki)", "value": "2c11edc3f8bf5a2518db6f5398d8fd3c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256091, "uuid": "6a4c96b2-97b2-4449-97ab-c341cd985a16", "comment": "Malware payload (Loki)", "value": "42d09f47aabd0bf8dadff01cd1de42d3791912bf2e215ca3bf0f668d47f31ecf", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256091, "uuid": "e6126a76-0c6a-41fd-8092-4dca4770ff00", "comment": "Malware payload (Loki)", "value": "b149cf0b9157bd4d394c63566cdbdca87d27ac0c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256091, "uuid": "e49786c1-c93e-4720-90a4-20fd5a6886f6", "comment": "Malware payload (Loki)", "value": "779307dae1a1922cb594ffd1c05550a61d5973a8f29b6258718541fccc6a7f7c04672c6f3cd64c61dd2f7455ddf5b6a8", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256091, "uuid": "68ada509-412c-4540-94ae-1d5e13e68ce7", "value": "T14FF4398137F19462F0DB05B91028768C1E3D7443A6E6E2665BBB39C49743AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256091, "uuid": "816ae66f-c2a7-4b2c-be72-3075d5cf73a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256091, "uuid": "ba0b3f0f-08d8-45e1-8766-001058e0230e", "value": "12288:Genair6ATCjXoxWofAr8z9i7+pvhc4N34p9:Gena67fAr8zw6Rhc4N34p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256091, "uuid": "b5bda568-8547-4960-aff5-61bd2ff3b96c", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256091, "uuid": "2399ff6e-1437-4310-9d70-0c627beef337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256091, "uuid": "b5d28f47-8466-4e5e-b499-fc3a1c9965c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae20a646-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675264279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264279, "uuid": "3ba10725-ab79-4397-8188-c4d0eb070e3f", "comment": "Malware payload (Formbook)", "value": "52ee443e436f545deefb870c12eb775d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264279, "uuid": "e318a2de-bc85-4907-bc7f-8f42413c956d", "comment": "Malware payload (Formbook)", "value": "43dbcc71737c54b9bcd7f5cc12d2f3d332bf8ca7e80f594725230c44614c5ab9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264279, "uuid": "35231bd7-accf-4589-8c71-58518b4527f7", "comment": "Malware payload (Formbook)", "value": "7a95ad8fa7d8a29bd3f3021ca397b694cfdf5a6d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264279, "uuid": "7b82cdd4-55b4-4f59-8cf9-8a80a04bcba4", "comment": "Malware payload (Formbook)", "value": "93a4711bdca8813469070bc9d2efe55b63fd06f29a2316912f04a1b606c312fe21111bd841265dd012a9b2629adfa5d3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264279, "uuid": "9d9c7e3f-36e2-4556-b56a-310dc9095009", "value": "T1444412AA30E9F8B1E62C277200CB465507A075BAF543641A59DF362CACE73FC64FE844", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264279, "uuid": "eccb11b2-480b-42f0-8d6e-06e1bb01e39c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264279, "uuid": "27c9f816-5c18-4dad-8aa0-4256faf28ec3", "value": "6144:Cnfq8hGUQO5EZthoSHF/PqCXhRtsWVpCHpHopWNpinuQwe524/UJHJpsXO:AC8hGUn5EZtX/PqCxsWiHJlNuwLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264279, "uuid": "bb94960c-77f6-459f-bd8d-e91cdae08a23", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264279, "uuid": "f1bc0234-e291-4a5c-81d5-b5d78791694b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264279, "uuid": "1dbb42cf-db30-4cad-a426-01bfcbcc9b8b", "value": "DHL Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db700fc1-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675264355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264355, "uuid": "21d4b507-1236-4aa4-bbab-b958efa4c6ad", "comment": "Malware payload (AgentTesla)", "value": "3d0a93057793efef0c46b3548092097c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264355, "uuid": "d040d8c7-6193-4771-9432-ba1282275394", "comment": "Malware payload (AgentTesla)", "value": "43f40a78d3e447655b12c956bcbd64540d19f774216858dfb0791cdbb492ea07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264355, "uuid": "37c05889-a9cd-41f1-8ec1-9d73849a8115", "comment": "Malware payload (AgentTesla)", "value": "5f794fc15e991c2e5935c47b9eb069400ebf2054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264355, "uuid": "456c7717-fa19-4a5b-a6da-5818d7f74953", "comment": "Malware payload (AgentTesla)", "value": "8a4590132efd830aa9aa01b65b0af635b9b5e30d5f1a339c260f4dc6f9b64192759dd8238c3a9d67999e0beefb00eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264355, "uuid": "b196af97-8879-4766-9464-e7fc8e58b709", "value": "T16884E25038EE520471F65A731F8BFA288B3735D2A5399E3880CC26199FCE4858DA57FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264355, "uuid": "27d19252-e925-4992-8c8a-0d0d8f69be97", "value": "192:fQIov4+++++TI+++++S+++++u+C+++++B+++++oRUAzHN+++++o+++++o+++++oG:fM26UjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264355, "uuid": "de63d681-944a-4d13-9bf4-103c3520d9b0", "value": 406308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264355, "uuid": "7af904b4-779c-4bb3-a1c1-7d774d09c758", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264355, "uuid": "19e403ff-0553-40d3-b703-a14b30a72a67", "value": "MT_26009786_45342023_TXT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636ecc9a-a213-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675243967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243967, "uuid": "06e7d063-766c-4a2c-a966-d834f2789c0b", "comment": "Malware payload (Smoke Loader)", "value": "5b82951e130e62cdd1ffe83c173c5577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243967, "uuid": "a8290bb9-978f-4f65-b139-0cb77ddf1e8f", "comment": "Malware payload (Smoke Loader)", "value": "44f0fcac8ca299ad3ab499d5b80c8f5990b45b0d5d24d7fd518249ed1760ee79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243967, "uuid": "91dd3f70-66a0-45e9-9b65-b4f59020cf39", "comment": "Malware payload (Smoke Loader)", "value": "ea6d9f216a48d4d11ebb9026d225ba3a48cda3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243967, "uuid": "3d885ce7-2f24-4994-8684-a6f5db2e428a", "comment": "Malware payload (Smoke Loader)", "value": "c521d941e93664ad8addc8c52cbe5f15460121916018baecee15bae26d37d75cc69533030c9f5d966d5afce026b5dc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243967, "uuid": "75b55060-a483-41c3-9be8-2f2e14c0e9eb", "value": "T14934D0323580C073C67E50309C34EB993B7EB5311A75955B7BA81B6EAFB06D0762A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243967, "uuid": "d36891f0-6ef9-4ceb-9476-44931238a15c", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243967, "uuid": "69720f2f-945d-41a9-8ba1-edd26ba690ac", "value": "3072:168GrmJ3ObR/eLmvWZ8J5iV7nn8h8rATMhOTX7kB5MZZaEtHc59:1689yRGLmvrm/ATMhOXwBNkHe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243967, "uuid": "12fd16ae-87f6-44e3-9f26-7d6811587708", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243967, "uuid": "89127a75-b699-4e9c-acbe-6aa1bcd2401c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243967, "uuid": "31334b4d-7855-4ce4-b362-3b9d184985f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68542ec9-a25c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675275328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275328, "uuid": "cbe0d248-b90a-4058-99fe-28d8549acf07", "comment": "Malware payload (DCRat)", "value": "794ffd3f15df798c9e24967d5601fcbc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275328, "uuid": "04ab2d17-a50c-4718-bdc6-9048b638466a", "comment": "Malware payload (DCRat)", "value": "4521deeecaaf651beb1282125e70cfe8deca459bd452781f55260988895b701a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275328, "uuid": "c18927af-fb1f-49cb-bcb9-29958da0e156", "comment": "Malware payload (DCRat)", "value": "f601c2975a798b045aee9e68719b36ae8da01dae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275328, "uuid": "cdbf094b-5e89-468c-a5bd-210fff3f0d4e", "comment": "Malware payload (DCRat)", "value": "e92579fbc4d02a51036596cf21a4a5ed4a81ac31b8afb180eb385c2651507ac481da61d59b039fdf9f206ad33a9fc70d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275328, "uuid": "2d959ea2-316f-4846-8420-6ef4dd601bed", "value": "T15A555B12BA0ADD02C0E92E3BC9DF45240BE8BD417B66D71A7E5F375D62163A70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275328, "uuid": "701b6436-c20f-47f0-8a24-35d51f729a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275328, "uuid": "c809caba-324e-4cf8-b9a2-b67eb718d1ef", "value": "24576:/PLoxXw1dpqthRHHyJVnZBAQcNDAjAQbCjO6F4//PeSh+4:D1LqtaPZ5G2C6E4H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275328, "uuid": "09f359de-47c4-4753-91f5-16a582f8276b", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275328, "uuid": "5153accb-2ff8-4a3e-932d-9a37efda0fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275328, "uuid": "4c353499-bd0d-4bdc-a7d9-b60d0e52cd77", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-4521deeecaaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84949792-a1cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675214817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675214817, "uuid": "aef77598-fc65-4480-ba75-13acdfe574e9", "comment": "Malware payload (Smoke Loader)", "value": "ba61f8ddaf103fb2786f0531e7032d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675214817, "uuid": "9404b25f-15aa-41ae-b395-5d0662cfc006", "comment": "Malware payload (Smoke Loader)", "value": "4587a2ae3c826cf7fc539f52987ba8f7356068e41888fde9d07e2d5cf8f39314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675214817, "uuid": "eefaaf48-a02f-4735-9e90-76cf5d1783fd", "comment": "Malware payload (Smoke Loader)", "value": "9ceb2377137eae0354371bbd2823c75b67fa24cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675214817, "uuid": "a8de0b78-6433-417b-82bc-c04cfc05b5f8", "comment": "Malware payload (Smoke Loader)", "value": "ed4e1ec8805d69ab8ed0d763e94807f70de1f8fb3cb7fd36f1ac55b0a4a89630a6ade5bcb66eb00dcbdadd0dc421d434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675214817, "uuid": "64c4031c-aedd-4bf7-96e8-2c7bb0a43704", "value": "T178548EC272F1BC62E9328AB19F1EC6F4761EB5424E096766221B9BDF35B01F1C1A3351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675214817, "uuid": "35516317-6464-4e30-97aa-f19757b7cfbc", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675214817, "uuid": "26bc2bee-9672-4d93-a7e6-ec00d085c7cc", "value": "3072:AgB+ew+LLKsRcw73CV3LQprGSyGdXHhqUDi61OUxVQSdgSmqPUx6WfQz86cZWfb9:2ew+LLuwbCmpxVXpbgSmqMoI9ZYb8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675214817, "uuid": "3737da3f-548b-4d0d-88ff-ff18ea5f0c55", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675214817, "uuid": "62c785dd-39a0-46c0-9d1d-1a758bf75688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675214817, "uuid": "0da687c5-84d6-451b-a078-e54c9511c0f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f82c9f-a21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675249150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249150, "uuid": "8c89c34f-ac64-4567-81f8-1c395421d72f", "comment": "Malware payload (Quakbot)", "value": "19c50bc5569c814059b985f0792b166f", "object_relation": "md5", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249150, "uuid": "473f5218-9750-45c9-b464-4e1930309dcd", "comment": "Malware payload (Quakbot)", "value": "45bf8b0432b64358aeb24827eec92a4556c9e91d80bfba27b2227f68fdf19147", "object_relation": "sha256", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249150, "uuid": "11fc7460-f295-4d74-9bd0-0b0eb8a9f6b0", "comment": "Malware payload (Quakbot)", "value": "95b742f26252ff88abdcb26fac218e0bee107153", "object_relation": "sha1", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249150, "uuid": "0b2a9237-b4f0-4304-a377-bc8579b2240e", "comment": "Malware payload (Quakbot)", "value": "6104c09dbfa12cfe4f7f0dda430b5fff4b3d0487cf96c0f4e71c560227e6cff63715ddfc828ba01aebb608bb9a458585", "object_relation": "sha3-384", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249150, "uuid": "1c9ac6db-d406-4303-91c1-dd34ed5e0707", "value": "T14E41DCCE5D721A7C897D4BF37EAAAF944314CEB0B06A6A31B145110203D3AFA1943368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249150, "uuid": "833edb35-c4d5-4f7c-a3b6-e7e805ab80c1", "value": "48:hwJcdcqWlQOM5kptqUnhJ5uY7bDykdBvvNCPeOMkywkmmVl:hicdcqWlVM5swZAbdBviSkywk9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249150, "uuid": "867c4dc9-d3bd-4087-b888-7e3d77d2f3f0", "value": 2240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249150, "uuid": "2f5c0e31-4575-4e70-915a-b645d4954f3c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249150, "uuid": "06aad1ab-b4b7-4cf7-a37e-9bb3ef3ca77f", "value": "drop.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dbff58-a22a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675254066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254066, "uuid": "3ee6a6ea-a450-41f5-a8f0-623e69e952de", "comment": "Malware payload (Smoke Loader)", "value": "4924c02a3052431d4327bd81df5a398d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254066, "uuid": "4f9e52d4-ffb8-4477-9a46-25c59d164118", "comment": "Malware payload (Smoke Loader)", "value": "468812af3548654b056eda21649cf50c71afcda8c72f68b731c837207842eea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254066, "uuid": "3cd5a8bb-9a52-434e-b505-ce1735ffacde", "comment": "Malware payload (Smoke Loader)", "value": "65365d41d999d27921f1f3e4b4af856f91c15e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254066, "uuid": "0612daf0-6b73-41e2-a05f-06ad419e73a9", "comment": "Malware payload (Smoke Loader)", "value": "5be97dbf0e15dfd9ee74b9a311d2c2d7cafbcd8875f192b7627418c8a680a1f28e455fa8e64679f1533d36eceea75236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254066, "uuid": "fa7e9f56-a589-4be1-a9a8-ea41ccf623b7", "value": "T1AE34DF327680C072C5AB50305C24E7D57BBEB5326976590B7BB80BAE5FB06D0763638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254066, "uuid": "3946204f-1273-459d-9fa8-570722a82bb9", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254066, "uuid": "0276c374-0550-4d5a-820f-f7b817f16b85", "value": "3072:ZSjGPANiKNfawLg4hWwN5jBDMsG3OhPk7YqBojKwV0bXk7iLaA:ZSjaYfVLg4hxjBDtG3AvVe9LaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254066, "uuid": "ee84c47d-5d2c-422c-aeb7-ffab129e5c7b", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254066, "uuid": "c4ad4e9d-802e-45e0-bf7e-88525f232afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254066, "uuid": "5ab65e9f-4e3d-49db-a440-f4c7f8b67151", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f68cf1d-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267153, "uuid": "813e28dc-ad2e-49fc-bdb4-aee9d40fed48", "comment": "Malware payload", "value": "d7f8019fa6a535bc1b0b7f9fc1f751ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267153, "uuid": "5aa8e780-5540-4abf-a033-478bd6ff5aab", "comment": "Malware payload", "value": "46c6ffe88a3541f179da56eac0d6649fe5b20b561a43793bb7b5c1b8282ad4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267153, "uuid": "df00c1bc-18bd-4e7a-a0d0-7e59fa6b0741", "comment": "Malware payload", "value": "f496986f7a40c0a9ef35c950f48522faf7d403d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267153, "uuid": "473c8e33-3fb7-4058-9922-1131053a8e5f", "comment": "Malware payload", "value": "7ad4d276b41ee7fd4c64bd17ef1d3a90533fff2810f00da54db7b24c26bc8cc5640ce65f06d1e908c9b4efc3bda30c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267153, "uuid": "8d4a47c8-1f60-473e-b098-49531d2ecee6", "value": "T111C1E0015EEE50DAF23707702BEAB3771666E8B1552E62F874444A589F306D0CC62FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267153, "uuid": "3f315edc-54de-4cf8-b108-a6fd0cfe2e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267153, "uuid": "951ae382-25b7-4dfa-9572-9f7b85ef7d5a", "value": "96:cHkI5797fCFVwiTVtowwvk+dw78bC/+PGc7Y3d3ojVrl:WJ976FPVnwvka+8bC/+Pg3ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267153, "uuid": "96e18136-080a-4499-8ad5-7e18d2045217", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267153, "uuid": "35a93abd-615d-49d9-b31b-c21ebdebe1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267153, "uuid": "ba44b200-cf44-4dc7-9196-4931696159eb", "value": "d7f8019fa6a535bc1b0b7f9fc1f751ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3139e1c8-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262781, "uuid": "c8da6cae-a8ab-4836-964d-4b209061248d", "comment": "Malware payload", "value": "585dc08713bd5c4993f82372fab19124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262781, "uuid": "c164935d-ac84-44bd-8c2e-9d14a0366db3", "comment": "Malware payload", "value": "46db2cb734082006aa792fac99e35f17a012b0ca0d530563d5fe2a2d30a996b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262781, "uuid": "32b77d7b-2d65-4f1d-a5dc-9e335e94ebef", "comment": "Malware payload", "value": "169052f8e80bf3858f8b744a2a591622b64fbf91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262781, "uuid": "e4138298-f404-43dc-ab35-4e61852454d1", "comment": "Malware payload", "value": "ca8a49b4d5cf8e7ff8d671d555a72131d80ab4abd2dcc366152a790c37bc57425cb0f5a69becb5c03abb15512d0e9ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262781, "uuid": "78e1ac4e-b756-4368-b482-866c738227a6", "value": "T14B55128DB3E604F9C41BD23A8AC69625E2F3741947B443DF57248B769F0A7F2263A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262781, "uuid": "008f5486-8ab1-4736-8fef-0462843110ca", "value": "edc6c3de5dcea9514b11905219670b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262781, "uuid": "a94349f4-e27f-41bd-bb84-14c144982c5d", "value": "24576:SlxObwiWk8Ty80JGTom2s8iQ+FVu1YteAqE9DpQGjl314ZD3bQ2jgcMFS:SlgwXm8PMEb5F4IeAvUGhF4l02oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262781, "uuid": "8ce6d92a-aee7-459f-8a23-60f2eb2c5b93", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262781, "uuid": "7ccff1fe-81b8-4228-be12-c81d7e0b0604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262781, "uuid": "16d7a9a2-4ccf-4a87-801f-62b9b0fa9381", "value": "585dc08713bd5c4993f82372fab19124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf04e8d-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Emotet)", "timestamp": 1675232950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232950, "uuid": "249d47f5-519f-427d-a15a-b50f39ffeaab", "comment": "Malware payload (Emotet)", "value": "f2442d7a1fc6818f9ecd8e6c934262b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232950, "uuid": "2c4c170b-dcde-4ecf-a8dd-462571fd645c", "comment": "Malware payload (Emotet)", "value": "46e5089050d2af12f462978cfcba2f4074ff3e89e801926f69206e9ece8c04c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232950, "uuid": "4b566d3f-a853-4974-986e-eea7edc0fa1f", "comment": "Malware payload (Emotet)", "value": "4718bb8430dbdb90a140f8dbe80be7ec97c3d327", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232950, "uuid": "1cd7a19f-ad57-423d-9f19-bff66c3d13ae", "comment": "Malware payload (Emotet)", "value": "7b77d9c3229088978c489b4d2f652b3e9696e16da3602c12cd484b2909998e9ba480ee03739ae02939ff869a10fc3cad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232950, "uuid": "daf7a99f-545c-46e8-b6ad-eb910408c423", "value": "T15294D7AB3A8FA1BDF17B01766350FB05E0D2791A9FBD29D30A8B658893F2D054F18D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232950, "uuid": "5843bcf2-2e18-489b-a498-84b7a91b58ef", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232950, "uuid": "6f8c8638-ac3d-4ce6-8ec6-89ae09b63199", "value": "6144:l4Wk8rwFPwjqEiEGA03mKh7OyAjYzqlm8HNbVNH60:l4WjRiEKWKhqyuYzqtNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232950, "uuid": "47ca189f-d9c9-46df-91d6-2f92e9a7befd", "value": 437060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232950, "uuid": "6d338903-b601-4c89-8b11-c4fe0876c2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232950, "uuid": "dfb0b6c9-29bc-4c94-a2d8-ea0b3694bd8d", "value": "winword.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb44361-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675267363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267363, "uuid": "55d5b13c-97e6-4ca8-a81e-4ace754b0fff", "comment": "Malware payload (Smoke Loader)", "value": "13725d57e1ba5d0feaa5b49dad3c5c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267363, "uuid": "d86ed98b-33f5-40b3-9525-38b07af11195", "comment": "Malware payload (Smoke Loader)", "value": "46ffc3270732b5773857df73a57f5dbf1250c26d9f8d81dc9effc797cf004234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267363, "uuid": "e0cd6b78-389e-4199-adeb-9c44e670bbc5", "comment": "Malware payload (Smoke Loader)", "value": "cffc84279bdd51c4a8c495cc0fea9645e60b6aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267363, "uuid": "c7a75932-2b0e-443b-9e36-1ac615c1187d", "comment": "Malware payload (Smoke Loader)", "value": "8950e03800f98d0de12b75596dfc6ec21337790aa241a7d58604f853278660b0551ce1ea7c18006f8f1bd78915687a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267363, "uuid": "ed797698-7a6d-4b8e-be1c-16e70b415f1c", "value": "T1DD34DF323990D073F277D0305834E69B3BBAB4315935985B7B981BAE9F302D1267A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267363, "uuid": "de7a79d8-5d72-4321-ba24-1c8698e72372", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267363, "uuid": "c7e8bf6b-d7ad-4d1f-a0b6-a0246983e413", "value": "3072:2mjGP/0NKaxkLukOWIzr5yF8wyYpr4rUaPQHl1Z6iDRxV1/Huas:2mjtPuLukORzM83YprV3/Z5LVxOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267363, "uuid": "c6e6e63e-6199-4802-aed6-1e0c9a9feef4", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267363, "uuid": "64ecd484-6098-4c83-a4e1-402f9ff9067e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267363, "uuid": "33b11bef-29a2-4679-bbee-f590a7e4564c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fc0989-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675267008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267008, "uuid": "c9e27068-b1f3-4a3f-a958-fbb5046c0e7b", "comment": "Malware payload (CoinMiner)", "value": "311e42202f438d9158bc923ed055b66b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267008, "uuid": "861d0af6-c4fc-4fbb-a603-75eaf62c2ae2", "comment": "Malware payload (CoinMiner)", "value": "47c2dff9db0c820b52c1937b62a4904889ea1d2a5ab183b7d054da670a1893f4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267008, "uuid": "a425ac5c-8d67-4e44-af82-bcf0ba742ada", "comment": "Malware payload (CoinMiner)", "value": "821ef3675261c08270ac35f5afdb7e40f91ea38e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267008, "uuid": "94465f01-10c0-4c4d-89e7-e2b9ebfee771", "comment": "Malware payload (CoinMiner)", "value": "5a074a8d3092a510a4beb6de71349cf5f3135d49be4d8a406f4ed33c153fe68c53a9a55e7ef8d92c1ff02eb43878e37a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267008, "uuid": "0c16bc77-0c9c-4a72-bb75-9d9723f1945a", "value": "T1C9E5FB1D77B9DC34E406A9BBC6A185B2D506DC31E923CA5B3548FF98B436FA012F1386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267008, "uuid": "95a5a023-2bf5-4711-99ee-ee5ef23bd0e2", "value": "39111a6d1881228ca60c7dfcba351926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267008, "uuid": "a9c9f35b-21df-4f0e-8fb5-0708622708aa", "value": "24576:aEMUEIY3GQgmQUnQQQQQQQQQQQQzQnt9JQz07uH7GW1WRazAock2FE:aEMUqUQwuCW1Mxfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267008, "uuid": "6af9ea20-cbba-47f1-b0cb-25ea8792c59e", "value": 3257344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267008, "uuid": "c5f95119-7a29-472e-86b4-0955cf42903f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267008, "uuid": "a671002a-2320-4244-a3b8-580141f4a0da", "value": "311e42202f438d9158bc923ed055b66b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcf605b-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293430, "uuid": "14866ccc-d473-448a-9a74-a9a78cb88ba8", "comment": "Malware payload", "value": "84f0f3490acb0a861ce0cf97be914eed", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293430, "uuid": "2e2fab5c-855a-4fb7-b437-5e68bd551f0b", "comment": "Malware payload", "value": "47ed3c1001783f740ef0d6ca84b1d627b3e02fc6e5d7dd212fcf99da680b07da", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293430, "uuid": "25e43e5d-b05b-45ca-a5da-fcd8691bde7c", "comment": "Malware payload", "value": "b6bd159fa1fed38f5879ebb33800dbad28f4e40d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293430, "uuid": "74863568-9ee7-4a35-9a16-6ad4afad4ddb", "comment": "Malware payload", "value": "e1bf2f772136f4bcaabbdbd12097a1879cf4255e345ac67426b4aca07b750397d461e94b1e07563f991a58ece0bd1b25", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293430, "uuid": "0efe586a-f47e-4f33-b4c9-d3baff688d3a", "value": "T1F5D5122AA1DBAC1CE45BCBC1671DC6834F4EB193BAA73456097D970A8273D4ED4C3A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293430, "uuid": "9bdedf4d-695d-48fe-830c-a5fd1e2abb4e", "value": "49152:Ke4yTzJDobvvE0W/acbLwCT//0bAx1YFMv6zTkIKSkpVq5K3WxYIlR:Ke4KJ2fW/acbjTn0mpiERpVAwWxbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293430, "uuid": "7513dba2-56e7-42b8-b1e9-8f5e40de1e00", "value": 2874896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293430, "uuid": "8938b5c8-fa39-4f9b-a5df-e207e8bd5e92", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293430, "uuid": "37ced173-a490-4d97-8cab-efb4aef3bf44", "value": "Living in the Light A guide to personal transformation ( PDFDrive ).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4b4520-a28a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675295144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295144, "uuid": "58906363-3323-47ef-adf0-4140315c2e14", "comment": "Malware payload", "value": "537c56c3ee99eeff505360d75e0ed54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295144, "uuid": "38ad506b-9d9a-4510-84bd-5213ce96e41e", "comment": "Malware payload", "value": "481e496b069ad64bf2f38a3bf561697fe4e9794d268b415ba3bd9ba9215062fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295144, "uuid": "d3972327-5294-4f9c-b548-a3690340d74e", "comment": "Malware payload", "value": "b8448b2e76e421b4a740a9b79e348a28b5d1a26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295144, "uuid": "327aa7ef-d9eb-4440-908e-f72e27bacd9c", "comment": "Malware payload", "value": "2c6dd69ebcd72bf63ce5ab5f67f3e452fcd62f7c4ad688422fb63d3c0faadd8816891ea1f533cab375dc836e3ca377ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295144, "uuid": "7c0bf787-84bc-4e32-bbc0-a9855e33ba7e", "value": "T11EA523362A3D8836D0929EF85D31E533ABB69DA4287C8601B4FD3E0F77BD6C56A04147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295144, "uuid": "65b4ac8d-90e4-499d-b3d1-6a4ffdad6100", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295144, "uuid": "15b35eae-99c4-4a05-9c2f-d4157b4c709a", "value": "49152:icPLnQ6iAf77N0/PqekZvrhTeaF4nDuOX4eIk8QaULCgv2MR:XPLnQ7uNaEBhayODuPeIUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675295144, "uuid": "4df0abac-f587-469c-b860-7c315b510b47", "value": 2187924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675295144, "uuid": "1795f784-1f63-4868-8d37-1ab887c1d320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295144, "uuid": "c5116459-d87e-436d-9137-670204d97b0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d8ec55-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675247623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247623, "uuid": "9fdcd538-af7f-44e2-8c01-0682b076f42d", "comment": "Malware payload (Formbook)", "value": "fa085156570f892559c12dac9ac9cc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247623, "uuid": "c041e0b6-f337-47f0-bbf4-ee0d8158ba09", "comment": "Malware payload (Formbook)", "value": "494b6ba9c3bbda71a890fd89433ff0c5fac708ac0391b4f4b2b83714afaba73e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247623, "uuid": "22f09c21-0733-4f2a-967c-3669a47e988d", "comment": "Malware payload (Formbook)", "value": "662e2bce7d5e2a7a5fe8338cd719966e602b2290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247623, "uuid": "8102d446-1281-41ac-bec4-bafa7472e466", "comment": "Malware payload (Formbook)", "value": "5bbc00384a7f617352dc9ddbd8813391a6eb5d9582f6f2fd521bff861779614cd7e062c370690917cb0cc94c725d8c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247623, "uuid": "d9ccfa50-3eb1-4cbc-a298-ba1cb254edb2", "value": "T18BC4235462F8C73DC2BC4BFE45B2553097B82A1D6E47E2992FE438EC284770866537B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247623, "uuid": "f27f0097-e409-4e52-b91b-8e4d3e7c9a0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247623, "uuid": "30a117e3-3ba1-4f9e-8723-3b565f1228e7", "value": "12288:Kr8uaHPiClcTw370L2waCP/bYshYM8Gq2TJt9i7+pvvCWtO:Kr8xHdcTcg7aC3BhkGbjw6R6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247623, "uuid": "fd7e0c02-d9e7-4c19-9689-70978d7697ca", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247623, "uuid": "378f085c-3feb-4438-b944-f816d309e996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247623, "uuid": "a8b5bbcb-54d5-4a19-a23e-595535a130eb", "value": "wIQ8g7Sc7RrSm9l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba76f9ef-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675247549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247549, "uuid": "f65082b5-e514-4073-b723-9a4c367b59b0", "comment": "Malware payload (Smoke Loader)", "value": "c5b5112f2204c1b10b9488524ad01c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247549, "uuid": "e6afe2b1-7f06-490b-bf2d-fdc428d74e62", "comment": "Malware payload (Smoke Loader)", "value": "49a07120835b4a318074efa3ac6fca1420a10552e0c65f2a884c50e5e9524fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247549, "uuid": "f113fab1-2ae7-4a02-9836-4a98fabda7d1", "comment": "Malware payload (Smoke Loader)", "value": "017b66af4874305661b96d07ee3d23e2937803e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247549, "uuid": "be5def3a-9086-403a-bd98-1ce75c6795d7", "comment": "Malware payload (Smoke Loader)", "value": "812a6b12d160afb3c302db07628d1d648ca2871df51335a8dec87c4e1393dce4778484f8a47e4bc1bc965a5d07f9c045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247549, "uuid": "77534fc4-f5fa-48c0-9b2f-ae1f35ce66d6", "value": "T16B34D02179D0D072C7AB10305C74EA957BBEA4325932948B7B9817BE9F702D1A73B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247549, "uuid": "09d70200-cb19-41d6-bf53-761fb7e637f2", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247549, "uuid": "ef0e7daf-2632-4146-8334-913238df4974", "value": "3072:OWoGyyW3ULgMJTL/KbW0s5FPCq6+inH1S32X5wgdNrZ0uOWtF:OWol8gMlL/Kb5XMinHMY5llZP9tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247549, "uuid": "fef0c925-d580-49bc-9571-519ada1194a7", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247549, "uuid": "cf8b5eec-f918-4cd1-a807-761c6c24d15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247549, "uuid": "ea71ee01-a126-43e4-a13d-3cf8b8ba3b89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3a153a-a20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675241724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241724, "uuid": "e9ff6519-a943-434d-9f5f-0f0381ded171", "comment": "Malware payload (AsyncRAT)", "value": "43924592e1f9c0776edb140126dfd0a4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241724, "uuid": "cb0a2442-0985-4841-a182-05cba1a3ea6e", "comment": "Malware payload (AsyncRAT)", "value": "4b7c7ecab6728bb94b9fb3cb3d89ae86db763a3f0afa31d2b4cc8f1ba0f9580a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241724, "uuid": "6caa0c1b-a316-4c24-b2d6-6b1c620255cd", "comment": "Malware payload (AsyncRAT)", "value": "140284c4a9ea71c80f3d7b4aa5259e621ecc0894", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241724, "uuid": "1db725d2-7d7f-4d5c-be98-61ce99a4a131", "comment": "Malware payload (AsyncRAT)", "value": "f430d5f18d95f636bd3629b0545ac9900dcb722c203c2a13236b750cbecbf9dd8d432a950772413cb2036b536c08032a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241724, "uuid": "239e9ee6-6c9f-49cc-b278-0b31609d6e1f", "value": "T1AF45285AE8F78812C0E9F4F403625E108AE17E29259F8D1668F9315984F1B03DF7B66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241724, "uuid": "d5fd237c-a884-42c8-9ae3-048cd3071973", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241724, "uuid": "97972b0a-c148-459e-9f51-8865e40a6325", "value": "12288:dr+w+Px6rT9aUvCYMsFzPcc1lZgZMrfqgn811CYjojv3KapxhAnSWp9X5Z7aUvCm:hRVCYM6zPcc+1CY00ptRCYM6zPMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675241724, "uuid": "fb27020a-124f-4aa9-a10f-ec1612203803", "value": 1246640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675241724, "uuid": "b0c63345-6d39-495d-a59e-187e422f21cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241724, "uuid": "a0e40267-4e44-4a4a-af62-595c1e976d94", "value": "HEUR-Backdoor.MSIL.Crysan.gen-4b7c7ecab6728bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cc201e-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262763, "uuid": "bb2a093f-4cdf-4f11-9c95-5448663731d9", "comment": "Malware payload", "value": "0222b94c90c1ce04c6855feff9f55ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262763, "uuid": "189d9165-552e-4aa9-b634-ff61bffc81fb", "comment": "Malware payload", "value": "4ba299db5445aa713f34b127a4ca64becb7f8e86c66b0e3e8c0fffdc79ebff00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262763, "uuid": "6abbd2dd-1e49-428c-b10c-cf83d56e7379", "comment": "Malware payload", "value": "05b987dd066f5d8f13af056d2f62c395050452a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262763, "uuid": "f8bd96ce-3438-4e98-9324-13e97f52f74d", "comment": "Malware payload", "value": "2ac3f28f207c295a89cb03bdbc52c7b2a76ebd4af555137d79dcf19f933c689a180017892897d3af73245cb453bf6b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262763, "uuid": "d9789b63-04e7-4d9b-ba33-4ff6d1fbd208", "value": "T1E5763320B5FD80B1E6A60533AD992BD1A6EDE300DDA208B317DD5E5B383C654C5BB6CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262763, "uuid": "11e575cc-bd7b-4c1c-81ce-78c01a501bc4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262763, "uuid": "0c3dbff2-5dbf-429b-a2ac-dfbbf203eeb2", "value": "196608:91OmB5YW2ZT3FUA83Qr6QnrV1WheXEJ7Uikwq:3O8YW2J3qL3QrHTWh5JOwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262763, "uuid": "745fd729-0073-4165-b201-afce60080c1b", "value": 7612144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262763, "uuid": "3a0d8f1a-1320-4aaa-ab3a-ecebd7ced119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262763, "uuid": "6afccb76-2581-4d2f-852d-3cc545c4a2b9", "value": "0222b94c90c1ce04c6855feff9f55ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278094f8-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675266630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266630, "uuid": "a40180df-f15f-4649-bec0-66c732626183", "comment": "Malware payload (RedLineStealer)", "value": "f0696447ca3a7abac19e51880924d7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266630, "uuid": "be10b116-71f0-4240-91d5-523847a3f2b2", "comment": "Malware payload (RedLineStealer)", "value": "4c09a6476837c5b4f97cb5f878be50379292ceb62e359a502036c78460eb64e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266630, "uuid": "ae4fb503-efa3-4804-900e-8cfe6c39943b", "comment": "Malware payload (RedLineStealer)", "value": "6e6baeeedab84e034212bcd91b70b38e92bdc03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266630, "uuid": "b2914c26-fc05-4a89-82c5-f103f9006be2", "comment": "Malware payload (RedLineStealer)", "value": "e829520d01a2539ea59aa75c67c3177c18eb5922fef7f52b1b82b7f26029f89a138afd4d20b8c30b3e3149a1d7284502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266630, "uuid": "031e1134-55f0-40b9-b043-2e37dab07519", "value": "T1D2B46AC03AF2D0F9CC231332461C9661E569E4E706225BDB4790DD2A4A2F793BDB179E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266630, "uuid": "8f9682c7-ec1d-4fda-9297-664093c2b3ad", "value": "a6ce71db845588b87d92fe9a59defdfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266630, "uuid": "9817519c-f91e-4e64-985d-95b79bd7e570", "value": "12288:R/lt66QhTIE+3r+Z/79PxBXt08XeYWXDRn+lUy:R/lt66QZIE+3r+fxBq8uXRnwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266630, "uuid": "6d73fbe8-7030-45ab-8941-14436ac85a2f", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266630, "uuid": "0a4cc05c-ab4a-4546-bb37-3e3d096de1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266630, "uuid": "d93510d9-4ea3-46d0-9840-7e18e1983995", "value": "4c09a6476837c5b4f97cb5f878be50379292ceb62e359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231fff82-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238705, "uuid": "b59dd81f-c0c2-4042-8986-b8b91d0a40b1", "comment": "Malware payload (Gafgyt)", "value": "febabc8ee3ffe0e08eb733323c9a9301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238705, "uuid": "518b3b98-d556-4fb3-9e11-808e02bfa835", "comment": "Malware payload (Gafgyt)", "value": "4d17a21c6491661493b544c4164d4e5910b628b121045eb487fcc7939e62beb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238705, "uuid": "caa941d6-cb43-46ec-834e-dc6df02b6d6f", "comment": "Malware payload (Gafgyt)", "value": "384e9cea506aa6ca957346231a22a91ed7d34499", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238705, "uuid": "0ce0db91-fb4b-4d3b-9212-09c7475c7ce7", "comment": "Malware payload (Gafgyt)", "value": "e8b7f1f2f97dd9dadebde1ca2aa5878ba218ca35f5809718135ccb9bf18aee7e255645ff19409a9a6d9679b78eeba79f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238705, "uuid": "be8161af-80f7-4bf2-8cdc-bde0f5428ebe", "value": "T174931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238705, "uuid": "386dfd6f-91a0-4b39-a945-81b25bdbb5f6", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvcNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGcNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238705, "uuid": "7a6669aa-0b74-4e8c-be87-5b3a3272b22d", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238705, "uuid": "271ada5d-1a7c-4a51-b12a-38379d54a9ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238705, "uuid": "c8dfb0d4-fbb9-46ee-a655-14ad58e019e6", "value": "febabc8ee3ffe0e08eb733323c9a9301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ea57d5-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267156, "uuid": "67792acc-26ad-4148-967e-585bf71075fd", "comment": "Malware payload", "value": "a7859d766985610d9cb2c874ff6b0f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267156, "uuid": "c7d05cee-5955-4836-b2a3-288d61497e41", "comment": "Malware payload", "value": "4d5ecfdb7d68f7a04a8a686f613693bb2b79b60241a3755f4e04c248e51fb2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267156, "uuid": "a0f7fef2-6c42-48b6-9853-7e10ab381e34", "comment": "Malware payload", "value": "044b6fd1ab9a5ab95d0ed94a1c1f21ae15e95f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267156, "uuid": "398629b3-82b7-49c9-a64d-f7b3bf89d642", "comment": "Malware payload", "value": "9816755115620bd83b4f15853e3386a8ebc9698f954b3603dd06860dc5063d0940513e371ac7893e65963039c50202d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267156, "uuid": "422833e6-7865-498f-9814-c82b2b0a9d40", "value": "T191C1FD416EEE10DBF227073017EA737B1665F9B1952E62F874844A599F31AC0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267156, "uuid": "e240e1eb-c213-4546-acbd-575268e6f9d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267156, "uuid": "daa55ae8-6da4-40c5-b80f-2ee6f9c65a43", "value": "96:Q7F79YKCFM1nNysdds7Y738y/YY4Lwvzd3ojnrl:ct9YRFMNNyqdSu8y/Y8zdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267156, "uuid": "9bf69561-8a4b-4183-ba69-cead5e84aaf4", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267156, "uuid": "fa566fb0-6a71-4018-9e89-ed60c3ce85aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267156, "uuid": "f3354389-e5fd-41c0-81e8-b874d17fd339", "value": "a7859d766985610d9cb2c874ff6b0f12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d39109-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261654, "uuid": "90353bf3-dc5b-4f5d-9da9-be338815bc97", "comment": "Malware payload (SnakeKeylogger)", "value": "04528c38cb77ee375ae0b1740fd4e652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261654, "uuid": "bcd2748f-8d69-4d07-925a-523f7d82d996", "comment": "Malware payload (SnakeKeylogger)", "value": "4d67b83779599f1bcfeacdfc28afff670dd74b927cee2c756b27bb3f8c2b66e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261654, "uuid": "86795d87-91e4-4e1c-8545-c5ce362ca33e", "comment": "Malware payload (SnakeKeylogger)", "value": "d0050ecd3112d05aa1e2a4039a05854286dd0427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261654, "uuid": "c797606e-109a-4756-bec1-2e08a7078002", "comment": "Malware payload (SnakeKeylogger)", "value": "33380ffbbd16b00fdc81b03a96c7ab36267eadc45bfa00b23b9ea67fdcd2cae263d3db591b14fc2860d6a965ae369ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261654, "uuid": "2f362d03-782e-4645-90de-b2dd9b768444", "value": "T172E4AE432978D59AEF6902FBE10A506437F5CCBB811CF6185BAD3386D9E1B510C6BA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261654, "uuid": "91cc9a48-d755-4f3b-8f2c-3e4b22eb0baf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261654, "uuid": "75e0a210-7f35-4ad5-b6b4-d6d55e77d390", "value": "12288:33bUNbKluJwq26avlKLwzyyn24mXBBLLUfo5v6nnjqKoe:7UNbKlGw96avcLwzyynrmbLLUO6nnjqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261654, "uuid": "d091fbdc-70a2-4bf2-92c3-de08221a2780", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261654, "uuid": "acad0b62-3e83-4f5f-be6c-f7e3250250ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261654, "uuid": "d1cd3fec-6741-47f2-96fd-65b0f2bcbe68", "value": "Invoice Payment Confirmation_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cd215b-a1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675233101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233101, "uuid": "1802ecd6-d2ef-4285-aa0a-66bdeeac8424", "comment": "Malware payload (GCleaner)", "value": "77fcd530f523587495d8e00bb06c0331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233101, "uuid": "ccacc058-ad06-4526-ba22-b45ed6efdaa0", "comment": "Malware payload (GCleaner)", "value": "4dbbacc76e6f8719b7cc125919bd474c68042337abbe18a298eaab67ceb905b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233101, "uuid": "e93290da-ca29-40e3-90e7-a35ccd68ee3b", "comment": "Malware payload (GCleaner)", "value": "c902aab60699a79e9d0287cefdbaabcc07e8b578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233101, "uuid": "b973efd9-4903-42da-a01f-ba92cb43b7ac", "comment": "Malware payload (GCleaner)", "value": "f5885a327eccad5ada0b6c8705d93d056650a4e03dc3506e78525927b3c9bc9b989cc4b0998855dfcea62b4577f80949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233101, "uuid": "68a4f15b-9e54-4bb3-bca1-19e302787183", "value": "T132A5230B7975C937C3E2E6B56921E1A29EB32F15157D830234E97D4F3ABD3C2A80D219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233101, "uuid": "ea9396c2-f79a-4e07-a1d5-cb3092ed6cfa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233101, "uuid": "8dcc3bee-42df-44ff-994f-8c85aaca6bc0", "value": "49152:icPLnQkJpJVGmMuk3LfE25d+Qpc4LRW3ZvufHCW38f+i4LCgv2MR:XPLnQK7cukbj5Hn4du/n38fav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233101, "uuid": "81c6e360-621d-48a7-af7f-30d82b9ad61a", "value": 2200660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233101, "uuid": "7a04148a-c61c-48bb-91a4-6e97ffacc082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233101, "uuid": "b32dc072-a0d5-4c45-9b57-e1c8207782fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2668ba9f-a217-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675245583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245583, "uuid": "57fe6bd8-4b6d-484a-8a03-e7ae741d5327", "comment": "Malware payload", "value": "49bbf70c33259f8b199499fd898fcdfd", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245583, "uuid": "df2a7d0c-6d10-4940-93c5-431d860c0b93", "comment": "Malware payload", "value": "4dc854dca142428be848349b26aab293d1fecbd9ea8302c0fde00f4abc4418c5", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245583, "uuid": "7b3f8503-1e3a-484d-be0b-0513833c94ce", "comment": "Malware payload", "value": "6f57b4f5a82811cbbcdbc5f65ea826eec0ac5010", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245583, "uuid": "2411f124-7d4d-4bcd-8711-8af47df7e49d", "comment": "Malware payload", "value": "602fabbd0bff52320500b13b5fb3b902f41219d91a799cca74d51ba31cc6db7a73406eef35a8ee2bece6e6296f46468e", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245583, "uuid": "4857c824-b0d0-43b4-a724-2f51f2b89d44", "value": "T18702CF583B28921EC604309F538A6399F4B20264DCEB8E42ED5EFC1194136F7C864EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245583, "uuid": "dd23a34b-d399-4f4b-bd38-0c200eb2f6b5", "value": "192:tD5VY1Rm7oGS031pTAs9OYAEuissJOhk24A0QxKi+t1LjfA57:3IcSsZAs9OYAEuYOp0QxKi+7LMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675245583, "uuid": "88cd52cb-23d4-4605-8ffb-4ce5c5a47090", "value": 8820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675245583, "uuid": "791e2f2c-dd82-4716-8502-b0b25d00d933", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245583, "uuid": "2ab24ac7-8d5a-4fcb-a7b1-2f2fb1ef1299", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15cff96-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675239427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239427, "uuid": "66fd110d-b0dc-415c-b1bc-9b3e59afd3ed", "comment": "Malware payload (Gafgyt)", "value": "49bd49c6749b7c715be8f849851473d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239427, "uuid": "3db88dce-0b6b-4fcb-82d1-b8914c440ea4", "comment": "Malware payload (Gafgyt)", "value": "4e207e07272535f381bc0b7d0281bf5afe8c94e4f72299aff835a88e251a4dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239427, "uuid": "d34b66d1-d74c-4ba7-9c61-e31549e834ef", "comment": "Malware payload (Gafgyt)", "value": "82ebfc48f3a72b0da161cb7839b06ba430dd204e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239427, "uuid": "0dff1b01-71fb-466a-8ec2-9aa379b4d677", "comment": "Malware payload (Gafgyt)", "value": "5b63cd22e06cf1ceaecb1d37190fb61bec48e16db50ceb58f715748d047ffd81d11f2826c052d59d5910bd438caf0575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239427, "uuid": "d375d4e9-a7c2-4fa4-894a-5c09ab816552", "value": "T1DD734B47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239427, "uuid": "252c679d-8e06-4b4d-b739-ef4150e770c5", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/CU3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/P3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239427, "uuid": "9136a874-14bd-4118-90f8-74a2ff79fcb9", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239427, "uuid": "5b812db0-91c4-4d82-8ba4-2493bffedad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239427, "uuid": "3487ef7e-3620-4aee-b5f2-3397bdbd167e", "value": "49bd49c6749b7c715be8f849851473d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c44daa-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263721, "uuid": "4ce7dbc1-ec9c-4138-9975-545aabffdc43", "comment": "Malware payload", "value": "d0eea501bf9037576566cc57b6b5ae2c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263721, "uuid": "695cc6e7-0925-4287-bcf7-580f12bf75da", "comment": "Malware payload", "value": "4ef48d1dac8579e1ae4a39655a8b17aa2f7d327af0503a2bce77065d8bd8f73c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263721, "uuid": "d029c77a-1d42-4ff6-95c9-7ab46c538540", "comment": "Malware payload", "value": "d48889f02d3336561cca429dae6190100456eb01", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263721, "uuid": "c14ffdae-dc35-4a3b-9e35-8aa1b95fbfe6", "comment": "Malware payload", "value": "b86340986be978764e76b3425f71b8890a7f06a7e0cec1fde3ac3a1fbeaa01b324ca17e19895d7f9d267c467e9530d40", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263721, "uuid": "1b2438fe-fe4f-429a-b84a-c2c70290ee35", "value": "T102E3CFF0678498D2DBAD9B97A1596D9C663132BFEDCA20C80045FFD929373819E0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263721, "uuid": "01a39c3e-e88d-48f5-90a0-57b381b89067", "value": "1536:0IuKvI51/xh5GQJLoKeFl+M7VTtS1lb6z22YovJkvi9Fr+NUb2Lcx5tXbog5hKPC:QKYWxYIJfjDJDq5nJQy7Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263721, "uuid": "2a7a09af-8040-4ed1-81f5-74ba5a1661e7", "value": 150124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263721, "uuid": "a4a6e7cf-77c2-4b1a-b424-2a592204228e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263721, "uuid": "f432c0da-39a0-4a0b-95d7-0d948d43b7c6", "value": "CUSTOMER023- PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95858d31-a1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675218711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218711, "uuid": "267049ea-a3d9-4a22-b104-b5731772452f", "comment": "Malware payload (GCleaner)", "value": "a49ee64e684198350c33b82a1e82ad78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218711, "uuid": "6bf1cc0f-b6e0-47a6-85b5-ea5a4f726680", "comment": "Malware payload (GCleaner)", "value": "4f5e4b1d7584fef6465055095da470d4f288bd7c3706021d129eb049cc5dd704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218711, "uuid": "bff274e3-ef86-46d4-a52b-126498b4e22d", "comment": "Malware payload (GCleaner)", "value": "f7feb1fe822eee4c245e772a603a84f657cd5472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218711, "uuid": "0bdede12-43ef-44e5-b619-7bdbc9e379f6", "comment": "Malware payload (GCleaner)", "value": "f2ce0b336d603df06c342515364187d83d5d8b4cbf355ece28f904c261a189054ee1d92769b8df87156c52dfcaa6f9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218711, "uuid": "05c552ab-0a53-4af2-aa73-8bd2fb74fa31", "value": "T175A5334BE0979573F7F28B719C2CD694BD37EF5AA238842971AA118C4F25BF0642F604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218711, "uuid": "5ac0d5d2-7d72-4687-b2c5-71a96495c694", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218711, "uuid": "1b7eb2f4-0d64-4570-b5a2-9d962544d23e", "value": "49152:C2scOpwzfIoCC1aK3hMgA1kBea9kZVj5w4RZ+dyabqNwBmsLCgv2MR:ds/0kSfikUPVpRsdVAwBmsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675218711, "uuid": "28587076-c291-49de-9fb7-fb028f065c66", "value": 2191567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675218711, "uuid": "0d005905-31d6-418c-bdd5-aeaff3324f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218711, "uuid": "47843fb6-9a86-45a0-993a-351f748e8adf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05ceb5d-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675263423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263423, "uuid": "b63466ad-9990-41c5-b330-cdf8a4d56207", "comment": "Malware payload (Vidar)", "value": "b88f7b5059addb742a976033f1785cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263423, "uuid": "cf50ae88-8433-4803-a0a9-119a989cbc1c", "comment": "Malware payload (Vidar)", "value": "4fb4edd3c46004e0915f9f6576373bc6a81e1aef200238d3b73c5c323a416079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263423, "uuid": "44584069-24c1-4e19-8e01-12ee099ad852", "comment": "Malware payload (Vidar)", "value": "95f7fc6282828f0d342e91a61de0b0ac3e43b6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263423, "uuid": "09e25a7e-32d8-4d3b-bbb8-32852fde4c2d", "comment": "Malware payload (Vidar)", "value": "0a8080531019113b590bb856e308312c49ef4b1058e4428624020fc8f87d9efb106d8d108940a3fd35082a284b034019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263423, "uuid": "a34fae58-be37-46d2-b2fb-5249c85b8213", "value": "T18D271262FB4331D1D5E4887188277CF731B17D6B87C05B3AA4F8758108A279ABA36937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263423, "uuid": "0ccc3483-62b3-4ca9-a5d4-4f0b2bfb2462", "value": "9f95eae0e562cdd8c0f94b7ddd3234c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263423, "uuid": "237bc92c-fe3f-4517-9ddd-3418d67a35b8", "value": "98304:HAYXBtgbPrAuVAE6lu0gaq8JmGnVFJIBjg9KXQup70J8RgB0hJk48JI72P8qz7g9:FRtgPrAXEBXuwg9Mtx0JhunkJ4qz4FNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263423, "uuid": "7272286c-4e4b-4dd0-a3e1-19df25f30d48", "value": 20962154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263423, "uuid": "4aedb9e5-15ff-45d5-bf44-85dbf8e4f1c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263423, "uuid": "c93bf0ee-c467-48ce-8aec-b63c98b85e97", "value": "b88f7b5059addb742a976033f1785cac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b731728-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282098, "uuid": "f25a30bb-0424-4860-bd91-a78f886def9e", "comment": "Malware payload", "value": "7e9c44113bd8f0d547f2ebc3907dc504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282098, "uuid": "2df89936-d225-4df8-b712-1414ee25b8a3", "comment": "Malware payload", "value": "50825b0c7d0120fdd2e616dc9e6e0cb02d447542a1502d7a29e5b04db4a9e9f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282098, "uuid": "e2a0edb1-1e09-48bb-b92d-9b683ea2f4c0", "comment": "Malware payload", "value": "c8ee5cda606b438ffbc157ee06062b99191748d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282098, "uuid": "ea489c4b-42f7-4b83-9e7d-a8c4274711b0", "comment": "Malware payload", "value": "dd525dc4ea095cb1158f0f7e74e08db245bba179d2901a8267a749efcfbc50cf2682792d173391e51ec2dd2f83fe4cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282098, "uuid": "afcd9438-b2e3-4691-b672-ce66f31a5ba5", "value": "T165F46B5170D1C072D973173509E0CAB45E3EFD714AA29ABF67A80F7E4F302819661A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282098, "uuid": "0bb4d825-38d5-4e61-be46-1efa98266c55", "value": "ad2c822b9af1b5a29a479da986f08c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282098, "uuid": "dc591919-d816-4e2b-91ac-be739ff81b1d", "value": "3072:yVL9WLK5T9i3rqr6xCYgcOnhXsZAiezOb5wvmJpuAg0FujD63uR6ofd:sLcmhYqiCYgc+s2ivJYAOieR6ofd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282098, "uuid": "c4e37663-6a73-46b8-aa8a-9c77aa5990df", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282098, "uuid": "654560d3-8264-49d8-9905-dd3f90374c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282098, "uuid": "72894658-de5a-4efc-a28a-430ee7272aeb", "value": "info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88960f3-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675267303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267303, "uuid": "3bcda32b-5853-417a-95bb-adbf4643ddd6", "comment": "Malware payload (Smoke Loader)", "value": "73b42378eb38c2b876ae14b8ea57a865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267303, "uuid": "654b4ea6-bfc5-4a62-8908-a7db25f4a892", "comment": "Malware payload (Smoke Loader)", "value": "50a944d60c8d2b10d8390e891d8befe8565e98773bd88e93c84e9e17d93e9c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267303, "uuid": "9aaf2284-5503-4fc9-9775-23a9a53276d8", "comment": "Malware payload (Smoke Loader)", "value": "2981c5e4bea54356dab6d300d00988dd7322b443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267303, "uuid": "c8561bdd-f2c5-4091-a126-b87fe4ff0735", "comment": "Malware payload (Smoke Loader)", "value": "7fdd31cc7418a06a54c9877db71c2a75369e21aad25dbf9f41b8fcada4b7592508b789034bf167f8a19e4176dfdf48a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267303, "uuid": "856ca95e-9be4-4339-be86-2632430d8b68", "value": "T14E34CF323590C072C566D5705C30EA99AB7EB8712675985B7BA81BBE9F702C0273E34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267303, "uuid": "f9805da9-1833-4f8c-85df-c92c71173b65", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267303, "uuid": "07e50b4d-c3fc-48ff-a585-ee079f93bf06", "value": "3072:XmfGX2hCJarULCEWsx+q5AxTQiyAWOtBt2PVQ2wHUcZisVklm:XmfCggLCExxeQiPWOz8dDwVVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267303, "uuid": "054a1f11-d14f-4428-8d57-48047df13574", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267303, "uuid": "72869a9d-ff65-41fb-9d8e-aa37fcfec802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267303, "uuid": "1a178ec6-1c51-4eb9-a9d3-51653e317b2d", "value": "73b42378eb38c2b876ae14b8ea57a865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9798c2bb-a202-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675236753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236753, "uuid": "a9297c08-16c2-4f4e-b818-7ac1aded3922", "comment": "Malware payload (GCleaner)", "value": "37012625f9bff02aedb4e3079bcdf98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236753, "uuid": "04b4bb8e-30fa-48df-862d-08393e23da8b", "comment": "Malware payload (GCleaner)", "value": "5145bd5fe8c331e9e1d7af0e1fa9479dd48b8a4d22b572e441a802c87954c5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236753, "uuid": "0a1e64ac-3658-4983-8beb-1954220325f0", "comment": "Malware payload (GCleaner)", "value": "56531711897762695491659a067487b470bbf97b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236753, "uuid": "1b34ff91-79b9-4acb-910f-8e04c467e88a", "comment": "Malware payload (GCleaner)", "value": "bda15e8c84e6537a15af88eab06a10c713f4937481d1a7017cd1a49c8e42007e955833dfadceacb47f14f5be475c717e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236753, "uuid": "9b02f143-3711-4680-aa92-fec3288094d4", "value": "T13FA53301257B4877E25166B96E20D2724EB39EE6267C830925FD7E4B7BFB7C36404B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236753, "uuid": "f340f1aa-215b-4d17-b3c6-3f71e19c6ca2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236753, "uuid": "50ea34a5-a149-48a6-80dc-7afc00b4214b", "value": "49152:icPLnQ72Q8dEQJ71+D029FC4TawZRYTuXpf+JQ15ukLCgv2MR:XPLnQPQE4JM0aFW2mTuJ+G15Hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236753, "uuid": "c293a5ab-2f0f-48ef-8427-8da922ab659f", "value": 2252494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236753, "uuid": "8b43dbc0-b174-4f00-aabc-c53e31b86f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236753, "uuid": "822d7f01-d09d-4c8a-b0c3-6d3f31dc116d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fd7489-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675267619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267619, "uuid": "df10db94-69e4-422e-91e8-b6c666215eca", "comment": "Malware payload (SnakeKeylogger)", "value": "91a8a8e103d658bdb62eec5b990b3538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267619, "uuid": "3047eb85-c306-45d1-8fe1-3026e91ab857", "comment": "Malware payload (SnakeKeylogger)", "value": "51a2538d373cfad000a1373dd37efeca4e7581d9c89ee62375ccd24f133daaa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267619, "uuid": "397b5d86-d02c-4680-815a-ef5beb752eff", "comment": "Malware payload (SnakeKeylogger)", "value": "2a25835c274ff5ad31e74e8cd75d71c744ff0c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267619, "uuid": "08e37964-2491-4315-81a0-98e5ee967f26", "comment": "Malware payload (SnakeKeylogger)", "value": "94ebc2b906875ea1c62b7a83e2eb6fef4dead33b89ddec3dad42ad67adcbebc44dac05e2d8f8a0d707a4ce72dfa32dae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267619, "uuid": "59891e52-0bbc-489d-957d-abaac34ca07e", "value": "T17EE4026E03BCCFA7C55843F971E404592B3016A6B093E7085D9AACD5CD8B3F14B3A56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267619, "uuid": "b82c202a-5aa2-44c8-aa7f-d5ecca3e891a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267619, "uuid": "77cf71ba-94d9-40f1-bfd0-8f646c1680dc", "value": "12288:5+4dwoz9wbY2FrbkYu6zsTkHJPUwrhLFR8vsKaTOWeh3ih9HMA:5+4KozOPz2kpjJcvsK6OBYTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267619, "uuid": "1ed7d82e-b75c-4ea9-b899-f13b772a6597", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267619, "uuid": "467f888a-35f7-473c-adb3-96b59a0c0d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267619, "uuid": "56723642-a795-4b86-9c44-a55f596fbb78", "value": "91a8a8e103d658bdb62eec5b990b3538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d7d765-a1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675224744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224744, "uuid": "34edbb79-8ad6-4597-bece-a5c96a70ac98", "comment": "Malware payload (NanoCore)", "value": "d3e933b0aab571bdc73355a106d657e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224744, "uuid": "9d3fbb99-edef-479a-b110-1de82b2e80c2", "comment": "Malware payload (NanoCore)", "value": "51ab5d042dee8df90162a00a3307cf8d38d12bc54b7dc07c756996aa0f6b3804", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224744, "uuid": "4ba06f7f-4b2f-443f-95c8-5f02fabe2258", "comment": "Malware payload (NanoCore)", "value": "ee600eacf16a1075fc8a28116a64f96403122d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224744, "uuid": "6373b261-7b74-4d82-b75f-d7d70b1a24d4", "comment": "Malware payload (NanoCore)", "value": "39b407c0f891dcf611e41e25a3b15d722e4dc6809ba6095f70f054115477d9ac168459cd394d667c3c320f7fc172afff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224744, "uuid": "e1a155ab-604f-4ac7-bf88-ff6b49ab0348", "value": "T145940288F8548973EDAA0833FEAAD8055726BD126E650D4972D4BB5B3EB3483C30D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224744, "uuid": "54c15235-a25f-49c9-ac02-7c25003f70f8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224744, "uuid": "7262b72c-1bd4-47f9-8fe5-a5c136876e9d", "value": "6144:nYa603Pc/eEb9Ih4VB/Q3Eo1z/AMxf09Vi01XpSjROKeOSA3yPKN5nCugfzs0GFD:nYi0GEb9Z87jf+1wdPNiOh7gfzsh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224744, "uuid": "5e24078e-103d-4019-ac16-d9216eaff03d", "value": 430029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224744, "uuid": "11e474f4-8282-40b0-a3de-3e559a035cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224744, "uuid": "3a08d458-2d31-48e4-b8c6-6a6b3f931fa8", "value": "d3e933b0aab571bdc73355a106d657e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b699c58-a22d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675255120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255120, "uuid": "b8d5b446-0563-4bc7-b688-77dee3b58a24", "comment": "Malware payload (Smoke Loader)", "value": "58ce59ca81477032f40d763cbe85a291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255120, "uuid": "e8d03521-4d2d-4df4-94ed-7dc7d129f951", "comment": "Malware payload (Smoke Loader)", "value": "51bacb1229d201a3dd4e2e865d25400c2c64d5b6d0587b68a5697cc2cf46ab82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255120, "uuid": "0e6ee534-055c-4b82-9920-13646138acb7", "comment": "Malware payload (Smoke Loader)", "value": "dfb915c14a324e6b6901a6884219fe293685456e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255120, "uuid": "a336e8d0-8d74-404b-84d3-aaa56070c837", "comment": "Malware payload (Smoke Loader)", "value": "7f8e1230ddba0cfb859cadb4fce310130b7160bd040f5172768fe18e05f29d5ec68b48521f11e3f29a624eb6060254d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255120, "uuid": "5124e7cb-0e12-45fc-b351-5d38167095e3", "value": "T14C34D0327690C032C76650705C60EE987B7EB5310536995B7BA92BBE9F702D0A73638F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255120, "uuid": "4ae0e208-75da-4f84-bd6f-f371f78bfd69", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255120, "uuid": "3424461e-30d4-45b7-961b-bc42212dfc7d", "value": "3072:vSUGTJLa0LBxqCLfx7W2P5XMbnifRqiHdNg+KxkEN48l:vSURcBx/Lfx7zLfIkdNg31l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675255120, "uuid": "b0fac207-0c3a-44f3-9456-2f6a0e24e34a", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675255120, "uuid": "c60171ad-edf2-4b54-a4b3-0de7b965dced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255120, "uuid": "4ad2bdbd-3a24-45bc-b8e4-091f5b7e5eae", "value": "SecuriteInfo.com.Win32.DropperX-gen.2729.15463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa8a7bd-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675239585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239585, "uuid": "13afc29c-8a3c-4371-99f2-f6730d1e9885", "comment": "Malware payload", "value": "cbd2de5612bfc0fa1ff0a53214e43c1e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239585, "uuid": "1901c9ee-89a9-4e50-b1dd-142afdc5a4d3", "comment": "Malware payload", "value": "52a22a5b8934f54d18273dd71d3e377cc903ca262921e0f19972501c15732439", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239585, "uuid": "a3439967-4f10-4ee5-a59f-8056f91bf80f", "comment": "Malware payload", "value": "27220b57f347c79cb9b366b50be9d96cdf98e0d7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239585, "uuid": "4d2e0e50-5178-4031-a508-90b47070ca5d", "comment": "Malware payload", "value": "c6dbcfc7226c4a201582302d9e064882775afc0f7e8d97f1cfe0c90765c0e22d08cd0f7ec073621cb8e8d98698529523", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239585, "uuid": "b656c2e4-58ed-4942-844d-12871087502f", "value": "T137948C13A944CF83D419C7F47E834ED81F4AAF09E9917AEB10623F8F7E35662498A11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239585, "uuid": "9440b131-535f-4ac6-b667-4e21c9a40fb0", "value": "6144:PXaFJkKXiDU7wBBDou/NMdqaskx5+1/xVEDid83Sp9y9rmjalv4Nn0kGPxc:PXaFiKXKT02NM0ry+14Od83I2Y0kGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239585, "uuid": "af13a781-4927-489e-b04c-7739aad0a4de", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239585, "uuid": "6790d7bd-5010-446f-886b-0b26bd1a91c7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239585, "uuid": "eee0a468-2182-4f28-8d72-a25dc184a332", "value": "PurchaseXOrder-PO013255.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b068df8b-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675264282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264282, "uuid": "5355fc13-ab4d-4464-a2ef-1bf283bcd725", "comment": "Malware payload (RemcosRAT)", "value": "6d452842eeb2efa505763049d59c553a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264282, "uuid": "4a20a5a2-6709-4fe0-97dc-240e91dbca36", "comment": "Malware payload (RemcosRAT)", "value": "52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264282, "uuid": "8ed03f94-1883-4a6f-9143-041e1132e425", "comment": "Malware payload (RemcosRAT)", "value": "e13f2202155e12573a985b5df24319e5320f588e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264282, "uuid": "7431b836-5525-4810-b7b0-729dc78d7836", "comment": "Malware payload (RemcosRAT)", "value": "252829f26f279c1e5f760aeacecac261454084cc7e00c9726d708214e02283924073104b865855e12056c8dff5557b01", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264282, "uuid": "ff9e84b2-8bab-41aa-9395-a7026d6ea2ad", "value": "T18725BE8377F1A862F6CB10A5142837CD2FE0A103BE95E2679B7B79C0A7058FB7698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264282, "uuid": "aee95696-3216-4548-ae2f-aba6d011da55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264282, "uuid": "f1c02699-65c9-41a1-a6b6-2b8d2d5b7af2", "value": "24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264282, "uuid": "27da7f85-05e6-453f-8d8a-61c8fb30cc66", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264282, "uuid": "291f2c91-0abb-415e-8d1a-f6b1b1194042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264282, "uuid": "94cdbb82-e363-483e-bdee-e098333a6c0e", "value": "DHL SHIPPING DOC PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edcf5f5-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264226, "uuid": "f229c350-d033-4c5b-a069-59bf784405c7", "comment": "Malware payload", "value": "676edc977738e12afe401808f7f45b18", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264226, "uuid": "4a51eb79-482f-48de-a2e9-c2298d322464", "comment": "Malware payload", "value": "53570d6534ecb6c826a2ae043a6d9ae6c026bbb35a48d8bb750a6b6f03525a03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264226, "uuid": "6ae306c1-7846-4c79-92b5-d0ecabf9ff94", "comment": "Malware payload", "value": "e15d990f8105ed7ff5453988c14dc16173024b66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264226, "uuid": "c4c48065-67c1-4422-98dc-ae626cb3caa8", "comment": "Malware payload", "value": "e5c1a1d1e7dfa91948cfb57b10fbbb9b8a9de0acb6acd1de80d11f870fab4c26c893e2da011b334056b195c3db0ac4eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264226, "uuid": "2a0f3467-a13f-4f70-afe6-3ee0697e35fe", "value": "T14CC66C57E84BE8BDF76E31B0747EA73199A40A2890171D77DE86CC71A29E7313C4821B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264226, "uuid": "edccba4c-a6b4-4018-aec7-2db443f1dffa", "value": "7d614df4d986ee3d7de768c8be4d1b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264226, "uuid": "bdfe752f-1b19-426b-8b4e-ef33dcccea2f", "value": "196608:oiLVWX0ayx1xXBAxJ2S9HPb/nPqgKgVNDRQujiuO:oiLVY0ay1OPL2UqujiuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264226, "uuid": "86d0740a-c63c-42e0-ae0d-eb51026a8532", "value": 12290048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264226, "uuid": "80350c54-b6b0-44a6-8a41-1a08dc105651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264226, "uuid": "04bcde14-fd5e-4603-836a-29ddba1b529e", "value": "53570d6534ecb6c826a2ae043a6d9ae6c026bbb35a48d8bb750a6b6f03525a03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da63ee86-a1cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675213243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213243, "uuid": "888a8355-6857-4374-a1c5-469f1035bb3c", "comment": "Malware payload (RedLineStealer)", "value": "3ca08c1cd5a8424f43fe03e461d2b34f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213243, "uuid": "932def96-a3ce-438d-99c2-57a7b201cc61", "comment": "Malware payload (RedLineStealer)", "value": "5393f9c789a72cf5d685cc6e1885ec4e11d6b634d5997a2fc237fbc9fd08003c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213243, "uuid": "4a899007-2da2-43d8-9469-e89db3b26d1f", "comment": "Malware payload (RedLineStealer)", "value": "88ae0b0801a64a49a86bfd7a9446ed29677ce606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213243, "uuid": "0efbc245-de8a-4c85-861d-e0f3f81e1b7e", "comment": "Malware payload (RedLineStealer)", "value": "84fb1d50b55dbda27e16144d9a707b628377edb5639bce7810c62fef84745cd72c66590c3049479a27c45c009f3296f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213243, "uuid": "ebfed0b5-b383-454a-a940-c65cdb28be1d", "value": "T1A784BFC2B2B2BC76E9218A718E1E86F8751EB553CE097765223B5BDF25B01E1C1E3350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213243, "uuid": "10f3ffe3-9e31-42ff-93ef-2028be9ed31d", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213243, "uuid": "6b6a8c7c-e29d-465e-b054-303d7ccc1967", "value": "6144:H57Lt8v/4TmsY/HjN4FwdatD1x4qEimqMoI88M:Hl54r42+DwpNqMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675213243, "uuid": "ef5bc7f5-68ad-43ba-b2f5-5eeb4ef7a9a0", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675213243, "uuid": "ec7ae118-3db4-4ede-a375-cf38f36e19b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213243, "uuid": "b55b5d4a-a046-4c90-9cbd-a3873eefba25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee034d52-a224-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675251501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251501, "uuid": "82a88ddc-bc15-43a8-8449-6d4b4681b4f2", "comment": "Malware payload (AgentTesla)", "value": "26ea3ad05811e75428af299919a14daa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251501, "uuid": "7676359d-8e2f-44ad-9f37-4b913259c47b", "comment": "Malware payload (AgentTesla)", "value": "53b961617f7cd7c0d853800b9d0876ab5b8d3e181ffe936de9153117d1c09a14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251501, "uuid": "c3509065-9905-4e7b-a0dc-c90a9d1a1a9e", "comment": "Malware payload (AgentTesla)", "value": "d0706ac9784b85ed54b13f2caf9619010ee44e74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251501, "uuid": "9590da5c-6b75-4840-8e66-98f37a726446", "comment": "Malware payload (AgentTesla)", "value": "08aed3a2f57f01d6312a3a8bd8f36f9b939ab09c683aab9ce656f906f1c8695eb65eb92a4a45221a0bb2deaf1b38d570", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251501, "uuid": "c908a26d-a0a7-4304-b243-5819645d1f3b", "value": "T14C35493D297757D6C338FA3186D18020B6EEA1823717F96ADDE61AC54F01682BDCE61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251501, "uuid": "697ce9a8-440b-482a-ad2a-de42bdabedcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251501, "uuid": "3bfe0773-fd6b-47b7-82e5-df9ca41b9796", "value": "24576:TUqjseHKNTn7tunA+/kSL/MfmBm8YolWZ+fJBAKYBgW3IkU:4OSZYBUBVIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251501, "uuid": "bb799969-b6a4-444c-aa6a-54909752a1dd", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251501, "uuid": "24740781-a1e2-4b99-b725-7243ccc8ee28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251501, "uuid": "47dcbcd2-97b8-44c9-8231-6f4144880f8a", "value": "STATEMENT OF ACCOUNT (SOA).PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28f9985-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263508, "uuid": "46b8a571-bd5f-4511-85ef-ee1c853de0e0", "comment": "Malware payload", "value": "c0afe48f74b3b4c7d6a7de998e3abba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263508, "uuid": "bd040ff4-abe1-4177-9713-d7e93f3b62c8", "comment": "Malware payload", "value": "53cb2b39ef846cb0aff973c5bbdebc6ecb6f99202f26150297cccfe9e655d662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263508, "uuid": "f3f3fa8c-4818-4de2-96cd-44a6eff669d4", "comment": "Malware payload", "value": "001d2541caf2f733b5e5179c0cb2d6819dd707e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263508, "uuid": "457fff2b-5656-4caa-96b8-d7bf03363b4a", "comment": "Malware payload", "value": "8995dd74d07f61c56ad5e6973ad3c34f644cd2a29c44a68a5d1eadfbaa4d30183cf4f830eac7018b8fb9f86f33d1ec7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263508, "uuid": "a9a30335-5f2f-4dd9-b944-ae1861175764", "value": "T1947633823EE785B9CD833DB3D4AA36D285E5D01586B16E6F67D101780B7F80EE4369C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263508, "uuid": "33193581-eb2c-456b-b57a-4a42d91433fd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263508, "uuid": "9f412cdd-e886-4fb4-b058-8058c1903913", "value": "196608:91OoLa6+vzcGYHIuMlyBC41HeX8Rez5T6yGVYaRYPkED:3Oou7gGi8yBCmHeX8Rez5TNVaRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263508, "uuid": "b26e9893-3da6-42ff-b5ef-a66cf4bc5aba", "value": 7608568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263508, "uuid": "c1b2cf07-4667-486b-8ffa-2e5a224cddf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263508, "uuid": "4c8f3799-5a0b-467d-9535-2ba86cfbd672", "value": "c0afe48f74b3b4c7d6a7de998e3abba7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60341d39-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267154, "uuid": "b966fcc4-4cff-4c8c-8558-2a4bc3057d17", "comment": "Malware payload", "value": "03a4deecc574f2ac6607ac0f42893dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267154, "uuid": "df877a38-a8cf-4018-9e86-d5a561e742bf", "comment": "Malware payload", "value": "53fe9f44234da20a89f99c3049018513f8cd909c8bb70ce82f16702beb91f597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267154, "uuid": "fc300e3d-8974-4c04-8eef-f789ba80ac4b", "comment": "Malware payload", "value": "cb050ba027e7f02acbac5e98ef3f9458e8817b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267154, "uuid": "f0308329-1526-4ecf-a5ad-bb9558a5ed76", "comment": "Malware payload", "value": "6af9099ad701043a768c403eb5087ace4fd2154e9de09af8292f8a2ded6cabc2a44a110095770186f5161b4e13d6c5ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267154, "uuid": "361d72d1-04b9-44d5-9ab5-91359521a884", "value": "T137C1DB519EEF50DAF227073027EAB37716A5F8B1942E62F874844A595F30AD0CC62FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267154, "uuid": "2012bef4-d6c3-4f7f-989a-9a182879755e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267154, "uuid": "0f33a3af-7ff9-4a63-8f9c-ac44ac8757ff", "value": "96:sK7/79auICF0bzN+i6Z8r/W88mvxd3ojHrl:sK7D9auLF03N+iC8r/W8xxdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267154, "uuid": "b7b3e4d8-a7cf-4759-ac01-527f030d8a9d", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267154, "uuid": "dacc332a-eda7-44e7-bfa8-9a2fa9d7f1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267154, "uuid": "ca73b150-9154-46a6-a94a-b5bf832de08d", "value": "03a4deecc574f2ac6607ac0f42893dae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69f173b-a1e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675222229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222229, "uuid": "8b2279a7-3688-4b62-b857-94116cec0a76", "comment": "Malware payload (Smoke Loader)", "value": "bdc7ff51ade65fde49d77d149c3ab603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222229, "uuid": "dd101c2b-d415-47ce-82ee-c935a210e38e", "comment": "Malware payload (Smoke Loader)", "value": "54564a47b84c453a98a75b24bca637a2d10502ac307a040a6cdba2a990cee26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222229, "uuid": "50589f5e-3764-466b-b003-ac3cbe7d0809", "comment": "Malware payload (Smoke Loader)", "value": "bce076a5c43cd896ecb92f8f26e40cf7d89731f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222229, "uuid": "a9008d26-dc44-475b-bac1-1c4f8f6c0bb2", "comment": "Malware payload (Smoke Loader)", "value": "6fb7b0b02bc553aa86d7fd9e729b2a39807521bfff07176d0ba0cf720262716c554ad0785db99ec9bfa7c997a9af2cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222229, "uuid": "d22b8c2f-cb5f-4e0d-b040-dffc0ba2a580", "value": "T136549EC272B1BC62E9228A719E1EC2F4B61EB5534E187766131BBBDF25B01E1C5E3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222229, "uuid": "f09c0a81-a08d-4aa6-bd6c-83d6b56c0983", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222229, "uuid": "340577d7-6c09-49c6-80ac-4ba357195d4c", "value": "3072:FABtEtLGlRcf3Q8C2bcFhqkwBa6xBp4wkROyb8WWmqPUx6WfQz868X8W3MMW:8EtLGIe9wPT5kRQnmqMoIvR8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675222229, "uuid": "acabc7bd-4983-48df-83d6-6a7ea4ef2107", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675222229, "uuid": "12d3592d-e4e7-4e6b-85e0-d215fa205413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222229, "uuid": "9f571aaf-2aa5-4a1d-aaf6-a86f068e9e79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a7bc15-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675268205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268205, "uuid": "9979f6c7-073c-4bd8-a7b9-a7470d4d597a", "comment": "Malware payload (Mirai)", "value": "4096d89b9ccbd0a858e390b3f2a26992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268205, "uuid": "13aa124f-c312-4a5f-91f9-1a55111a3faf", "comment": "Malware payload (Mirai)", "value": "54c3cf0a5f8eeb2b5079e9e5a9faeeb6c32ab9082eb8501413bac5f9decb3e16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268205, "uuid": "0701d76c-7853-4ccd-bddf-ce76c8088321", "comment": "Malware payload (Mirai)", "value": "33967a7064d607bbbb6431a166337a8901fc5aaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268205, "uuid": "b9221786-c293-42e0-94de-11c1e80e496c", "comment": "Malware payload (Mirai)", "value": "b4dba2a2e453f0ac175e665d4fa580e074b55d0a0c1fab51ef8a49c9f2654fafe345aef72f12d562a5a387989ee39279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268205, "uuid": "4a8228eb-1948-4f0b-89b7-d18ecfcc7847", "value": "T1E4B2D119C0AE3E70FED77D355945E2817FA19BDF7A618DC016C15A110622E282F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268205, "uuid": "3585fc0c-5d93-4933-b122-0c9254419974", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoxSM4uVcqgw05VxJj:KApCdvwJr69VJoA8FZtxCo824uVcqgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268205, "uuid": "1db69a20-ba61-4755-a892-c629434021a1", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268205, "uuid": "ce0ded2c-0732-4fff-a206-82011628e648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268205, "uuid": "be9ee347-e447-45fe-8b6d-fe4b8c4820df", "value": "4096d89b9ccbd0a858e390b3f2a26992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa4d81-a213-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675243936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243936, "uuid": "26663c71-f512-46aa-a856-75028a1668c1", "comment": "Malware payload (RedLineStealer)", "value": "2d3577f3bc5a5971ad4f95d631964223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243936, "uuid": "c8b536ba-8fc9-479e-9ddc-35187a78c135", "comment": "Malware payload (RedLineStealer)", "value": "54ea63fd5a034285a7f3579cbf5301f0c7ca6d0c7beb98c39026e535710b1351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243936, "uuid": "ac2d5183-d6ae-4384-8627-ae02dd829150", "comment": "Malware payload (RedLineStealer)", "value": "d24443329b304031b3e3950f787d22c68e81e8f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243936, "uuid": "243821a2-db89-41c1-adaf-bcac91bd4235", "comment": "Malware payload (RedLineStealer)", "value": "9eab8ba43f3d9ec30d08860298ed2fc0861534a51283facb68bebe8e35a4ccf0f030900e1bd2aa702b35b4c053281fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243936, "uuid": "0edf9deb-0374-4b45-98ac-ebffb16bcf88", "value": "T1F974F13275A0D032C96710704935D699ABBEA9311D7A940BBB94CBBDBF703D1A32235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243936, "uuid": "d8beee5a-baa0-467d-b85f-2cf99131032f", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243936, "uuid": "7982eb6c-44d6-4cb2-b39d-8d899545c99b", "value": "6144:MSDS5wXLZXkgx1RHRpf/0EUxdZ7wfZqVpl+B9P4kzY7m9Mh7WN0:MSmuXlXkKHHfcEUTZ0fEwLntyh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243936, "uuid": "aed47c80-245d-4f39-879d-fca04e80e6db", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243936, "uuid": "086cd07b-4713-4510-ac9f-4d62efd0b391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243936, "uuid": "a6e7fadd-e5c7-478d-87f4-ec82dd9688ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11ffd23-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675279370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279370, "uuid": "84730e56-9c7c-49b3-92d8-d2453a472167", "comment": "Malware payload (SnakeKeylogger)", "value": "e59309999f471bdae10ea6cc4e41c774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279370, "uuid": "f7a2f986-135d-45aa-a747-9a77c5a99e02", "comment": "Malware payload (SnakeKeylogger)", "value": "556b9345b19fd45c3d08a046d653a5f0d216a51a77c67d92b1a64abd3958c456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279370, "uuid": "7f66f536-1743-4bd3-84af-3147bd60a5cb", "comment": "Malware payload (SnakeKeylogger)", "value": "1514f45a7915f1fba403a9d10fe47fac2f2e3c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279370, "uuid": "e32614ee-110a-4542-84b3-8205bca10a18", "comment": "Malware payload (SnakeKeylogger)", "value": "07243377ea5c3383ea82525f8f693d6bcb8b65b712d5191c1be7fd73ff62771c7118c24770e1000753885bf4318ea464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279370, "uuid": "2608f38a-b4ae-44ed-a327-e690437b3f7b", "value": "T119F4C439197617E6D339F67042E04420B6EEAC836723E959ECE636C14F329817ECE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279370, "uuid": "a95a3f4d-1579-4e3c-9ed0-884688b207a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279370, "uuid": "5665c315-ae1f-49a4-976c-c2e54d27d392", "value": "12288:SUYeQNQg+C+2SlLVseHKNTn7tunA+/kSd+70XKp2l5oryZHZQc1il45rXQJkqbfA:SmQ6hjseHKNTn7tunA+/kSiu5P1ilaOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279370, "uuid": "2d907e47-ba77-4c50-b66c-cb891a70d0d9", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279370, "uuid": "caae6b34-ccb7-4e17-b64d-cfc3bd06c0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279370, "uuid": "6a8bd62c-fa60-4e4c-8dc5-54c8893e1ec3", "value": "BOA_2301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a121bf96-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257385, "uuid": "de26e29e-b38d-4bfa-9ff0-9e8f7e18ffb1", "comment": "Malware payload", "value": "451a57f49ed13dda73acc3bc7df2c522", "object_relation": "md5", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257385, "uuid": "1cd71650-dc63-48cf-ae17-5e0ddbdf51fe", "comment": "Malware payload", "value": "56a2c110fa83576c17bef10665c7f68cc5f5b3504d952dd5d50703345b2b5f7a", "object_relation": "sha256", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257385, "uuid": "568d8e80-9dc6-412d-a181-45ac8944be17", "comment": "Malware payload", "value": "ad28696fa36d519e61dbeecf11dca42d7488e8c1", "object_relation": "sha1", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257385, "uuid": "13dd80b8-ad61-406c-96da-d5d3e1fc5e0c", "comment": "Malware payload", "value": "515cf94c3c05f42d8458ee7e89fb0699fd35f563a5accf3ec7eb039c7e260b781926b05bbd3ccf512a4916c9d34a652b", "object_relation": "sha3-384", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257385, "uuid": "1ad6717f-3573-4463-a0fe-cacf7a39f30d", "value": "T1EEF3E1349150848FE2B7253BDCA9AE529260DF417CF2EBCF5DA3190A4AD9760FD6120F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257385, "uuid": "7e54a634-9370-4ee1-8ab3-d215f13349b7", "value": "3072:bRn2FufffffffVHFbQdF8A8o8VadJP4v53fdhcB:b1ZToqabP4fhcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257385, "uuid": "86564deb-5bc0-47f3-95b1-1e7241c1d8ed", "value": 161376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257385, "uuid": "4343d3ad-8ef6-4549-9bf3-49e82db2fe17", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257385, "uuid": "48e466de-dce3-4adf-8c14-c8a98de3db2b", "value": "56a2c110fa83576c17bef10665c7f68cc5f5b3504d952dd5d50703345b2b5f7a.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7792d90-a1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675210634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210634, "uuid": "c371edc3-8141-4a4c-8f62-61d140537146", "comment": "Malware payload (Smoke Loader)", "value": "e53660cbbbc8885d6f8fbd6b43ebc95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210634, "uuid": "e67d77f7-8fa9-48f6-a46c-05eccbc07fdf", "comment": "Malware payload (Smoke Loader)", "value": "5739359446718794cbd2a9151ff92c10000b89e2aae410074a0a6cba74e3007c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210634, "uuid": "20a2953b-4d08-4410-82ab-eb45c6ba4d47", "comment": "Malware payload (Smoke Loader)", "value": "dae054a439ba0c6dcd09b9ea3887812d7c3fed3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675210634, "uuid": "2a92b0f4-9e7d-47ec-a9c9-95ba44c65305", "comment": "Malware payload (Smoke Loader)", "value": "f0fe5422126be05821d86b1e3b23ffc7766f1b830d939a9a26932857f8d2b00d9c138e9abf617fa5745e4bed0e1faf68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210634, "uuid": "bdc1f7aa-861c-4592-85d2-01db5be81749", "value": "T157547DC272F2BC62E9228A719E1FC6F4751EB9524E1D7766221B9BDF15B00E1C3A3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210634, "uuid": "eaf1b6ca-ec71-41c5-95af-86dd786357fb", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210634, "uuid": "810dca5e-df55-4876-bd59-57ed6291df74", "value": "6144:Jt9Lv0TvuOSN1rio/l3pikzhSx1+mmqMoIzP+a8M:Jrr0KO+1mojzhSv+pqMV+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675210634, "uuid": "c6bb3e58-ebcd-4c9f-b028-bcf58a74bac4", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675210634, "uuid": "a8951fbb-b6a1-490e-ad80-50a8fd9a48d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675210634, "uuid": "469f229e-4e0b-412d-8a91-1162545fdc86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85131a91-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267216, "uuid": "53b77ac4-cd4a-47f1-b9da-e98296e35ed9", "comment": "Malware payload", "value": "dd5ea000d69e9ff0c2b681a3a22a388f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267216, "uuid": "879a5814-88bf-40d1-9bde-50d94d6cf61b", "comment": "Malware payload", "value": "57963258cbbcd26e8c38722fe8a9dc8404538ff2f73bf7728292fcef8e4a3dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267216, "uuid": "d8bf7240-aa40-459b-8454-ac8201f58625", "comment": "Malware payload", "value": "a0d7c93e5475c55684bf9d7a68bd068972ee1fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267216, "uuid": "55447b01-753b-413d-a39c-02ec1aa7542b", "comment": "Malware payload", "value": "f156e64415f5956a3fc40826c7b462b66031ff5957953494a67b34e35d0f3f148b8abefd424d137224c84c0820044294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267216, "uuid": "a35bfbcb-9b90-45c7-94dd-99d04693a409", "value": "T14D957D20764888A6C7130E32BD49F27DF2AC967007B541EF5296AF187D77983B624D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267216, "uuid": "c244e2e0-e577-463f-9b5a-a81ce122e02d", "value": "d93b87dda4f9983816147bbc6eff077e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267216, "uuid": "026454b8-44d0-4c9e-b6b5-3cdd534cc195", "value": "49152:ZgfYCj3AI5NFMIuxuMWIdMtiZZi/r+Kz3+ULkNVAjbOPM:ZgfYCLAUHwuMbis3i/fz3+ULkNGjbOPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267216, "uuid": "3879c114-154e-4aa0-bc6f-de47af7c5d1e", "value": 1959754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267216, "uuid": "b3f87c9b-27a1-4f1d-b87e-e7bd898afdb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267216, "uuid": "d3baa71c-9527-4041-87c9-7ddadf7df3c6", "value": "dd5ea000d69e9ff0c2b681a3a22a388f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dff2cb-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675262554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262554, "uuid": "c40de02d-9a49-42d2-a94d-72a78ec379e9", "comment": "Malware payload (Rhadamanthys)", "value": "f185a5ab0d02164e334903e2eade5ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262554, "uuid": "1f3c1df6-4dbf-4e95-93df-d14da3fec536", "comment": "Malware payload (Rhadamanthys)", "value": "57d04caf34e3105fe2115bf0201cdae955eaaeb8f36c4b1465c33f993a70a5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262554, "uuid": "082c8f46-58db-4323-99b9-fe11743c429f", "comment": "Malware payload (Rhadamanthys)", "value": "673b118e539d748a1594d6ef89af6a5af105a1d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262554, "uuid": "d2b1af66-cd84-4aed-905b-9eff49b083e7", "comment": "Malware payload (Rhadamanthys)", "value": "43e19d96e7c58df1f60b01b57bc55cdfff2a221731c2977ac08ba4d61cc25a349e47a55766587c939171d0ce2cce1537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262554, "uuid": "a1c20306-5129-472c-a117-1a230f6137ff", "value": "T16D74AF12B2D1BC40F56687758E2EC6E4F51FB5D2CE08A7662318AA1F25B32B7C763311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262554, "uuid": "ca9e1267-32f9-45de-acf3-7fe2d6d40683", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262554, "uuid": "b384417a-c10a-4b98-8603-6fef9050658c", "value": "6144:3XAfLHD0v22SX12TXZqWBbjZygYywck7f4VZx7:ncbrj1iZ5b1yRywxzOZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262554, "uuid": "72c352a3-5733-482a-b14f-c71b359688df", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262554, "uuid": "9dfa4c58-f098-4d4d-8b3b-b21ca8d40ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262554, "uuid": "0c315046-9c7e-42d1-87e1-53eb3f206076", "value": "f185a5ab0d02164e334903e2eade5ef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59937e09-a251-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675270579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270579, "uuid": "e4c0c8e0-2535-465a-a69d-e75db3449918", "comment": "Malware payload (Quakbot)", "value": "7e150e6c6ca9f318706651411f6afa37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270579, "uuid": "e74f9ff2-7978-440a-8c2a-04542943d031", "comment": "Malware payload (Quakbot)", "value": "57f86a03dcb2a9ebdd6d7184201cef6ba9d70f57aa524682857d4e7a27ec57ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270579, "uuid": "54eb303f-b5c9-464c-b1ed-6136a5f2008e", "comment": "Malware payload (Quakbot)", "value": "332c4de637e639b4818a03ba1ccb96e6d91a91bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270579, "uuid": "61e22ce6-1e57-47a8-ab5f-70efec57c1d0", "comment": "Malware payload (Quakbot)", "value": "12aebecb932e13745d640a40e3ded9f8781a8a3e9f0ab08aa3266f73bf30f3d38f10c10bd3f246f624bb3e86fdac8779", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270579, "uuid": "bc711bef-23c3-4b1b-a453-49d56aef507d", "value": "T1ECD48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2C29DD139D1B64930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270579, "uuid": "8cda2ac8-ffc1-4829-9c85-f70c56794123", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270579, "uuid": "ad7e6842-ac73-4b06-87a2-04b4c6403e03", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTr3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1tXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270579, "uuid": "5ebc630a-6730-40a5-896a-554d8f4c3e25", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270579, "uuid": "009c7277-c79d-4fad-baae-b66b55d89a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270579, "uuid": "b3a0f434-e799-43ef-8965-fe105b3710ff", "value": "index1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa83892-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "17b233c5-3b33-47d8-9bb3-880c3dfa1390", "comment": "Malware payload", "value": "537de6ee0a72601be1e1e452a3010954", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "6f05e9da-2287-44a4-9b19-09e62459c863", "comment": "Malware payload", "value": "5826818bb43d41f6bc08722f036f3f9402dd53b6e6d6356caa5192fadf278451", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "746aea0a-7d48-407d-b95a-9f92ae0fca30", "comment": "Malware payload", "value": "91f87bc5cc88249811dfcd130ccc2ca907eee2d3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257132, "uuid": "52270b1c-7cfc-4bf4-942f-be241ecd20d9", "comment": "Malware payload", "value": "98a4e9c47bce2ae7ee42f9ed455466602e4aa0269213e40713f2795220ff43578acd4cffc402533f276b5c542f15323e", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "45e338e6-366d-4fe5-bd0e-a5b4ec34d90d", "value": "T159C3192027DD8726E7FEE779F8B006110FB5E916B573EB4D5E40806D1DA6B805A213A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "f429a382-5c5a-4c5b-a7ee-d279820fc4a7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "1c5d0c38-080b-4b08-890e-23361dbe8706", "value": "3072:nYroBKFuiSfBStfhXjCjjETsm1cGvyN0rtmfeJyLG3CE2F+46tD1C2Eo:nwSfBStWnGvsPfeJyLGGKD1C2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257132, "uuid": "e607f773-88ab-41d8-a411-fe18aaee0a19", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257132, "uuid": "2fce0b47-9759-44fe-b5ff-4d4e630bdb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257132, "uuid": "53b918d1-83a2-4803-bae2-1dece8430f18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731c7edc-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675238839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238839, "uuid": "6ac538d2-3f84-447e-89d4-e482478d2e64", "comment": "Malware payload (DarkCloud)", "value": "d264f7901f3200682872190fd7489b7f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238839, "uuid": "b1d1ae35-1512-47f2-97b3-f54f3c9d3623", "comment": "Malware payload (DarkCloud)", "value": "586351cd027abe49609dfc262b07d57c8db133910867943784bb6c27b2a48a36", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238839, "uuid": "14bc1556-2575-4e47-a373-f169d0278960", "comment": "Malware payload (DarkCloud)", "value": "99b63b06d865dfc6cde1eb9423a4c50320418a5c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238839, "uuid": "2183fd60-ded7-408a-a5c1-b3ccfbfcc1a4", "comment": "Malware payload (DarkCloud)", "value": "fd625bb5eadbef53f5c57e8d95c4a37fef5c5fe2523a66654fe6ba8d2d98050d267c0b27027faf7f31d7738eb678e391", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238839, "uuid": "31341041-a7cf-4af2-a610-f3f386d0dcc0", "value": "T139F4337AF8632A23A17C629004583646949FA3CC74CC6DE464CB77B4EE47F790CA1D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238839, "uuid": "24aeb7d2-d5a4-48a3-a22d-38746749773d", "value": "12288:wGV6NzVIZjd15iyOE9x5h7xuNVsTztIp4eh/DipBWOinKipbRpv7+p5SlT:wGV6NzVmXiirkV2ztIp4mcWJbplpv6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238839, "uuid": "40442a95-b7d3-4f49-8742-d99e46197546", "value": 740259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238839, "uuid": "5ee1e23e-1e02-4177-b9f7-3f6697d84016", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238839, "uuid": "f5c23113-b6e9-4049-91a6-256fbabaeb51", "value": "TRANSFER_REQUEST_FORM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3484d3-a211-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675243148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243148, "uuid": "6acdff40-1860-4037-bde1-efa85a4fa149", "comment": "Malware payload", "value": "76977248a7b34ad531b61fe7778acc5f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243148, "uuid": "07a4c88f-6b78-467e-9c0b-5a02eedb41be", "comment": "Malware payload", "value": "58d0743c87e07ab4c8910c370a164e90b1ba43c8192d54f376f80142c59ea285", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243148, "uuid": "a87b488a-f675-46c2-a40f-c6df700c7ec8", "comment": "Malware payload", "value": "d46b4e1a9531d5e8e3ca19c2e69476f2077f8a95", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243148, "uuid": "dae3053a-11b3-4218-b30f-ca0876ded482", "comment": "Malware payload", "value": "b05b3a20d2145b1c16c44e58abf867db0d21f7b56d28ad1f2b30d986ccc24e5ee2dc5d6174299540222ee7097175655a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243148, "uuid": "ea67ffb8-f560-4148-b0a8-c3c100446fd5", "value": "T18CC002439A1E5C44D5D5977C754309515D7740D0D07D539B540C5241498B1957C07F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243148, "uuid": "0eb4b521-226b-4398-8892-e3c1bfc572ba", "value": "3:vhjCrf4qejtYrnPlt4qezl+l0llt:5jCrwhCrIBl+lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243148, "uuid": "76e063eb-ace0-462b-87a3-c90546474974", "value": 134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243148, "uuid": "0a63f42c-fd79-406c-9e8d-dc9e9c1f79ba", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243148, "uuid": "10b60653-e431-42b3-970a-270ca2b06547", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945a078f-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675262088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262088, "uuid": "f853ee02-fef6-4d54-9e93-7abebd37a8ae", "comment": "Malware payload (RedLineStealer)", "value": "ac08d04e9fafc4bf8d4ae8880dfc6736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262088, "uuid": "9ff6e134-c61d-478d-9a91-59986946a61e", "comment": "Malware payload (RedLineStealer)", "value": "58f3394fd637f0849ee49b99dd66b868c12d8386f47fd39821a0029f4b0fe5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262088, "uuid": "b6e4527d-672c-4971-bb73-4ec920802643", "comment": "Malware payload (RedLineStealer)", "value": "48d5ea799400caebc1f2c572dec2813fd9e46893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262088, "uuid": "18fae0a9-634c-46f8-be8c-92ec70fb397b", "comment": "Malware payload (RedLineStealer)", "value": "9fee0a521c0c61541cda27db1455671d26f3de9e71c7fef7eb7d95dd087b831daff53cc27a5eac8a1ea4034c2fbfe789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262088, "uuid": "43e6e922-cd98-4cb9-91a7-c414e083865f", "value": "T15A74F13275D0E07FC6B301709D20FBD46BBEA5311979480B7B58066E6F70AD1AA7634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262088, "uuid": "9b7a2a0c-9ea1-4912-b13c-ae1a1bbb259f", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262088, "uuid": "ce6d725a-509f-4fb8-a3e5-4327a3e767a8", "value": "6144:mWgsCh9LiV+7+d4ZRewkF6CB4c0QjVzP05/cdxpx1mM8a8YH2PqXaUx7FN2:mWXU9WV+7+2eNF6CKcpjVzP05/Chlv8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262088, "uuid": "d70de9ba-5aea-4e73-8a97-fd3f5d3a383a", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262088, "uuid": "b94a8bbd-a7b2-4c76-8cc6-d3a56f362ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262088, "uuid": "2e74202e-0958-4430-9fcf-0de0cff1c9c2", "value": "ac08d04e9fafc4bf8d4ae8880dfc6736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2c543c-a259-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675274207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274207, "uuid": "adf3c6a0-1088-4aec-9e96-91185cda58f5", "comment": "Malware payload (Smoke Loader)", "value": "bc5e88671bc71a11534fdfe38cca5d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274207, "uuid": "859c55ca-9bfe-4003-90bb-04c39cf9aab0", "comment": "Malware payload (Smoke Loader)", "value": "591f15ddc3382fae068f91ee3f1c05f3de36f4b149e32b0160ffa8fa4cc84ac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274207, "uuid": "41e3b8db-bb41-41e3-ba4a-ba6064d2f8ef", "comment": "Malware payload (Smoke Loader)", "value": "c6e9123b5904ee5f2e2d8e926048f371afb4b14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274207, "uuid": "d54336ad-fbed-4174-8f8b-25d75ddf93cd", "comment": "Malware payload (Smoke Loader)", "value": "b4220f7633a64d757fd03e66c99137ad8721fd54799516491ec2ac6cafc2c859a13425f333828c6512f11e97337d526e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274207, "uuid": "7ed96c44-6cec-40c3-a83b-e7a9fb1bd904", "value": "T1A034D02279D0C032C17750709860EAA67BBEF4311975958B7BA8CBBE5F302D1663B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274207, "uuid": "abbcf4c2-2a81-4405-8dfb-f6fe8952e34d", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274207, "uuid": "08315efe-3f18-41d1-af7d-ee76773e6739", "value": "3072:ojAL691LLHFLvcGWfo5M024zC10ok034CwxIA34syukbWbtBaugwd1:oj1XlLvcG2j024DoPRAIc5VkbWpBanc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675274207, "uuid": "059d7371-a514-41ee-a309-a51d6c7cfbca", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675274207, "uuid": "6a51de6c-1da6-4eb3-88e0-db9be8ce1866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274207, "uuid": "ccaaf22e-61f6-403e-8b8f-ee70d7a8e8b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7bf790-a21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675248009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248009, "uuid": "4bd72539-eeca-43c9-bcf7-d224b3f3c174", "comment": "Malware payload (Formbook)", "value": "46d06ae2b3a333893520f095be0113a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248009, "uuid": "85b6545e-e1b5-44a8-aee7-d7dc2c5cab81", "comment": "Malware payload (Formbook)", "value": "596582af66790eee7160b485c4fa5d060b3c820af83343fe4c12fa360043a09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248009, "uuid": "08fb0db0-2d34-41f7-8dc8-1749eb97cd60", "comment": "Malware payload (Formbook)", "value": "221a2b523a9f1b13488b0d30f8e7eebf32270500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248009, "uuid": "052ff707-da42-493c-9bdf-a123b398c529", "comment": "Malware payload (Formbook)", "value": "a9b5728c4a91c3768ddae8992d093dfbbe8f3b744f0b35756581e343b4c185fd0d915d5a854bfe55a69c8da335a64e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248009, "uuid": "55676a96-42ed-4874-af04-4653ee36b0ee", "value": "T16F541225B2D0CAE7D1E353361A7EEB26BEF9F12418E143177360075879622219B1FB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248009, "uuid": "b82dd68b-4a9c-401a-b116-d66f957ab115", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248009, "uuid": "2aaec7a3-b8d0-427c-af60-44b6e8b73ffc", "value": "6144:/Ya6DihnwmaL1YHiqRpakcLl4+FheuO7iI5/+ikkkkNhZ:/YRiJf7HigpeDjTh8LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248009, "uuid": "2820c3bd-e052-4e07-b765-98043e76ef02", "value": 282094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248009, "uuid": "0fcb2f1e-8712-4d6f-a1c0-80de17874d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248009, "uuid": "00f71940-9d02-4c00-bc4e-b35e4ae79774", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240b357e-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675278650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278650, "uuid": "4adb3021-d7ed-4939-bad7-ab3109ce6817", "comment": "Malware payload", "value": "c92bed4ca1a4428baabe335ba9fc4441", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278650, "uuid": "9e5191d1-975c-44f3-8acc-9b4626242642", "comment": "Malware payload", "value": "5a2f8b1052c24cc34202efc22389306a559a0ec6f59dbfb572a39b48924e68d5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278650, "uuid": "5a7e4fdf-d012-47e9-b123-ec6c95ecc973", "comment": "Malware payload", "value": "d50f0aa002a4c0d9e490795821608e751f896be4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278650, "uuid": "10d25c0c-7690-4a8e-8435-548de1c50af0", "comment": "Malware payload", "value": "01aacbb07272dd52f61ef4c3dbb2da13f447ed32fb3c0ebbee626b0f9fbc55d71e1e8c304317c33625d01377d4611778", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278650, "uuid": "47de3ec5-40dd-4a88-8407-4e920ac1ed4f", "value": "T1E8228C2EC504FD36C323057DE12842F4F35C506ABA52B95D1841F29D4FA06C757DA6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278650, "uuid": "1f5584f0-0b3a-4415-afd8-e0c20e23c92d", "value": "192:ScIMmtP5hG/b7XN+eO1GLmUO+5+5F7Jar/YEChI3tN:SPXRE7XtO1GLf7wtar/YECOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278650, "uuid": "aa77fc15-ea15-4dc9-8ef8-fc2761f2c6f3", "value": 10368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278650, "uuid": "6e66fbaa-55f8-4291-9d04-b24ce21fee77", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278650, "uuid": "33184172-86f9-4856-91cd-d2465c9da54c", "value": "DHl_2023010299265.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102ba906-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675257142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257142, "uuid": "7f84abcd-b675-4739-9487-3f938a2701a0", "comment": "Malware payload (Loki)", "value": "2ee13ecd998734cd7fc80b882c7c3eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257142, "uuid": "58a4bf86-5ae7-4a1c-b8aa-2b2ae85b3c17", "comment": "Malware payload (Loki)", "value": "5ac52f3fe1e191e4f6c6e8f4ab8c5137dae75af22fe37a858e6b09add80b2dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257142, "uuid": "66d2b3b5-7df2-4a88-82f9-7e40c381c3ea", "comment": "Malware payload (Loki)", "value": "93b675eeaf1da0de08d0ab9390baaf8d32967a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257142, "uuid": "29245b74-1388-4745-a308-048ccafd97bf", "comment": "Malware payload (Loki)", "value": "c6647aae1f8051738a4e67bfaaff5c8a90756b13af2b6e8478d05d0270a3f0e384c2119ddbdc4623af6799b72c1cf6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257142, "uuid": "dd316def-774c-4be7-9f07-82a856489126", "value": "T1E304020AB7F0C89BC6730A3359355F27AFA4E52555B8830B2781975DBD227A3E60F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257142, "uuid": "828001bd-de62-4ff8-ba01-fc6c150a797e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257142, "uuid": "97660f2c-f235-432e-bf9a-de2024713aa9", "value": "3072:XfY/TU9fE9PEtufbLiHGXEXWKo+Gov1DANq78+ZzhPKfl/Ih3nU0ewEIcqEFYdUm:PYa6BeHJGoe478+ZzJKd6XU90hEF80No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257142, "uuid": "3ff962f6-c3a1-44b9-8d13-fb25830b8a30", "value": 188282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257142, "uuid": "e833d06d-94d3-418a-a60f-9b08d944d5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257142, "uuid": "b3db5ffc-7b34-4d99-ae2b-91ffc2b36ebe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c323368-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675240197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240197, "uuid": "6c6e527a-1842-4a67-bc3e-cfa5d87d31fd", "comment": "Malware payload", "value": "fede1aa8be0e7a4d98039f08a0efb4a5", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240197, "uuid": "f6e6305c-72a5-4107-9843-6d9431074170", "comment": "Malware payload", "value": "5b5a2ea7a2530ecedee3bbdb5a7a200f939914c90e2500d11a9bd1ef5b61682f", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240197, "uuid": "790851a7-d934-43a0-95ab-2e1a968dd9cb", "comment": "Malware payload", "value": "2c0c8f05317f46d2c97ad018e31da626bfa78042", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240197, "uuid": "5ac12df7-0559-4d52-bdcb-30f2e4b2a37a", "comment": "Malware payload", "value": "db316990f1b8e27c2b0597bffd4d7ce95d13e8ddbb76d550ec44d3c28e9067b8ff483285fbfdf161aaadeb7bb2e4c761", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240197, "uuid": "a427aca4-d903-4bb1-8464-3b8e9d51e55f", "value": "T17362C14211C653DC6A6245E7F72BF2BD7B029997AB814A99C8908447FA33C8754C1F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240197, "uuid": "a28b3df1-114b-4e2c-983f-cf02be3bf9b5", "value": "384:JXl49X76lqDLSviKlIJvyNRJ2RpllzmBWgYfYuJnwjrtKQ:k9X+qDElIJvCJsl6BWgYfYqnwjB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675240197, "uuid": "1fc49973-ea33-4347-8dfe-3febcd2fbdfe", "value": 15934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675240197, "uuid": "405f2284-308a-4cb5-8811-895c59c4d9de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240197, "uuid": "afb21082-65b4-4ce5-9071-20b583f3e93b", "value": "SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a370d15-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675267117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267117, "uuid": "51e0b8af-c0ad-46f6-ae13-51fbf6f09850", "comment": "Malware payload (AgentTesla)", "value": "0f7ed787db34d4d248ac655aa56b3e55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267117, "uuid": "82680614-d001-481f-a676-6a05b5b567f2", "comment": "Malware payload (AgentTesla)", "value": "5b62fd08b3a979449bc21a217e7057e710e5a66ab1f4159a935db45629e24156", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267117, "uuid": "29d9b107-673f-4159-a1bf-501c9848ee93", "comment": "Malware payload (AgentTesla)", "value": "e027702ea6c656212708c39a28d90f1b2d37a184", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267117, "uuid": "43e68ff9-ff8a-4e63-9da9-ce60921893e9", "comment": "Malware payload (AgentTesla)", "value": "a8187ac6a3ced88089893218e9b124a02e681695b82ccca8b23acb70119dae64c68f3fffceb2623d6f24012e479c18d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267117, "uuid": "da1bbe0f-722c-4459-b522-2ddc4ad7d07d", "value": "T1ACC4230023FC976AC07D137D58A7EA3083F5AEC4B64BFA489F9938DD195BB841B51B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267117, "uuid": "45d2c791-6929-4241-93e1-d948a8a9edbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267117, "uuid": "6d47a334-a99f-4644-81a5-dd1c6e817545", "value": "12288:Mr8z9i7+pvGEnUwAXXh43cLFMtlr0S3RM5s9LICWtO:Mr8zw6RrnSXLLF9GCKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267117, "uuid": "46309fe2-fd3b-4d7d-be88-db08659f0f2b", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267117, "uuid": "1e60f415-9ecf-449c-94e5-6f50abde1fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267117, "uuid": "58d64213-ece3-49a7-92ee-722badb1edb8", "value": "0f7ed787db34d4d248ac655aa56b3e55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1462a3eb-a20f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675242116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242116, "uuid": "ceae1343-cf61-4c23-a113-d527678dfe21", "comment": "Malware payload (AgentTesla)", "value": "4436a63515e866000d52ff33e8df0571", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242116, "uuid": "a49295a0-6671-46ad-9b4c-550d47d4277d", "comment": "Malware payload (AgentTesla)", "value": "5c3700ed8b42e69c59ef0436a07b2ec24b6804fc2e129d9b332c79160e648bb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242116, "uuid": "48e36e6f-c965-4c36-b9a5-2a97ec0ec4f9", "comment": "Malware payload (AgentTesla)", "value": "372c6c445c3d873881349f47fe718335634a661f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242116, "uuid": "e9c45869-0253-46c2-9e9c-b9c41577a9bb", "comment": "Malware payload (AgentTesla)", "value": "e5cf5c2bc56dd5a79bb7ab88a81c7f2b5aa7d43df78eb98c52c2117617bcbf5a66d4128f979cc1fb61fe45f6bc55133a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242116, "uuid": "64fe8ac7-b6ce-4f2e-9294-1dd15224dd01", "value": "T19DB423E6D730E9BE2C532406F15526B24B153D41A1D72BA64846B394E8ACFED3F33DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242116, "uuid": "19951c70-901f-4071-bf4b-77a8f1daadee", "value": "12288:hDDIRVgqnZ+2/zb0w1xt1yLDtGPFauZ5UpnQqT:1OVZX/0k5yftGtApnQqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675242116, "uuid": "89f082ad-1b8c-4f4e-a7f6-449c3700482f", "value": 529080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675242116, "uuid": "cfb32bdf-192d-487c-a7ec-1deec729e84d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242116, "uuid": "1deecee3-2b49-4c0e-9514-a73d64617071", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b351282b-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675259133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259133, "uuid": "52725b27-7db8-4d45-8968-83b2ecf862b9", "comment": "Malware payload (Mirai)", "value": "4bada833b2bc07697247fae7571ba3ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259133, "uuid": "e330395a-62dc-4077-b1fb-eb1197a091d1", "comment": "Malware payload (Mirai)", "value": "5dd3781a8e21af4c0879c616af3707b4cf6644106491bb1921e3969ec2dc8b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259133, "uuid": "6a138355-1187-44c7-b1a3-6ca91541acc2", "comment": "Malware payload (Mirai)", "value": "cfbb3eb9911aea7539876772b4f08de173f932bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259133, "uuid": "c1097f72-8d5f-4cb0-9b74-e4091b740df2", "comment": "Malware payload (Mirai)", "value": "535635a983fe9f042c931de88908c252419f816068ec889a5c672f4552120e106362ac2e3fe5567cd29ef0ba393c8e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259133, "uuid": "2896b7e6-8ad9-4ac4-8709-dff2253e4ff2", "value": "T199D2E1026641FEE1C5B00232EC678A9B72253D79D1D134FA973C0DF8A6E9A1D47F9A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259133, "uuid": "17af4de7-3645-4db4-9780-767f30eb0cc0", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgy9q3UEL7w:WRwynNIOQQ1KMwnLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259133, "uuid": "8d45da8c-b279-4ea0-b378-c77d9e97533c", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259133, "uuid": "1dc0c767-a67d-4bf3-9b54-8e53e08ca84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259133, "uuid": "423dd260-f073-4026-b5d5-a96ff37b482f", "value": "4bada833b2bc07697247fae7571ba3ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f757fa9-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264173, "uuid": "e973c542-06b9-4ca8-b410-16692d16e3f6", "comment": "Malware payload", "value": "a2f1d02b9f6e41f0f48935e0d3ba3f74", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264173, "uuid": "7d30216e-941f-4fa3-b367-e232be2f56a8", "comment": "Malware payload", "value": "5e7ec1f087859d81c27504ad7be02fb726e2167e1d35984cd413c90e83e9956a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264173, "uuid": "92caeb03-9d9f-48bf-bb9a-cee5e12ab5db", "comment": "Malware payload", "value": "f98bff267bb3e2808f46f7ed187b08c186aef781", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264173, "uuid": "804b59cf-aed8-43e8-ad1b-b5492828cbd5", "comment": "Malware payload", "value": "f5edd7d0c68cbc30a23906c433f97b2c710a57a11495f606b823f4df6fbdc916255328d4d0ff497f9568e75f74de48d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264173, "uuid": "eb30c19c-d615-42f8-a79f-5914b303e179", "value": "T15135BFF876047DE6266F576BDA96ACDC037626639ACB94CC8064BBC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264173, "uuid": "139561a3-4c02-4725-8fc2-4d1f8daacff8", "value": "24576:heX7tl05bVh6lkEgF1seoMgnN7O7g4CBICf5/5CiSUuqWBcxaaTuQOC77N+:U54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264173, "uuid": "5c713133-3a26-4baa-9355-aa90a6c2e35a", "value": 1161349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264173, "uuid": "679fffea-3764-4602-8251-966bf6e519f8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264173, "uuid": "e0a88250-0488-443f-af5d-94f963d9837a", "value": "RFQ-SO-23010028-Tematsi_scancopy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6b2a35-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675264225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264225, "uuid": "b979416d-32e9-4633-9c36-98f19e3ea225", "comment": "Malware payload (SnakeKeylogger)", "value": "51505dd088beb3a3406dab4bcfc0090b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264225, "uuid": "c677bd6e-694b-4935-9e4c-4fe53fe0a7fb", "comment": "Malware payload (SnakeKeylogger)", "value": "5f16e8c1fef7f5f311b814b10f7b9e9b1ec3c204075fb8bb48ac207e256ea208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264225, "uuid": "b458ddec-2bec-45d8-84cb-3cac08215f4f", "comment": "Malware payload (SnakeKeylogger)", "value": "7efb628f6b348b0f19360241f3f0661419617bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264225, "uuid": "4d59f2a6-ac9a-4be4-8221-ace3e369ec2c", "comment": "Malware payload (SnakeKeylogger)", "value": "c3dd4f1aaf9d4cb6101bb8e66535b27f71711778a72770087991707a980ef97c9d3d1464a48e7ff41213144e7ffe40d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264225, "uuid": "b9fa9256-6dfb-4279-9943-bf517700241f", "value": "T112A48C2BBA44622FF4ABC6F108266A63B5356D251FE06C0F63815F5A3871263B1F570F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264225, "uuid": "1b9da19b-4b96-4945-8c36-c3fd00caeb24", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264225, "uuid": "0dc4dfce-2beb-4762-949c-5b6973197a1a", "value": "12288:GENN+T5xYrllrU7QY62YrTNbwcD/xtDmpfJuB3:K5xolYQY62YrZ0nfs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264225, "uuid": "8477ec04-79c8-4245-ac20-68e343fdac23", "value": 472700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264225, "uuid": "2902c050-fecd-48b6-a8d7-85d3e162c37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264225, "uuid": "4344d345-06e0-4754-b24a-7be0357e3cf2", "value": "Halkbank_Ekstre_20230129_075423_612150o.pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ff33f3-a1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675229563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229563, "uuid": "77943cd9-ab61-44c0-aa23-acad685de6d5", "comment": "Malware payload (Smoke Loader)", "value": "2c69d7847c6cd6bc07073adcac004616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229563, "uuid": "bf36a05f-79a4-4278-83a2-983bff8396d8", "comment": "Malware payload (Smoke Loader)", "value": "5fe495c1b5effba238f87a08843ea700e45426d5a10c75f8b17ed98613bfa250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229563, "uuid": "3bce75c3-8d7b-4503-911c-708cea573ad7", "comment": "Malware payload (Smoke Loader)", "value": "07c11b234baa739fdbd0cf3b1de80bde66e4cf44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229563, "uuid": "728f02d3-16a5-4e5e-8ae2-689b3f2157c5", "comment": "Malware payload (Smoke Loader)", "value": "e161e3db381e57d6fa7799b27f2aaa9304f4d8dba48c069cfec5dc15842b502385d4411cddc4bb631439c87869828155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229563, "uuid": "807229d1-aead-4dfd-a1f0-e3f9ccf110f7", "value": "T146548EC266F2BC62E92186319E1EC6F4751EB5524E387F66231BEBDF25B01E1C5A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229563, "uuid": "a0ecd63c-cdb1-40fb-b91c-a62842888fcf", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229563, "uuid": "2b3efd5a-d6a6-4154-be45-f890631e41c3", "value": "6144:LkNL7DuZWIgfBHFgpTP3TmqMoIAjYd88M:LeHhJATyqMS0d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675229563, "uuid": "9350953c-abe1-40fb-99b3-a1fb60729c2b", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675229563, "uuid": "9afc71d2-4308-4926-bd1c-8237c8763b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229563, "uuid": "28b58b6d-99d7-431e-84b2-6ba7f3657463", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df731a2-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675239233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239233, "uuid": "2930776d-0bb4-49bb-9536-b5fa9680264c", "comment": "Malware payload", "value": "cb24a5f7ecdb871ce971af4de1a28efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239233, "uuid": "23c6be31-72e7-4a34-afce-c01f85607936", "comment": "Malware payload", "value": "5fecc5be9e3d2116d07409d2011b7d999f8da5e773022afb4850bf906d2e54ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239233, "uuid": "5d0766d2-c078-42cc-ab5e-4a1ef7df7333", "comment": "Malware payload", "value": "60a854c40ded3127eba91dc1b6c934628f453337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239233, "uuid": "f7c5ea94-f1ad-4d8e-9d2b-8e428cdfa39c", "comment": "Malware payload", "value": "3d12617d2825c524a6d3b8783cdfeb34ae8982e283d1722175ac5977f32e3fde0af7c894351713e5ab6ea78988c422e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239233, "uuid": "22fbba09-a037-4fe7-85c2-fd34fab61798", "value": "T1BCF4E0057A478165C2F156B0383F849047EA3D7A2BE9DD1E394AF78B0AFB39105E5E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239233, "uuid": "535ceeea-1900-44f1-b1f6-8168eda39ca9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239233, "uuid": "da81229b-1d89-494f-bb0b-23b225f8381b", "value": "12288:VQi3pRXc6m6UR0I6p1hf39Wkv8xwJiWt6uIn:VQiZ9zHI6pdUMic6uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239233, "uuid": "4e265108-ec17-4579-8ac9-77870cf2b7da", "value": 776461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239233, "uuid": "a2bd9917-9dd0-44e5-acc4-7314ca00926a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239233, "uuid": "c205b928-3ec4-4b70-97af-68110352793b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff022d0-a201-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675236284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236284, "uuid": "38aebd9f-2641-41c1-8264-13d7e06c40c8", "comment": "Malware payload (Mirai)", "value": "da1e64e4e98d97f09130fbc7f94d69c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236284, "uuid": "eaf28202-ef2f-4d51-a01e-69b7779820ec", "comment": "Malware payload (Mirai)", "value": "6005bdcf6b3f7fe83eafa47607b0eaa427d414908a8d78c4042fcd1ca9056585", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236284, "uuid": "dfbe4c51-8111-48e0-babf-7df8a2e64d0c", "comment": "Malware payload (Mirai)", "value": "1a0f366536cea0150bc2df5523a547054fb82c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236284, "uuid": "cb055614-52fa-4831-a9df-7a5dedf9c7ed", "comment": "Malware payload (Mirai)", "value": "edb055cc1d3d918b1868a223194b1ee33a2906396fa0c8cb7240cd0acf3935094e03305d64db43c2798f298c13e5b647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236284, "uuid": "4b7f5a07-568e-480e-ae54-e02631903be4", "value": "T1BF833B3576351A23C1D6A67A21B78731F2F4668E1CB9C72E3C621E4CBFA11D02257F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236284, "uuid": "93d7f001-dd04-4b60-b6ed-f66aba7d8583", "value": "768:5S335O4Gs2cEW2GmUqLoVyX3OY/D9cjlrb/WkpQMnGL/j8ejTyMxO+s5aJ9MDsUg:5e3wuqUs3//mjlrqMnSKus5a7MHt2RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236284, "uuid": "227feb06-3faa-4703-8e57-7c2b3bd2b197", "value": 83880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236284, "uuid": "9560fb5e-af7c-4318-8f56-9e69d4f552c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236284, "uuid": "f5849366-ed55-480c-8318-d934280b121b", "value": "da1e64e4e98d97f09130fbc7f94d69c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b6e348-a22d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675255077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255077, "uuid": "310f2e7c-ba4a-42e6-8e55-45c82b7ae9f2", "comment": "Malware payload", "value": "6218fa7e494e039ea3c71cd81d0e23d0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255077, "uuid": "bd62fa0c-95cf-4e21-824e-f5662d1bbef2", "comment": "Malware payload", "value": "6097de45c0c390875a3192b79f58b57d05592addaeadfd332c928f4d92494b6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255077, "uuid": "827858ec-a814-4ab5-84f9-1bb80517a189", "comment": "Malware payload", "value": "66feae9d5e9b040a1beeba40b0bae56b05a05c32", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255077, "uuid": "7f05eefb-8075-4b8e-9b44-7fc222f2d73c", "comment": "Malware payload", "value": "515f34706309edac5a5c069264f2a3231984861bce8632ba0cbbbf411ac87626ceabaa2efa535d1a589ebfe09d1e3537", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255077, "uuid": "ab132301-32fe-4184-9378-06b917d53d7d", "value": "T1F28236666AB44C61F15AECB7471E600E15BFF43620C205C4BFCDD7B4767A10A4BAB2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255077, "uuid": "0e0444f5-0394-4736-a619-27abe68311af", "value": "384:322e3NHe79ScXfsffJR+RXrpinJWfGX0jyPACqJ1Y8jF:G2meRHXCXqdyrq7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675255077, "uuid": "c3da6e18-c257-4340-996c-e6d1d9b05363", "value": 19110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675255077, "uuid": "262e05f2-2787-4d7d-996b-7cb5e0f1df84", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255077, "uuid": "6d0663f5-527a-494a-9d63-99a6f7e2f42f", "value": "_______________o.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262ff4fa-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675266628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "bc83c795-0649-43b9-990d-0137922b7402", "comment": "Malware payload (RedLineStealer)", "value": "d89985fb0374da504e9a0d426d1baeb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "9cf66585-7975-409a-9f09-2b185d1263e4", "comment": "Malware payload (RedLineStealer)", "value": "60e6ce0b81e5896b7611674ff322a00349c79d6155e03d37e1787c14da897ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "6c28ed39-32cf-4dd6-b52e-d9fcf58fb99c", "comment": "Malware payload (RedLineStealer)", "value": "98d61649c2f4cf6f5fc9a49d56036136cf1ce8b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "8e7a1e8b-0441-4784-a69c-78026593f687", "comment": "Malware payload (RedLineStealer)", "value": "fbc1d5f2720886c2695180161918f8d6066ca67bc6c3766b44b7a2061ab830963fad24736e280c2da9bf5c2471e507c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "f94325f5-2fdb-4f19-bfca-11a084ea1c51", "value": "T17EB437116E809322C4EE107C4734D5E6676DB8210F6F469B17F3F62B8A776B08628E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "ebaa98e7-c859-4389-a0de-8068b43d17b9", "value": "a6ce71db845588b87d92fe9a59defdfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "58af650b-dca4-4bde-8ae3-5cd9501186a4", "value": "12288:h/lh66QhTIE+3r+Z/79PxBXV08X++7UBAQND7Ue:h/lh66QZIE+3r+fxBi8Oa0AQNvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266628, "uuid": "c6f69e40-15e3-4902-a976-aaf098fc3b1b", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266628, "uuid": "0b4b4f9c-35a7-453b-9b3f-36134b2ecdd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "686c8d74-f1f5-4e61-b7e5-ae1f75d9b4ba", "value": "60e6ce0b81e5896b7611674ff322a00349c79d6155e03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776317e6-a25c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675275354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275354, "uuid": "851b33ee-4941-4ee6-ba01-823f0a87ab64", "comment": "Malware payload (GCleaner)", "value": "02ce01f99f84827edf911ffa0f377e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275354, "uuid": "9f1dd33e-6780-47b1-a0bf-2bdfe09850db", "comment": "Malware payload (GCleaner)", "value": "6151619284ba5571351b3ebfea609e2dd5ce46adcb329dc9f66454b226786ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275354, "uuid": "96726eaf-a2ed-4254-8b8e-eadd7d49c466", "comment": "Malware payload (GCleaner)", "value": "e1e5f01e2a7a8cb157f59b53edb7c4aca16ce7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275354, "uuid": "eccf27f0-bb6e-4082-9ff9-74aa1dbd41ff", "comment": "Malware payload (GCleaner)", "value": "fdb2479c32972b8074d47f1eced745f5cfab358d6c04d4b688f7d5bd19e25cfed7a05ff650e559065add771c69bb4534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275354, "uuid": "12ca6c78-1b6b-4f42-9961-20a0972a9618", "value": "T159A523034E7DD432D155A6742E30C137EABABD2029399B1371E67C4B3B3B6E3BA19146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275354, "uuid": "42361084-f876-4f2e-8640-b024a7f5393e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275354, "uuid": "077c0811-bffd-430f-800c-d2f7f2c91405", "value": "49152:icPLnQB7pPDX7F95O4GxqU6E7xiRc/7+vAPHp0wg9cy+LCgv2MR:XPLnQtpX7FC4G765gqw+zev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275354, "uuid": "6bb3816f-b20a-4f36-af4d-84cf7c539e95", "value": 2191489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275354, "uuid": "9546221e-11f2-4f9e-8e11-7b64afb12d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275354, "uuid": "36bf22c4-1e32-48b3-838a-481d283c20ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbe9139-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675262181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262181, "uuid": "e5485e15-5bb3-4b7a-92d3-9379293f100a", "comment": "Malware payload (Rhadamanthys)", "value": "4b304313bfc0ce7e21da7ae0d3c82c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262181, "uuid": "2bbec825-1821-4a37-982d-1f98e8985687", "comment": "Malware payload (Rhadamanthys)", "value": "623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262181, "uuid": "43951643-c0e7-4d33-a3bf-d68a2520ef89", "comment": "Malware payload (Rhadamanthys)", "value": "60745879faa3544b3a884843e368e668acbb6fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262181, "uuid": "fb85acbe-5357-4640-ae13-04258a9f27e5", "comment": "Malware payload (Rhadamanthys)", "value": "04e23cf674e4528f2375be9c5a8d2205f0bb4860511b75d638a7da44c257d0040f5e67b502587d488efd0a4e877c9be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262181, "uuid": "8f292b62-fd21-4ea2-955f-ed6b962b09d3", "value": "T10824E155B162C8B5FE880177A829DF6A3B7976760B24CAC3B73C18CA7E602FD511B1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262181, "uuid": "80abce6d-99a7-4240-8d46-6cb63a032311", "value": "aadfbab8d412495f4fa7ffcb1329305d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262181, "uuid": "5b7f5370-2327-4e50-b05b-70fc17b24446", "value": "3072:IdXC8b2etUPxnxQDMcNPlBauCB6jBeQMYdGeMfuhYKTuE5yVRhOi2tB:IdXCk2etQn0PlBZCBjPeMfoT5kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262181, "uuid": "5ac8ec5e-c241-4a83-ae6d-1a1e144da0f2", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262181, "uuid": "d6da776a-c186-438b-aec4-009bdf1a8c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262181, "uuid": "66e08835-9722-4f54-99a4-de2f5fc8820b", "value": "4b304313bfc0ce7e21da7ae0d3c82c39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44a6d03-a234-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675258330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258330, "uuid": "94fd96de-01a0-4c5a-9945-9b9864facbfe", "comment": "Malware payload (Amadey)", "value": "6a16ccfa2814e428bd55f29aebb140fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258330, "uuid": "0f9c4894-bda2-4965-9b67-ff3f8aa257af", "comment": "Malware payload (Amadey)", "value": "6264f90d79f3845be97a7cb264bc473bab6e289171e70b8355a71f162acb483c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258330, "uuid": "1fa78ebf-f005-40a4-b633-12e50eae01a9", "comment": "Malware payload (Amadey)", "value": "a187667ac77bb47bafa4797cc1826348fc6c208c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258330, "uuid": "5002f9f8-e944-4bde-95c1-18a1cdf60794", "comment": "Malware payload (Amadey)", "value": "4033ae65f9170e0adb9393dff249faa703ee98ea428e73da1a6fe2ea00dc5c5a33cbf052b4fcb7dc848fcab7e847a9df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258330, "uuid": "28794b74-44d0-4e28-b7fb-3be3667d284a", "value": "T17E34CF323BC0D072C5BB51705C20EAA57BAEB9315838B84B7F941A7E9F716E02636357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258330, "uuid": "52c9601b-a9cd-4c19-8dae-fbd09d1ef4cb", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258330, "uuid": "c98abb6a-9cc6-429b-a446-6266e6e821f0", "value": "3072:Q6wGbrLcGvF4RgL5jJJWx0u5676HvIIhT3vIPOUbw51ePa8Y0:Q6w5mFxLFJJfPigQTFUcuPa8Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675258330, "uuid": "a4ea2466-78ae-4543-a687-2a2934de1785", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675258330, "uuid": "61689acf-6aec-4d0f-989e-7f7224d1b6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258330, "uuid": "daee4f66-b70e-4ad1-810b-6a55d90e7533", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadedd46-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675256113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256113, "uuid": "1af48e1d-7723-4e01-b72d-78b65dfbcbb9", "comment": "Malware payload (RedLineStealer)", "value": "d6878ffabe09a80cf65c4a9375d779f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256113, "uuid": "7cee2429-6732-430a-88d3-712698a226a7", "comment": "Malware payload (RedLineStealer)", "value": "631ea17c524a31a72bd97071aca991712c59b1b3b69857a5dbfed5a81af18a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256113, "uuid": "a0a103e5-1fa1-44f3-bcbe-a046f5e14f88", "comment": "Malware payload (RedLineStealer)", "value": "3b5258cf91ab21993e6a0678f47b5ec92d1f7333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256113, "uuid": "2804b4dc-dbe9-4df8-aae5-f533a8f21648", "comment": "Malware payload (RedLineStealer)", "value": "f6a8c1739ad3404ea348ea42bf67da5e54301f2b389f5eef03fd87d8e1b0c995fd7ae6b5b8225f55d836cd1459a36c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256113, "uuid": "d5162223-03c4-463b-bd93-02cd131cd53d", "value": "T11374023239D0D032C5AB91704834EBA9AB7EF831197698573B542BFE9F706D1B236346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256113, "uuid": "d2f54461-379e-4029-b056-e782292d3788", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256113, "uuid": "bb6a065c-eea5-42bd-8427-3a915dc19bba", "value": "6144:5WVPrrQLlFkx/qOxIC7W2JUy6t+2hw9uQiosdjuSg0CQY/:5W93QBFkxiOxIIxJB6t+2ElQju7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256113, "uuid": "dbacf11f-ab78-4f84-b757-9c9b5d4fd10d", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256113, "uuid": "5e884e49-7c99-4e65-9fc0-437460c4bff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256113, "uuid": "e41a1d67-e50c-4960-9c74-bb70dd238d88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b9da04-a211-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675243273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243273, "uuid": "c4f0ddb3-6a1d-47f8-8cdd-1d7905fe27d9", "comment": "Malware payload", "value": "918e0248d7d8ee4b260d6281381df579", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243273, "uuid": "dc832a3c-576a-449d-838d-36abbde83cd9", "comment": "Malware payload", "value": "63dd9cf6bc2297cbaad7ba8386f285685ca5ff9adf0baa6c9843a921a155b06e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243273, "uuid": "0ea3f19f-d703-47d5-9b68-da88807c4874", "comment": "Malware payload", "value": "9d57cd6bbc11f6ed1d3f8bda4c70341950204bc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243273, "uuid": "4392d764-2eec-4c96-b58a-446e9744ce3d", "comment": "Malware payload", "value": "cc76efc91b268a26a65144959f5f03a90ed53cfb62e6c6dd6e1b9f6af9127ca2a01c9cf7d080be517777c898b3419085", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243273, "uuid": "bc778b58-3339-4daf-8000-b2fcea18341a", "value": "T1C383E706A3539F29D1160C79403793DC27797EBE6E11621771E23EAC3A702BD973AB18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243273, "uuid": "d952b056-91f4-48bc-a66a-5fddf0478342", "value": "1536:H6EMWgsGiAhhlXElXrEGmQ/g515+ygMmdD7S+/ZAxrtzU4UU4b4oU404iisEDc3:H6Eqhhl0lXrEGmQ/g515+ygM0D7Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243273, "uuid": "f4644546-744f-4f75-84b4-6924ad7e9053", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243273, "uuid": "0717643a-60cc-41b5-8a50-be9493a7544a", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243273, "uuid": "ba2437d7-ba41-4c7b-bf8f-73f1c030cdfc", "value": "Zahed Ali Mohammed.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e96325-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675278737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278737, "uuid": "f53aa49e-a168-4164-9a73-8c866a4863ce", "comment": "Malware payload (Smoke Loader)", "value": "3f1309bb2df5714b8e5d97f095925ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278737, "uuid": "c06a4102-e6f1-47d3-85e9-3c8e5b3d3e6e", "comment": "Malware payload (Smoke Loader)", "value": "64837a68aadd62eea69a20e872e2f7345044a4b5c0f0a7f00e4a3fb3d8ac06a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278737, "uuid": "06912b8e-394c-493d-a00e-c42aa77bb16e", "comment": "Malware payload (Smoke Loader)", "value": "e8b669a8425b246474bf4dc29a18b0a44edd4b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278737, "uuid": "90cc23d9-7631-4319-88c8-591d2639f251", "comment": "Malware payload (Smoke Loader)", "value": "1648f272404abbfefa9e56052d4151e068d5ca3cc720bb11e0547f068b23d4e767a1730919da696358211e9367240322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278737, "uuid": "8fd08f74-e968-43fc-ad55-cb7830505bef", "value": "T1D434E032B5C0C072C9BF54301870EA956BBEB8314A75955B7FA40AAE5F302D1773A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278737, "uuid": "1f3735c5-dc42-4eac-874f-2ee969b48bc2", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278737, "uuid": "2ca82c3d-487b-4726-b57a-e9af4bbe377a", "value": "3072:SjApdGJND+8LLAXW/m5qhn8aVUTmbZdkIq+dwPCGlsrzOS:Sj5t1LUXOAaVUqbLq+SPCGlsrzOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278737, "uuid": "10eeb5d4-7180-4105-a8cc-a1a51f4c1e61", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278737, "uuid": "eac14a87-aa3e-4362-8c08-8932c8655735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278737, "uuid": "ecd4439e-4da8-4908-bae7-95dc78cbdcb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc86ca73-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261779, "uuid": "e10a69a2-3008-470f-8380-9baad53ab606", "comment": "Malware payload (SnakeKeylogger)", "value": "5bf2e95d5f8e1d3803270e2281b3ecef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261779, "uuid": "c239a66d-0a29-4b25-8a14-63730fe7aabe", "comment": "Malware payload (SnakeKeylogger)", "value": "64b9c66d1790f7f9a62366c7bbcd694941f39fa86077994f0d752f70c90f56b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261779, "uuid": "f7277805-998c-432c-9658-79d9c6f2f18f", "comment": "Malware payload (SnakeKeylogger)", "value": "9b86109510ff43bcad502d89497e0fdf7812e83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261779, "uuid": "970bc4bb-4f65-4c7e-bd71-bf2a48eeeef6", "comment": "Malware payload (SnakeKeylogger)", "value": "4b277a975f705d8f540a43ce3a8624bc6a28e5d191cf950362d48a6488753986b8ea8d8d49fb10d512dc3de65468b7a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261779, "uuid": "64e06b2f-e982-436e-99db-32b0c9972755", "value": "T1F9E40159C365CAF6D6A803FE05B010941B72269AF51DEB0C0EAFA3DC4897309D5693EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261779, "uuid": "e8c6f26c-9aae-492e-b102-b17dcb5f0fd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261779, "uuid": "75923574-6486-4537-b242-dfce21009193", "value": "12288:hSQAVVu8EkvQt2Lypq+rbXZlUBHbreSoWeh3ih9H1Adf:4VU8HvQALyfbZuBneSoBYTedf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261779, "uuid": "96dfdd83-0b38-4d79-bb9a-f56d348b3894", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261779, "uuid": "416b7655-640c-48f0-93ef-d8416851bdb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261779, "uuid": "e7ffd10a-4cd7-47e1-a8fe-f414d9cd482b", "value": "eTfneS4zTZnJUHw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c250f8-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675267786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267786, "uuid": "35d9eac5-c547-4898-a58c-c04e35fabdf4", "comment": "Malware payload (Vidar)", "value": "6387daf9f8f8b389ebf4104da31645cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267786, "uuid": "6267c37f-2fb4-4948-bdbe-3b46934d84b9", "comment": "Malware payload (Vidar)", "value": "64f785845b33cbd43229140157c41c3f4394df5d63f35907f07a18a1e6e84e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267786, "uuid": "902d9681-1021-4c16-87be-8e565944bb9b", "comment": "Malware payload (Vidar)", "value": "c0a8aea2b1fc8a88d528be51b3e4053702c1fd33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267786, "uuid": "f452bf93-645d-4d4c-bc6c-91fa8bc99fb2", "comment": "Malware payload (Vidar)", "value": "7fbd8e71741875d1d2abd980350c19db0d0b95a54fd660c563233522bba5023cd51a0f1549f8d18fa6b59ae623e461ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267786, "uuid": "4391fd48-e5da-44a6-ad17-111cb92404be", "value": "T14555F112D4D04AEAD05771B2727EE82221257C5FC7244E9B538ABD9769B3393343BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267786, "uuid": "a9b7366a-c29e-45b1-a3fb-9252280e49b4", "value": "2339ac77bf9371500ebbf86df3a10d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267786, "uuid": "adcacbcf-4805-47f9-af51-dfebb0454030", "value": "24576:xFB1eHMEtyrmVotTaXgimD0EkykUtbMm:XXeHirtTa9mYxykUtAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267786, "uuid": "0f614dd5-3e82-4569-8527-456cc239ad10", "value": 1289728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267786, "uuid": "096cc36b-81fa-4989-85ee-8465fc797873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267786, "uuid": "56aabd90-67db-4e72-a283-d342806b3bea", "value": "Nvidia_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de95f854-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675263930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263930, "uuid": "d372b8b2-dd5d-41d2-990b-92b014d642e0", "comment": "Malware payload (Amadey)", "value": "812b8d76e0cf1e825bbfcf787ebdd902", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263930, "uuid": "697d0bb9-dda8-417a-8b55-3fab94847e99", "comment": "Malware payload (Amadey)", "value": "6513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263930, "uuid": "f2981867-d41b-436c-b5b2-ffbb9ff07035", "comment": "Malware payload (Amadey)", "value": "9f981c60bb4195657340519e13f1422e5cc8967b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263930, "uuid": "b8e235b0-58f5-4da5-8d5a-f635f173ef57", "comment": "Malware payload (Amadey)", "value": "8b4fc357e23e028daa972b1fa4e3ad19e4b1d2fc20acbbd571fdc62a1ec06ff4d886007833601774eaf943c23ac6ec35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263930, "uuid": "db0855fc-3349-4041-b529-cc06af333c31", "value": "T1FF3409217D16C031D96061B729B9BFF2C19DA8259B7049DB7B800F3BDA112E76A70E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263930, "uuid": "209293ea-1ed3-4c4b-aa80-6ceed08cafcf", "value": "dd0e4efabc62274a7cfb37b4b7a2951d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263930, "uuid": "9b2dbb0e-cf6c-4826-ad2a-120f361b3516", "value": "6144:r0oFwGz+5JJw20a1bfjVEmAuVy1OVYvk8gF:rpLxa5VsuVy8VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263930, "uuid": "6ca72d0f-7ec5-4611-b8b4-04b2c485bb4e", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263930, "uuid": "d299777a-8d45-478b-9d03-5711abd15bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263930, "uuid": "5b193493-3aa0-43f8-bb72-109ce5682bdf", "value": "812b8d76e0cf1e825bbfcf787ebdd902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e343802b-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675264368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264368, "uuid": "13f9ca0a-6961-4091-a715-620e4a829a70", "comment": "Malware payload (Formbook)", "value": "b781cccd89e43f774cf706ac5d341532", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264368, "uuid": "e76cfaf3-25f7-4764-9d0c-2c967596fbf2", "comment": "Malware payload (Formbook)", "value": "651c376307abaf877ce5652cf108586393cf1be51170c0f9b10b481ff2a7e913", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264368, "uuid": "b10b0f5d-76f7-440c-81df-09a838ee39d1", "comment": "Malware payload (Formbook)", "value": "503ee04d3aa92398bab3629345543dfccb0ff439", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264368, "uuid": "b77e3ac2-e067-47cc-8d46-8cbee61f0a00", "comment": "Malware payload (Formbook)", "value": "d59c7882a8d4a7e306a2898d8b02035f004f96734f5f562a4866a4e8ef6333550a14122acc004ab0313059331698b122", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264368, "uuid": "bbae0b24-1cc3-4afe-9a80-5947c4976fa8", "value": "T1A622656467D06C5813530B937B1F34CEE95A8ADA7DA1D54B9140BD88BC80B31EBE6B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264368, "uuid": "59ad8237-fd1d-4078-bac2-cf164d21490e", "value": "192:NS97Vy8MxXBO/vhRyNwnojiRTKjAjedpRayexv2f1l1voCfFQv5gPF1hi+4YQqjZ:N0s0vhRWBG2jAjeRet2lp1EKF1pxjWHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264368, "uuid": "2ac6c370-e9e7-4afd-89b0-c01327473830", "value": 10066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264368, "uuid": "86da5dcc-3c06-4b49-bb64-8c63c9249d21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264368, "uuid": "f426375c-99a1-4c16-a028-1a1615d2f40c", "value": "RFQ Medical Equipment list.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffa75d3-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675239988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239988, "uuid": "db35f5d5-44f2-4bc7-8aa0-537c88e0408e", "comment": "Malware payload (AsyncRAT)", "value": "f247c6c08093dca80671c2579152ee28", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239988, "uuid": "bc88090c-8826-48fa-b0f6-158a240a8107", "comment": "Malware payload (AsyncRAT)", "value": "658e0f3e03622f2ef3a44be0e3c19d116f9e7445dacc1b6264ea75ed2af25294", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239988, "uuid": "44d5c000-c1f7-4b73-8179-9dcdba601dc4", "comment": "Malware payload (AsyncRAT)", "value": "9f763c7a5efcc24b3297466522b9b15ef186cbc6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239988, "uuid": "a6eca138-801f-4b9a-9c45-d208c7e4cabc", "comment": "Malware payload (AsyncRAT)", "value": "3c1df455779fe416943e8a7559cbba1a91b792fd3c9c2f380315d9bdc821a6951809a9e12cd0dd0f95c0692e057e4618", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239988, "uuid": "9eef98ff-9a8b-4413-a21a-4e869a011c87", "value": "T119033A9877EC9323EFEF577C58A465824BB1A937A600E7082DCCB8E915D23C75A10717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239988, "uuid": "ccb20aa3-6194-4d23-829f-040a904cbaad", "value": "768:zOW5n4S3nN/SnxKWBihIkNW+k2RntQyiRI:zBt3nN8xKWBiVW+D9tQyi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239988, "uuid": "6220ecfb-cbed-41e6-9168-1d28ba631407", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239988, "uuid": "23958f6f-fd87-4b6b-913e-d934e5df9752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239988, "uuid": "8f067780-78a1-4152-a016-248dc3e8b6da", "value": "PO 347282-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3455cc-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292780, "uuid": "1327c162-60e5-457f-ad96-9f314f4dd274", "comment": "Malware payload", "value": "dece18bccd583e193f5dd36b0b4133af", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292780, "uuid": "58a35cd4-dfe0-4eb9-a684-5e96e67a18c7", "comment": "Malware payload", "value": "65b19125d28c36bf49a4e289f19ee6604760e51dd7054b06b8b6e8f9a4c76246", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292780, "uuid": "13169e9b-7475-4c63-963f-a714a1dff9d1", "comment": "Malware payload", "value": "883878bbe3e6ea915513f5b6fdad2057b9299a92", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292780, "uuid": "0500a1f4-da90-45af-b75b-279a35d1a6c3", "comment": "Malware payload", "value": "d37d555312ebf994df0f0698afccb5a5676feea3b84b835748a5992bd05e6390529f8d2151ebf5cff3eceacd1fb7993a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292780, "uuid": "039c15a3-72d3-4abd-ac50-06a258c7c44b", "value": "T1C4363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292780, "uuid": "3077c8dd-10df-4eef-804c-fdfa8c3f68af", "value": "98304:3v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXc:3vpvFa+g8RWLdPk/84tCEr0RtNiC5eSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292780, "uuid": "4e097546-b230-4fe1-84a4-1277ebc05f7a", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292780, "uuid": "0ac1681a-b137-4c8d-9689-117fb9fd699e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292780, "uuid": "2e320fcf-0c2c-46bc-bc0f-f7363791b10b", "value": "65b19125d28c36bf49a4e289f19ee6604760e51dd7054b06b8b6e8f9a4c76246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a7d525-a288-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675294229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294229, "uuid": "67c7687d-4238-4544-adcd-53a88a2ca232", "comment": "Malware payload", "value": "a898fa03d08e6fe4e2c6c235895a81ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294229, "uuid": "880a167a-7329-451e-8be2-39a6948bab79", "comment": "Malware payload", "value": "66d53a02848c70aabb3ae384ad8b96e1823de3beee4e5640c3587f4157c319a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294229, "uuid": "aa7b0a00-8043-4333-a347-99835099ead1", "comment": "Malware payload", "value": "9a1ad644870e8ca8847fd1d3387c47492b26d89b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294229, "uuid": "644a42ad-9092-456e-b6ad-087611064329", "comment": "Malware payload", "value": "62952ea6f52b55f779f7e736c8d351ec92f4876fad40bcccf3068de1d14f3dc5ec54e9c9c1c979167bd6f3ab9c377932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294229, "uuid": "3ed5ef53-ea26-4126-b51c-6d064e453d95", "value": "T1AEA523210A79C837D2E2A6F96E71D0B1A755BE001C3C6611F5FE3C1B773A6C25E0E296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294229, "uuid": "aeb3f5bb-1be1-4666-8147-3aac92efe91e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294229, "uuid": "bb816e36-8105-450d-805d-783a3607b662", "value": "49152:icPLnQbp2+bJQ6TvCT2dKLgNL9bXQ5vIYOXPL4ndLCgv2MR:XPLnQd2+VZTva2igBlA1Itz4nhv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675294229, "uuid": "e0e208fb-e027-4274-a659-3a0125f3bca4", "value": 2242694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675294229, "uuid": "82bd2ae9-c3fa-4f79-8468-7b30eb64de94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294229, "uuid": "6b3edfd0-d655-444f-a0b4-9b63ee27bab7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6ed6c3-a1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675229513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229513, "uuid": "6be2f799-1fe0-4362-b1ca-6e905142463d", "comment": "Malware payload (GCleaner)", "value": "1079993481fb4453781d0cd011e128ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229513, "uuid": "8314db87-bb55-4a83-a463-24b3bd852b3d", "comment": "Malware payload (GCleaner)", "value": "670edc76b173696392aa043b0af4d1a758311d6fd5e758abb0d9f32dc0d0ebc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229513, "uuid": "08562e6b-3710-48ad-898d-e0c233ec2293", "comment": "Malware payload (GCleaner)", "value": "7e5e7e8b1f02d6957dfebd6eb18bc06642fce532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229513, "uuid": "1eefdd12-cc38-4520-9d5f-9acbb25d3854", "comment": "Malware payload (GCleaner)", "value": "5081e74f322c2d428f9c2e773fb4c1348db521e953d43fbc1e3ce496beec0ff88b3e7b1dbe9e0a907aa2bc3eb291c5ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229513, "uuid": "48c27570-f9de-4d98-a36c-089206838286", "value": "T18AA533156739C836E2C268B8AF21D57666B1AF27283C131136FE3E1F727D7836E59012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229513, "uuid": "2fb90dbc-f91d-4307-9842-6bb351b13195", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229513, "uuid": "78736248-8ccc-4fa1-9f20-60ba049ecfa1", "value": "49152:icPLnQp9IEzm8/kkjn4KnWsrAQoVUqmmeWLjDSxLLCgv2MR:XPLnQs6lHokmbg/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675229513, "uuid": "b1b22614-5dab-4000-a9d6-0fe7d59ef47d", "value": 2223657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675229513, "uuid": "e0d77b1c-32e8-46a3-93c7-9022a7a8d306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229513, "uuid": "5cb5fe23-8aad-42d1-9a6a-d7edd54e95da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25753fa2-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675267485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267485, "uuid": "48311f01-35b2-4006-84d1-c6f1babccf55", "comment": "Malware payload (Loki)", "value": "274588d887b725e420267df5d013ba2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267485, "uuid": "2c481684-04a7-4743-9ef6-e2e42d5cea3d", "comment": "Malware payload (Loki)", "value": "6746bbf28639e5c8488dcbb3be31bb36c5987817683eb41a92d67359b033a768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267485, "uuid": "ee8c6064-0626-41e4-b01b-e3cd90428359", "comment": "Malware payload (Loki)", "value": "4e8fa9cb3024131e5195d553e28b27f69559e330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267485, "uuid": "b1017323-0d98-473c-af4e-b765d0e39daf", "comment": "Malware payload (Loki)", "value": "da97db4cf0e4cd0e77e59d20ec652a520e6fdbe85ba929a9f6ce1f7c4464be2b697043c0b7bc9ee2ad28710224209822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267485, "uuid": "ce612bbe-a7a6-428b-ae26-c8b189f31398", "value": "T104E47C8777B198B2F6CB00A5142837CD2FE0B103BE95E2579B3B79C0A7059FBB698151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267485, "uuid": "a35ef19a-0c19-42fa-9a9f-a5dce0c23d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267485, "uuid": "d0c3b059-dbee-4513-b86f-5f724ee08dba", "value": "12288:Gtz8L6gu+xMRSR5SQ0rfUqPWzScdVDV+I9bqWqG4yPa:PLzyRU5UrfUqPWm6VSWqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267485, "uuid": "836748c3-cc40-491f-abb3-b84b1f4f010d", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267485, "uuid": "b4ad29dc-491d-4f2a-82f2-f8e7c558ba64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267485, "uuid": "f75d0744-5d3b-4cf7-b5a2-90409a0ea54f", "value": "274588d887b725e420267df5d013ba2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9cb81b-a255-11ed-88f6-42010a9c006e", "comment": "Malware payload (LimeRAT)", "timestamp": 1675272326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272326, "uuid": "c42931d8-6cd2-44e1-99aa-80bad17f70bb", "comment": "Malware payload (LimeRAT)", "value": "6b3e8c6d5aa1896241ed1edf73204371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272326, "uuid": "714a994d-790f-4b57-b322-4cce306ce4cb", "comment": "Malware payload (LimeRAT)", "value": "67854367dadc638e0a65777647ab787ce3608625914274404805d0af9095b02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272326, "uuid": "5a4bb918-f6a7-4451-8b63-886d39e48560", "comment": "Malware payload (LimeRAT)", "value": "80f5a9dadf6600f4383b231a5d0689f95c851079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272326, "uuid": "e7f3bf70-b808-4590-a223-86a06f0131cf", "comment": "Malware payload (LimeRAT)", "value": "6fcddd045f6a0c4b27b2e0c8d7ca76215eb0f7d9d7090823180c5e36a2941442a245c61676e2f79fd15495f9ae256fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272326, "uuid": "981ba1e0-182b-425b-81f2-9669f6a967e5", "value": "T1BF35F656E8F78812C0E9F4F403625E208AE17E29659F8D1668F9315884F1B03DF7B66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272326, "uuid": "8e3dd393-0f38-4161-b8d8-4df9a66f10be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272326, "uuid": "3c3e6683-1aef-4dc1-8ff1-f003702b91f3", "value": "12288:/r+w+Px6rDBaUvCYMsFzPcc1lZgZMrfqgn811CYjojvlBaUvCYMsFzPMc1:jRZCYM6zPcc+1CYYDCYM6zPMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272326, "uuid": "c7038528-02d7-4ab4-8df1-01548e2ab282", "value": 1087408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272326, "uuid": "84c75f87-e87b-4339-bf97-a1f4bd421ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272326, "uuid": "83d83278-db3e-4a8c-a89d-b169c64db4c7", "value": "HEUR-Backdoor.MSIL.Crysan.gen-67854367dadc638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5ab1c3-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261754, "uuid": "ae693304-6c1a-4ecc-b6b6-d6577ea295ca", "comment": "Malware payload (SnakeKeylogger)", "value": "49527b2c0b9533d83aa364da21a90d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261754, "uuid": "4cfd65a4-d879-48fb-a892-074824a9e1c8", "comment": "Malware payload (SnakeKeylogger)", "value": "686420695c1cda262995094cab57131d907fe25ed47d80e8680fbb69b485d6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261754, "uuid": "de8a0228-5947-4f2e-b8f4-ad29559af9c4", "comment": "Malware payload (SnakeKeylogger)", "value": "435bb02de3a66b10d348f4d8ef5c531d271a733b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261754, "uuid": "40616af8-9cd2-4e08-995c-8a533a12605e", "comment": "Malware payload (SnakeKeylogger)", "value": "17ebfef1fc4a7ca639bff14a28a3d73c56f72d3683e539907d9f167503c503e02236e4c35a00cd2e3817465802102efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261754, "uuid": "d8ff5697-cc44-42ae-95b4-8bc161736382", "value": "T1D3D4D08C3650B6DFC857CD76CEA85C24EA2069B7530BD243A41712EDEA0E69BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261754, "uuid": "a7de7ab6-0533-4128-a335-7d323100215c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261754, "uuid": "a6637602-4be6-439b-9a17-b332188a44c5", "value": "12288:mBXQlI+FFYyU4gYgOB2bp/aZ+mr5Hr8z9i7+pvvCWtOsDeqohE5qcVO:eXQlI+PTlg5OB2bp/aNr8zw6R6hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261754, "uuid": "e8f02e74-1ca5-4f3b-b8ac-e0cef942849d", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261754, "uuid": "bc3da40e-00ef-45b6-9b5d-32b0c3d03382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261754, "uuid": "3cd8f942-aeff-4aab-a2cd-bf5e68392447", "value": "lista de pedidos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c769f7c-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292784, "uuid": "bceff159-3c18-4261-a974-4fd895a26373", "comment": "Malware payload", "value": "5ba509a525a778d2a4ff379d77f6f361", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292784, "uuid": "f27cf95e-b897-46e6-9773-39017e647a79", "comment": "Malware payload", "value": "69a41536060f6b50f74d6f67c5b866d88c72ada925a4f90c9d4e43d9afa42ffd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292784, "uuid": "65f5ce05-8012-474e-b043-7e628bfc6fbc", "comment": "Malware payload", "value": "95bc11d114a2aa249944233ddf52734fa149aa98", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292784, "uuid": "c0bb6c9b-c81f-4632-bc33-e1f72a8b62b3", "comment": "Malware payload", "value": "e822990b3b5cf70cdc671fafc702c000eb3189dfb31152cee7d115fff7a3a347ab919370f6a7dfd39b5bbe618e47d327", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292784, "uuid": "cdcb64f1-c893-43cf-aab7-3f4f98d23c45", "value": "T164363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292784, "uuid": "bcca84e3-3d07-44c3-8c87-df438d49bad7", "value": "98304:Hv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXg:HvpvFa+g8RWLdPk/84tCEr0RtNiC5eS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292784, "uuid": "ab44379a-809d-4248-9110-5bef7ec989c1", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292784, "uuid": "9b5a98b2-c203-4fbe-ac5e-b99997d5acb9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292784, "uuid": "792d6f72-0c6f-4e29-833b-5c50dc162589", "value": "69a41536060f6b50f74d6f67c5b866d88c72ada925a4f90c9d4e43d9afa42ffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b9f9a6-a266-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675279567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279567, "uuid": "4ff224c8-5be7-4dd0-8643-79b695055338", "comment": "Malware payload (IcedID)", "value": "1bc191ce31861ce56280eab0ea174cba", "object_relation": "md5", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279567, "uuid": "58bc6b01-2629-425a-8054-2bd13fd88541", "comment": "Malware payload (IcedID)", "value": "6a4bb9025abd30e0bda06417220a199163e084329c073633f877df3bd04b8a5b", "object_relation": "sha256", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279567, "uuid": "91b4e7a6-8955-47ac-a5fe-6dc50d0017bf", "comment": "Malware payload (IcedID)", "value": "2313e53237adc4f019a4803076bc57cbc8711217", "object_relation": "sha1", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279567, "uuid": "17fc34eb-6507-4895-a60d-14f4f43e08ed", "comment": "Malware payload (IcedID)", "value": "a8a2518eb9fd7498a7231952ded6d242594b29db3404f8a741cd9b1b67c38e61a51dbe1b82aaab843b407ae00c88b5a4", "object_relation": "sha3-384", "Tag": [ { "name": "133894510", "colour": "#904933", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "thunderbird", "colour": "#803C1F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279567, "uuid": "bb71d674-0fb5-48a2-8021-9f73c8a2abe5", "value": "T1BB15122F59A2AA4DF71D32B9DD4E1FF3D728B03180D8E4CE2D40D1A4581B71A7B59683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279567, "uuid": "ec9033ae-c61c-4f64-9d25-26d983935a89", "value": "6144:kgktMgO/XjWeZYn58USIOi1cDh5ZZ4f4egQF9Ad:kPtMgOPjvYn5nncDhuuo92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279567, "uuid": "bf9c5056-b5e3-4b3f-95ec-ad05fe5a8144", "value": 944583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279567, "uuid": "685e4dd0-ae02-49d5-9a2a-03f3578b06bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279567, "uuid": "6c392748-67ad-45bb-9a44-794e1169d865", "value": "Setup_Win_01-02-2023_19-15-33.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eaa6ec9-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675267152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267152, "uuid": "8e1e24f5-0ed3-4eb7-8223-dbad9f1adc87", "comment": "Malware payload (AsyncRAT)", "value": "3a913788543de3db4e3e783bdbf9aea4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267152, "uuid": "7217be66-dcfb-46fa-a626-7ec02ae5f97b", "comment": "Malware payload (AsyncRAT)", "value": "6c1a998b347416c733619dfee30c93822cbe28b6fdd729d8bbe29697d06c4594", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267152, "uuid": "2f6e6ade-d3e5-47ae-895b-aeddc171d5d2", "comment": "Malware payload (AsyncRAT)", "value": "328356b34150c847cd3a13c48669b8f3927943d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267152, "uuid": "f3754ee6-2067-4692-aa41-64fe68651ef6", "comment": "Malware payload (AsyncRAT)", "value": "0351f4ccb55e2e5c18df729249cd4af1d82ba1657b900f0a5a46dc4dbdf108dd5633c4dbb4fa3e58c7b5307db99100a1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267152, "uuid": "a2b59b87-a4e9-46b4-af77-58e0307f8fb0", "value": "T11216C726BA4A4D32CA24A075701B036156EF58CD4279F35AEA2DD0FA0DE9DC94F44B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267152, "uuid": "51f3ca75-7ee2-4688-a3be-df028d8e7ca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267152, "uuid": "4684272f-b235-4ecb-9802-67fe8e40429c", "value": "49152:VuIO86kmfd9xMQg3Q3cX5C/wnvdAlPjcmYerZruoow4Q:VXIfdtruCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267152, "uuid": "3062b426-a638-44e9-aebc-8845ae07092c", "value": 4360192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267152, "uuid": "17c7def4-4828-43c8-8cb2-c8aa08797a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267152, "uuid": "f4620b87-4621-47e4-8cc4-f5164a681cda", "value": "3a913788543de3db4e3e783bdbf9aea4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d5791-a21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675249141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249141, "uuid": "f6a82fbb-3225-4113-b0a2-fc9a05ba02cd", "comment": "Malware payload (Quakbot)", "value": "1d23c6234f44976e046d50144c2e9a30", "object_relation": "md5", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249141, "uuid": "985112e4-5fc6-46fa-9634-9bb8030e980c", "comment": "Malware payload (Quakbot)", "value": "6c49b4d40b2925a4e5910e4157f7d302acf9203192187d3d1d178c258239f1c3", "object_relation": "sha256", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249141, "uuid": "de918884-7b24-410d-bce2-0fe7a2abfc4b", "comment": "Malware payload (Quakbot)", "value": "b9fabeb81466bba5f6c3032376d86352af032638", "object_relation": "sha1", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249141, "uuid": "86f4fa1d-98b1-455d-83c5-024454f90c97", "comment": "Malware payload (Quakbot)", "value": "01f2720de504cc387c178a045c7611b09141be837aaacae6b9f0bd31fdd59bf3a654c08de48fd5d93eb905ae2fd1c4b3", "object_relation": "sha3-384", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249141, "uuid": "9a53796b-d07b-4628-8129-89d68b8dd00c", "value": "T1C904C00266F106E5DAF47BB35DE39F196A27FE22B222075F47B6652D4DA4210CC04B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249141, "uuid": "37d006c9-c507-4155-8ddb-8c7ff2a66265", "value": "3072:0aA0YRw9/WITtTWR7IbNzvL1aTe/4uWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCs:ia9xytedL1ee/i4iERBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249141, "uuid": "f5c446bf-9652-471c-b0e0-8ae2d5fccf31", "value": 189464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249141, "uuid": "7284675f-f317-4b59-9697-3577ec6b62df", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249141, "uuid": "dcaa2485-f5b4-4949-966a-8af1c2fe600a", "value": "65643.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66abbe1-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261823, "uuid": "53837964-9c64-433b-966b-8d2a42cbb8f2", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd3274dc695112f7f33437d224b2674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261823, "uuid": "2fb31c78-c2bb-45ad-b17d-3272dbbd3528", "comment": "Malware payload (SnakeKeylogger)", "value": "6c7cbf4b4eb2e90a7093cc03786942ca42c88c0cdd30397b1530530c7ad40ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261823, "uuid": "8c3e5ae6-d124-4c27-b031-d657a88ff42b", "comment": "Malware payload (SnakeKeylogger)", "value": "b5e9d05f8db3b081cd9c180ea16577f4d5a48cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261823, "uuid": "b52447bf-a350-4cff-aad3-66dfd940d290", "comment": "Malware payload (SnakeKeylogger)", "value": "998f52698ad5fca8f8ab94cd8647597609f682a7cb7b616f5b7626163bd49c00f8a4bacf058a47fe9cd564b605186678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261823, "uuid": "fb5994b2-46c1-4809-95a8-6ab57f0afa76", "value": "T1DBD401AAC26DCCBBCB4A01FF427150496FB2097AF192D78D0EAFE52184CF781857159B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261823, "uuid": "f6de3198-e012-48a2-9ce0-6b2045cf9d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261823, "uuid": "26fd8af6-a873-4bf8-8f42-6d50743a6d5a", "value": "12288:ADvyIzh0wyOl4dmHWZ5K8TphT7nmrAJmEFWeh3ih9HnAYTx:6aIz2wyOl/HiNRJsEFBYTAwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261823, "uuid": "d4a1bdfe-a7dc-4e6a-a4c3-058f70971a4f", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261823, "uuid": "5fb0e1ca-1994-4647-ac2a-d3372a826bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261823, "uuid": "fa3fbed4-c46b-40bb-85e5-59780a235b18", "value": "0dd3274dc695112f7f33437d224b2674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18c7c3e-a20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675241977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241977, "uuid": "8ed2bfbb-c012-4836-a3c0-f224cceba578", "comment": "Malware payload (Smoke Loader)", "value": "c227ad580a565bff58d94e080daf097a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241977, "uuid": "099e7e4c-4407-410a-a699-f564a2ecb797", "comment": "Malware payload (Smoke Loader)", "value": "6e3357f0ee726d400eb579a0fc0c3c7e745cdae67ed9e9f0cb0c4c45973946c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241977, "uuid": "7653300d-4e34-4e3f-907e-8cf11be3fb0c", "comment": "Malware payload (Smoke Loader)", "value": "66fffc12c5c54cb0dfdd3ace504c440a8eb135ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241977, "uuid": "f209b926-6ece-416f-a5f1-a279a1fea925", "comment": "Malware payload (Smoke Loader)", "value": "75ec1e0c784e46777c806e14640a3066d02b1455d36af5dcbac9fa7b9d12cf616cda2e90ce38d6aea1bd2a93b2398011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241977, "uuid": "e6025f6f-7a1a-4155-9b08-da9131c22a32", "value": "T16F34D0B279D0C07AC56B44749C34EA9477BEA9311839994B7B980A7E4F702D026FF34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241977, "uuid": "c25e8e0f-2186-4777-aa19-6644001da36d", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241977, "uuid": "13acaee8-8d0a-44ab-9741-85198bf6ce85", "value": "3072:4WoGRfK+GP+cTzLgoWL85UZ5/IOfXbpzetr/kB8p4OVYyF:4Wo1h2cvLgoWJZ5tu/k04Oey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675241977, "uuid": "f2ab638e-16fe-442b-b8b6-11563b29bf5c", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675241977, "uuid": "eaa082c8-f076-4da3-9c81-bcdfefda2418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241977, "uuid": "d9224e50-414e-4335-8617-2ebc8ef52841", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31820f34-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675263640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263640, "uuid": "c555dbea-2ca8-4373-863d-9cd0985b9c35", "comment": "Malware payload (RedLineStealer)", "value": "ef176de01a21df20fc402095195076e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263640, "uuid": "0ef24b42-8307-41a3-86c2-4f324d2fae0c", "comment": "Malware payload (RedLineStealer)", "value": "6e3ef582ebca27f12ebff54f82e8049baf35d2586ce5b943615474b2bc951137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263640, "uuid": "dbb4795b-4102-4049-9c9c-3a081ce57f98", "comment": "Malware payload (RedLineStealer)", "value": "f129a8138792a2a6d34961fbcd8863496adb1d6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263640, "uuid": "c5c3a21e-9b9a-4b16-9d24-c83903dbe812", "comment": "Malware payload (RedLineStealer)", "value": "798b70cb9c130f036063bc5ac16c3b376de56371d46e882d098939972107d2d09af4c4ba2c48ece5ea9095bb2afb3260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263640, "uuid": "95a44e5d-e9fb-4205-9bde-246caf3f13d4", "value": "T12B74F13336E0D072C5E610309C20A6A6AEBFF5312576985B775816AEBF702D06B3E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263640, "uuid": "6322b6cb-f2e0-46b1-8f58-2c61cf78c63f", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263640, "uuid": "b964cfe2-ca85-4901-b0bd-9a42f108ad30", "value": "6144:yqGMf5kLLy1ILlqCuDiV2KdA9MApDZs7oU5tUEGNEPN4:yqTG/y1IwCCgBeSApy7oq6VNE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263640, "uuid": "d24a9838-ced3-468e-af49-bb849bf3e0a3", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263640, "uuid": "71586c70-1bbf-4f56-9255-9a09d94dd38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263640, "uuid": "43b28a2c-aaf3-4ec5-88a9-fbedebbe899c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21912dcd-a1fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675234837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234837, "uuid": "e48796c8-ad1f-4f2e-9b5d-64e84c96277b", "comment": "Malware payload (TeamBot)", "value": "d8246facf451847eac47817f33f4629b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234837, "uuid": "b9b6c6dd-cc5e-4dd1-9f4e-0b7945c9acee", "comment": "Malware payload (TeamBot)", "value": "6ef4ae0f61234812d90c1dd8dcd497a3fa9f88bca0ac6c4c6d835a180322f217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234837, "uuid": "91f764cf-976b-4855-bc07-3b50bdfab291", "comment": "Malware payload (TeamBot)", "value": "c75829e5d986695bccd1fe5da3cd7a3f11902efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234837, "uuid": "26262f42-223b-4c34-8a3c-19acd79de1c9", "comment": "Malware payload (TeamBot)", "value": "b442010ddf2dc2e81d66d47972a66a82d998c7b113934c034e26e0da2c5dc22141629e8b8a8a76e9f39bf98f48d2a617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234837, "uuid": "5631c4c7-1efb-4b0f-9cd0-879fd9e4a371", "value": "T16B34E0227680C032C9A740709C70E7A57B7EE9315575A92B37AC36BD9F702D1763A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234837, "uuid": "ab7c8079-61b2-4ff3-909d-0559ced40f96", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234837, "uuid": "8c6910c9-48b4-490c-9e09-f1362a14000e", "value": "3072:PSFG5tT2dujiFLpdWJV5v4OBkl9lp2AvlZnFDzGQzZ04q7J:PSFT0joLpdcNSl9lpflZFDD24q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234837, "uuid": "ad662d37-3624-4b49-bb85-f7ac3baf4182", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234837, "uuid": "b3ed4819-f3af-4ba2-8595-e6f67fd0fc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234837, "uuid": "1ddc3302-bc97-479b-b446-1023b2dc610b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61520ce1-a221-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675249976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249976, "uuid": "6fa76536-4157-4f60-b984-a7ebedad1bf9", "comment": "Malware payload (Amadey)", "value": "52fca4d08faccbd7d3f9a487158ed24a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249976, "uuid": "aeb9db47-b938-4de7-b589-1a63f7a35151", "comment": "Malware payload (Amadey)", "value": "6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249976, "uuid": "3e29c00c-9e97-4590-9632-910534bd951b", "comment": "Malware payload (Amadey)", "value": "999297fae9adaaca1f2163e45aa4100ebe2a27f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249976, "uuid": "136dc760-a750-4b6e-904b-392087fdc6c7", "comment": "Malware payload (Amadey)", "value": "c432e9877c6bb7e47b91da0cd92955edcb9171964423ccf716f55dc466b6f0f29339caa80b990c382ac5cd78c0a4c765", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249976, "uuid": "1382ea82-b25e-453a-8019-be9327562a59", "value": "T16A3409217D16C031D96061B729B9BFF2C19DA8259B7049DB3B800F7BDA112E76A70E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249976, "uuid": "d5bfb8ca-a8bf-4cbb-bb2b-513651be7e08", "value": "dd0e4efabc62274a7cfb37b4b7a2951d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249976, "uuid": "24fed202-ebb1-40f8-b2f2-2c805f805cbd", "value": "6144:bMwVoejm5JJw20a1bfjVEmAuVy1GNgsk8gF:bp7Za5VsuVy0NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249976, "uuid": "94cd8ac2-c87c-4dc8-9876-6b242f2a1be9", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249976, "uuid": "05ce56b1-a8d5-4ec8-b14a-6dc5a3dbb9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249976, "uuid": "7064970f-637a-469f-8290-c73d83aeb9a6", "value": "52fca4d08faccbd7d3f9a487158ed24a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f288e551-a268-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675280714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280714, "uuid": "28aa4ebc-2e6f-43ad-afa8-7c4ff5d2215b", "comment": "Malware payload", "value": "e8c596f9123adb3446d48816301886e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280714, "uuid": "a20612dc-7177-4fb0-981e-91a7b6c8be80", "comment": "Malware payload", "value": "6efe700aa268844c175020f8086eba54a3ca912a8697b729166b50836c087050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280714, "uuid": "08ce43c6-a208-481e-bcc3-2a8dd8f9c577", "comment": "Malware payload", "value": "69a3a3a71e057ec97d47000320c453720cbe7cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280714, "uuid": "bfd87a36-d5e7-4adb-b5cc-6312ab4e718c", "comment": "Malware payload", "value": "bc2f31fb675a704e0d3bcda23e3c958f48652c7a2b8ae3f4eb1c87ca50b5aeab83391606da72094586fdd95d5dfd4426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280714, "uuid": "8aec9551-05ea-42ff-865d-80dc0b4d20c7", "value": "T14CA53357A96A8C36F281D9F91A21CDB7FB32AD46107C952134F63E0F7A7FAC26C05805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280714, "uuid": "61adfd3a-b6f5-412b-8fa7-47f9ccec30f0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280714, "uuid": "eca17461-345c-410b-9c94-0aa6a307ce58", "value": "49152:icPLnQf/rJXiQ7pta2kGsHKl7d4S6NrSIv6oo5GYYVEFebLCgv2MR:XPLnQftRjQeAFv6XUESv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280714, "uuid": "554a6b53-c137-4bbe-8150-a1453e59b3f0", "value": 2203403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280714, "uuid": "84255b3c-ea25-4982-a2ff-0a089e047501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280714, "uuid": "416874af-fd50-4e82-b0b8-0e8892c22350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c70847-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675239855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239855, "uuid": "41282cd6-4a05-4718-94a5-217725bd6664", "comment": "Malware payload (SnakeKeylogger)", "value": "a8caccc115c0ee90a947c31c8e3a452a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239855, "uuid": "697e88fa-ff64-45ea-91d5-2f59bdd04916", "comment": "Malware payload (SnakeKeylogger)", "value": "6f0318fc63a3a123bc36c8c9765852b56ab83083a2f0c1338d8d3493e7273802", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239855, "uuid": "cb7459d2-dfcb-493a-851f-0bd71a5a5376", "comment": "Malware payload (SnakeKeylogger)", "value": "42324c751619e2217c9879cb6bc312061d56639b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239855, "uuid": "ff429f50-1076-4e4e-882b-eba2315931f2", "comment": "Malware payload (SnakeKeylogger)", "value": "0c3a2ff6d212313fd6ef755f6e6e296c47a43d857e8dfe3627ff8062f6e8012a26d8bff099cb249a47600e5b2fd358ca", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239855, "uuid": "f7548b63-b071-4415-b915-47f020e0642d", "value": "T127027EB39B592D66CAA486FFD4487F160472FE54F1CE1385637CF9E2096B316863C444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239855, "uuid": "4381158f-2834-46c1-9a30-dfdaa672c764", "value": "192:3MHQcSUhRFs+McjIitJd07ab02yvQsqTLjFrJcLurIw6ZOzU:cHFthP7McjZ9oazJTLjFNcutaOzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239855, "uuid": "981c636a-7571-4ca3-aa08-b9f27ceb4845", "value": 8518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239855, "uuid": "7ed86fc8-20b3-4a86-a101-9b2999178f8c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239855, "uuid": "cf680437-ba23-4cd7-9a1d-33f2e32e6457", "value": "INVOICEXANDXBANKXDETAILS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cfbc58-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675239173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239173, "uuid": "1931eb42-aabc-424d-8f9c-eb5fb4a59553", "comment": "Malware payload (Smoke Loader)", "value": "22795ac80470f6fa863164904880b06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239173, "uuid": "56838741-00f0-476b-9fb7-568f49984184", "comment": "Malware payload (Smoke Loader)", "value": "70cc532f97f64fdb443d7e5f4b100918ef4701263f35be62d30b7c1fd70ea470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239173, "uuid": "c31b3030-98d3-4c46-a2ab-606188ea10ff", "comment": "Malware payload (Smoke Loader)", "value": "b6319330826a68d2e78663f9922226c2b931c5d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239173, "uuid": "a4bbb3cf-b6d6-4587-baa2-fd9888f69372", "comment": "Malware payload (Smoke Loader)", "value": "fac66185aa7757624ed280baede47ef70284bf85d82bfe78391510046e6e43a6dfae8ef216a2a9251231786bbcefe4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239173, "uuid": "adc15553-db58-4c28-acd1-9444c0ab838e", "value": "T1CA34DF2235D0DCB2C9E610706C70EB956BBEA53114B7A94B7B9C1B6DBF702C0263935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239173, "uuid": "e9c6d821-1ac4-4e13-9924-22dcd8ee9ff4", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239173, "uuid": "dcf10354-0a5f-429d-8206-2b14e444ee4b", "value": "3072:QW/Gn10lc7v0G9Lb4WMQ5x7EWA540NDBIKpdGQZEV1UX6b:QW/Dov0gLb4F0EWCZNGK7C0X6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239173, "uuid": "e93e7546-ff80-4361-bb25-834ca199cd33", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239173, "uuid": "1df07415-aa12-469c-8aa4-3b2d3eff4817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239173, "uuid": "e0e5f5f0-15b5-43ee-8075-10d1afbecc14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bf987d-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675239407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239407, "uuid": "ac5a0006-3737-4b72-91be-83f34b41b1fc", "comment": "Malware payload (Smoke Loader)", "value": "aae754c42d97b5092e49a5361d13fcb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239407, "uuid": "58b8426c-a1ee-475f-b0e3-8754cce8ec89", "comment": "Malware payload (Smoke Loader)", "value": "70e36dcd6d92f7921e7561835688071973758d7b8aa07d6f2c6d33be2dad09e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239407, "uuid": "6f586bd5-d717-4164-9408-4a9cccb069f0", "comment": "Malware payload (Smoke Loader)", "value": "556cab5e874b52e4db436e2ea0d192f2aacb39c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239407, "uuid": "486ed6ae-d6b9-479c-b729-7ec7befff6b4", "comment": "Malware payload (Smoke Loader)", "value": "ac992a65dbe0f97532afaa52c22245782b83fcaef5a798ef7ec3d525c872d13131039aa4c916d89259d6a5e19dea8db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239407, "uuid": "5cb098eb-88f9-4991-a01f-05e43d43d934", "value": "T12A34D0317690C032C5AA43304C20EA957BBEB8325539547B77981AAE9FB06D1773A37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239407, "uuid": "5141117c-4a95-4270-a18f-55d60b3695ce", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239407, "uuid": "d7da9ef9-a298-4860-a449-2cacf85fdc1e", "value": "3072:+WHGRDNnqkfLQL0yWz15/plHbrhknt0Bd7BglhaNtNZDsH/4f:+WHChf8L0yGpBO+/2aJZDw/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239407, "uuid": "b51281af-0747-401a-afa0-0914d86fb762", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239407, "uuid": "702627f6-16a7-4e58-b829-9ce5164df013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239407, "uuid": "2d4dd55c-7bd9-4f16-bb9c-dd433c39b0fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f49bf49-a26b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675281783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281783, "uuid": "0a822126-3b2a-4d7b-8a1b-407dc6c0a092", "comment": "Malware payload", "value": "f954b37ed06cb0d533ffeb1209154f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281783, "uuid": "fcc55f13-858a-4fa5-bf24-834ab7a3d98f", "comment": "Malware payload", "value": "711a1e3a095e292f772e7569f2b6380f242650b242f0b0fd9a4d6f638e61eb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281783, "uuid": "0e442834-2c45-49c4-8f28-dc2548ddf690", "comment": "Malware payload", "value": "d7ae42515fbbb4c48aacc3a56f4b5c9b6d6f188a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281783, "uuid": "7977cebb-a315-4b02-92b0-7d89a70f83d3", "comment": "Malware payload", "value": "0960f0481ee27601213b674814ee1fceafa7f9eb0c0bf312dbb72373ae62b7a988db47b59dec71f977cd5630bebcbec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281783, "uuid": "f93b2ff9-9db6-4b1b-b5e5-9004256e2748", "value": "T1DA7633103CD681FCC38794358AC47BD2B167A2242BD451BBA7F8DD6F193C91A8236DAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281783, "uuid": "b960164f-dffc-46fc-a2bd-744d5ab05730", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281783, "uuid": "ad0bedfd-968a-46ac-a03d-bff777c691e8", "value": "196608:91Of4WlzZevdyf3Npz5wyFdbqCJgIMlfLEa06jZ2YO:3Of4WnevW3NLwymrICfIt60n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675281783, "uuid": "e561bbac-abbb-498e-9d0c-9d1884019ab4", "value": 7586282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675281783, "uuid": "3b06ec76-12fd-4ea7-98c0-a0da384a132f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281783, "uuid": "975159f6-dc9e-4c3e-9651-cc3d36e9229f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53efb720-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267134, "uuid": "121fab50-c648-4aea-985f-15a31485cf3e", "comment": "Malware payload", "value": "1137589aa44bf2facb839b4a4abcb941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267134, "uuid": "2c406022-d929-4108-8839-ea7025ed9db6", "comment": "Malware payload", "value": "715455aef5e60b76962c64b6a1f1507d07566abc220c624c03b47b90e3cb4921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267134, "uuid": "21b65bac-3bd8-4ccd-9432-bbd7be3334d4", "comment": "Malware payload", "value": "7f86e36f26d36a2a9e4adac82a29668f8a4aab5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267134, "uuid": "a0fd3e9d-82db-4e36-b5cb-778c106d9956", "comment": "Malware payload", "value": "6a0b9b48ece707fb5daf9a2dfb3f5408154e9d43063fb85cc865042dc49aaa3d4b3c16ba996c8ba637763add91bde6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267134, "uuid": "4578660b-26c1-4982-b85d-406c3e08a569", "value": "T115C4235AE607B19CEA4B9EBEDB35CA12DE0050A173561C591713BD07CEE7FA4EC2B240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267134, "uuid": "f223c98e-9c79-4b6c-b962-430e74fc9720", "value": "217175ecb4b918909da918aebf70d95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267134, "uuid": "3baf7c78-b226-4976-b4ef-5bc100455135", "value": "12288:IdXvDWopdu11GNJGUOXOoDscvVqILhtgNUJh9UhJwYL:Mv6oLM2GvXOoHdqIdgUJeTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267134, "uuid": "7f711ba6-81f9-47cb-b5e8-0bb42163f519", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267134, "uuid": "a834912d-9e28-482e-8219-2ab7002c3ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267134, "uuid": "4093594c-2cd3-4a2b-947e-3e94ac5ba41b", "value": "1137589aa44bf2facb839b4a4abcb941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8417d809-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261631, "uuid": "5132c3aa-dfe4-4db4-a793-84d7ae289f44", "comment": "Malware payload (SnakeKeylogger)", "value": "e22d903df28eeabec96a1448d5ca9eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261631, "uuid": "9d51549f-2d52-4998-8be9-b01b42dd2d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "716527bcedf4027e1184a023eace3035400531c8e9fef134b4435f0afdbdbba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261631, "uuid": "81ce2f61-f682-4b6a-baaf-f56fafb7c59a", "comment": "Malware payload (SnakeKeylogger)", "value": "3b4277261740afd0c15fde9dbf2153af00eefd67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261631, "uuid": "b1f65a38-2790-41de-a2fb-91e7ea0e9b3a", "comment": "Malware payload (SnakeKeylogger)", "value": "2aed41dcefa672b2bf6922aee83a286acf36395a2b53a097330aad31f7ac2105953c7ff3b4d0817f7ee89199f5757aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261631, "uuid": "4620622c-0b1b-4d4f-b3b7-0a6e8f3689c8", "value": "T17BE47C8777B1A8B2F6CB10A5142837CD2FE07103BE95E257AB7B79C0A7058FB7698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261631, "uuid": "4b0fe109-75c9-45e9-b9dc-dac363798c13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261631, "uuid": "49752b13-3f41-48fa-a301-b4d5c2697987", "value": "12288:Gtz8L6gu+xMRSR5Si5LiaKiN4bJbwHUnaHas1jc9J58jGH/CSqG4yPa:PLzyRU5N5WaKiuVbwMSg5LH6SqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261631, "uuid": "a31b5529-fef5-4544-96f4-b81e0938e6d6", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261631, "uuid": "cb64c3f1-66dd-4af0-b1b6-699e0205a9f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261631, "uuid": "9c27d07e-eeba-4c22-bcff-09d8a315db59", "value": "e22d903df28eeabec96a1448d5ca9eb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5ce018-a247-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675266178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266178, "uuid": "33812283-5289-4e77-84a6-b92d608a5199", "comment": "Malware payload (RedLineStealer)", "value": "2bcbc3dc4e978242dd20690f29a3f475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266178, "uuid": "a7b0f42a-b441-4168-a5e4-541cf37e61a7", "comment": "Malware payload (RedLineStealer)", "value": "724e621a6d5cdf4f73f39e77178b9199cf5fa5d7bb4a5310b064685e4ad098ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266178, "uuid": "c7759dbf-920c-4731-9bd8-878bf864516f", "comment": "Malware payload (RedLineStealer)", "value": "f4d4df1eac23ce500a44880fc204804b7f01adb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266178, "uuid": "56761009-ed78-4b6d-9361-684ca92bcf75", "comment": "Malware payload (RedLineStealer)", "value": "8a2966f1cf846ab4db1b7968120a78670db5134692ff616af1c163f1dc98f356d7a8cd7a6de24f4ac5235c018a8094ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266178, "uuid": "43aade32-0de2-45e5-8710-9fec4b19df14", "value": "T17344AE05A7AA1E33D869CB346487F2721B21DC7A8990C30739C8BD673F77B920A154F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266178, "uuid": "5debba41-5ea2-4a14-a40b-27ea4c16a70c", "value": "3072:4BNHGY+kcVfupotY4rNzXcQfr93f/XvS9D7ZZ/0daoWep6jTwC5wxb:4BNIjcQfRvS9HDkWMww0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266178, "uuid": "0e8c8472-d19d-42b7-bce2-411f539cd8c8", "value": 260888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266178, "uuid": "71811004-c2ed-4b7a-a33a-7dbb76886487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266178, "uuid": "32094df6-99a4-4576-ad33-68dc61a90614", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9871b42-a219-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675246662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246662, "uuid": "66b3c248-2564-4ab4-b6dd-0edddab931d6", "comment": "Malware payload (Formbook)", "value": "f671fee9b885ec3f5765786049dc3c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246662, "uuid": "446a2959-4c2d-4e6f-ae35-47ba2e51e880", "comment": "Malware payload (Formbook)", "value": "729ccd7376ea8928baa92aafc404bd6408319185f63664914801cd09fb7099ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246662, "uuid": "f112bcbd-6f4e-458a-9e3a-3778a0f83267", "comment": "Malware payload (Formbook)", "value": "9dd3fb0499fe2fc138571ec318bfeca9619cd6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246662, "uuid": "96a63229-308c-44c6-9947-65c09f75685e", "comment": "Malware payload (Formbook)", "value": "61a9adad777d8f8613af062ead99f24d8849242a1f54de6e362c852598f904c30bd30883556c20d8a541a2638567e17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246662, "uuid": "6d29f209-e524-49ba-96de-a8549cf2fa5a", "value": "T18BF2089877EC9733EFEE43BC68B421825BB1A933A601E7082DCCA4E955927D74650713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246662, "uuid": "61ab93aa-32d0-43b0-8b63-cc753f4a5bab", "value": "384:NOhNuCCfNXNAQFP8fwEwl/WtY3R3ggKWuUw34KljAAlGOBN3bvE9DKvFUkml8kWx:NOWXNz8fnDY3NxKWZih2uW+k2Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675246662, "uuid": "321e275c-d3ae-4fff-9420-700ce11cab89", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675246662, "uuid": "d33a5a1b-eefd-47b5-95ea-69b0fa873726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246662, "uuid": "3dad351a-fb93-4a74-ada0-2c69c1a26257", "value": "Conferma_di_pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed10059-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675267233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267233, "uuid": "4e72ba9a-e1e0-4ab1-a8a5-b0c93117e462", "comment": "Malware payload (Formbook)", "value": "66f3a7d63e6bd9fadbb50dbd9c423418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267233, "uuid": "5edd5950-556a-45bd-bc28-64fd5fd942ea", "comment": "Malware payload (Formbook)", "value": "734bbe06c909b28854008cc74bfb94d4bcb19d5e9d1c58bc5e00da61f85c4cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267233, "uuid": "46fb6cf3-4121-407a-96e4-032130fc7539", "comment": "Malware payload (Formbook)", "value": "9b8eaeac9c2efef0d7244b66f11d2f04efd48ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267233, "uuid": "23df7049-917d-4a78-848a-b0284a38b98b", "comment": "Malware payload (Formbook)", "value": "6a1ec66f56332205396c5131436c9e33cc1a96fbb7b5f0dec04353ff8e3a8170f81829b5136eda7519fc87d9504ef724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267233, "uuid": "29f300fe-3ada-409f-9a43-75947ff0dbca", "value": "T1D2F4027EC36CDDA7C74C01B950B050866FB246BEF862EB8D0EABD575888B3416E164D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267233, "uuid": "726bcde1-531e-48ca-844e-0dfa2fed7712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267233, "uuid": "bb614754-b51b-4e22-ba61-a043c9b3d13e", "value": "12288:zHtuoWeh3ih9HBGESoc85V3ebV8furno0vFPb4cri21isT/gyEuHF3At:XBYTBG0c85Xfu7o0vFjrrNT/gyE+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267233, "uuid": "abc9a477-6c5c-4de3-b88a-20b581ea54e0", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267233, "uuid": "6bc9b770-b8d2-4a58-afc8-bab3a75ab8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267233, "uuid": "4130dd11-14d7-4c53-991b-785c249561d4", "value": "66f3a7d63e6bd9fadbb50dbd9c423418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff39f017-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675267421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267421, "uuid": "5df97e61-1e9e-42d9-b8c2-01cb3c8b400f", "comment": "Malware payload (Loki)", "value": "bb7abdc1adcd9b80507f30a6236911d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267421, "uuid": "70a3d4ef-e78f-4455-9e17-690f804ff9f2", "comment": "Malware payload (Loki)", "value": "73a6100eaa8300bd7adf9fa67eed914ef1e31f543cad2c6aafd5010b590f2ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267421, "uuid": "97a6571e-eac1-4bb3-8fc1-5aded4f457a1", "comment": "Malware payload (Loki)", "value": "9c54856199a5fd8d5d1328a01da59419aac6e46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267421, "uuid": "ce3a6381-b46c-4854-9b74-867ec0380dd6", "comment": "Malware payload (Loki)", "value": "300a55430fa7e50fde8af7033c870c9df9f07d9acf3db1b5092a4f184b12d7beb729121d419ebc3911cbf1d94893b853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267421, "uuid": "7b99be2d-3596-448a-ad68-4bc3b7306bb7", "value": "T1E0F4294137B15462F1DB05B9102877882E3D7443A2E6E2665BBB79C49703AFBF298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267421, "uuid": "6e41c70d-983a-42a7-90ed-cfe539915a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267421, "uuid": "237f328f-94a5-479c-9f40-979c8d480646", "value": "12288:we9acr8m2wpsCNwLI6gBYDJEP4aH9i7+pvxc4N34o:we9acr8FhC689YDOgOw6Rxc4N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267421, "uuid": "9705cba0-ea63-4940-b9f3-d2da510daf0e", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267421, "uuid": "ba0c58dd-052a-455c-aa83-77f4bc67bdfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267421, "uuid": "6c24bd13-93e9-414e-b4af-8d31f2d9b42e", "value": "bb7abdc1adcd9b80507f30a6236911d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe527d-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675239649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239649, "uuid": "411d2f62-96f7-4556-a8de-9e26b120e0cc", "comment": "Malware payload", "value": "4b7aa837e88cd219bdb017dd927ef978", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239649, "uuid": "1c855f48-1646-4639-995a-bd3713077a4d", "comment": "Malware payload", "value": "73bc1996842a2b9bc3d02bad78a3a6c7f168df28116bcf49e74d3e1fc022520d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239649, "uuid": "f01caa29-790c-436c-a3c8-4b7fdf80a5bf", "comment": "Malware payload", "value": "f6bfdf87b9acc4150f2dd875ad7802de36f3b9a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239649, "uuid": "cfd871e6-657d-48c3-8ebb-56d5a1add5e5", "comment": "Malware payload", "value": "89c57190a9fa0d970e4177db97616c1cd5870d1517110f9d3ca304ddae5b029cb133bf420fc21124956c34be43f55a2f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239649, "uuid": "f91946b6-f9c7-41bc-934c-4f169ccb2ee5", "value": "T1F843B45AE79E02648F9102B3671B1A89AABDB33DB3505471386C933433DDC7D4276ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239649, "uuid": "0326f613-650e-470a-8c4e-0b6449919ec7", "value": "1536:Nf0Xvx3EMRf0Xvx3EMZqnfPnk+bBTQBGkSi:NsXvKMRsXvKMQnffk+NTIGkSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239649, "uuid": "6f4053c2-a75f-4bf1-8074-fa8d13dd312a", "value": 56518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239649, "uuid": "cd1efee3-05bb-40b7-a225-5ef254e25dc9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239649, "uuid": "830d9886-d2de-437f-bfbe-1b165ade4ffa", "value": "rfq_items_order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6615750-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675261689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261689, "uuid": "9cab072e-7730-4551-b9df-af2d7c061a8e", "comment": "Malware payload", "value": "6b32c3fe6ac6dc3891575af2f3ce9dcd", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261689, "uuid": "da53882f-a126-4864-89c7-599131520469", "comment": "Malware payload", "value": "74c01c811409b3f3621575a74f6ee53758930dcb51e3abb6de73bf4484a7e432", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261689, "uuid": "82fb1b60-6d8f-49e4-b4c9-f2fc7a33e57f", "comment": "Malware payload", "value": "b2a995c7c3dd33da30427aa08ab218ad0650f84f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261689, "uuid": "ec7ef471-6904-4b9a-95e1-3fe8cb825c13", "comment": "Malware payload", "value": "90d393486ac77661e6ec44c0c0522fdafb12f76aaaf9ca860c8fa8a1e90c5dc51839d7f71cb739602b6de766142a253d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261689, "uuid": "ec0b3bb1-f087-47eb-9916-95b26ffbcf78", "value": "T11B641393EF499D4A8C79536CB1310E441C6C1C8E51219FF0BA9E95ABAAFEF48113C7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261689, "uuid": "bccddd15-4248-44d7-a25d-5440bf382f85", "value": "6144:+GKzVI1/tPwlDO0rNSGdMaI37O1QGIbwPppYKTmfTb894vqXS0S:pBKvRy7+IMpYD7SZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261689, "uuid": "4b060b34-c2c8-469f-b957-9ecd33062ce8", "value": 316295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261689, "uuid": "f8ab4967-c7dd-4f3f-b4b5-b12c9d052e7a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261689, "uuid": "1e837c91-650e-4924-a290-6d58ce630505", "value": "DocuSign-Feb01-2023-851846.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d241df8-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238776, "uuid": "a38c4782-3682-4e1a-b679-0f920e1ba012", "comment": "Malware payload (Gafgyt)", "value": "2c70d69d0a3161cd69cb3416b132322c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238776, "uuid": "c80a1c59-730e-4bfa-8671-72066a530d37", "comment": "Malware payload (Gafgyt)", "value": "7514184b4cc7752c1c58c22324483abda9a4c675383ba0bcda6b09521e3f6dc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238776, "uuid": "b01d3a12-4a51-4380-bd4d-3e5a93bb0a91", "comment": "Malware payload (Gafgyt)", "value": "f1b06ab023ffeae51c45dbda9e4afcf04a8ad57d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238776, "uuid": "f1b16016-a8b4-44b8-87e6-34b56af1ba77", "comment": "Malware payload (Gafgyt)", "value": "90ec26472e912c4282e7011d16b02b0965df03846916d9ac555285aaee2ad8025523529f0825bfeb30c58b96bff2b199", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238776, "uuid": "8d223b65-a802-4a07-b216-2ca0e02455da", "value": "T1B4B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238776, "uuid": "a43a4aec-3739-4ed6-915d-45287262fd07", "value": "3072:b6an17WtsWhdgYJa0D6mbPbmTQOWsXAOn:Wan17WPJa0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238776, "uuid": "2c25ab50-e6d3-4ee6-a1d7-6f6ef8e264c2", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238776, "uuid": "e954b58a-a766-4713-a113-aab03c4e9c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238776, "uuid": "55f994d8-37d4-426f-aea1-55cd2dd71f73", "value": "2c70d69d0a3161cd69cb3416b132322c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963a4094-a224-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675251354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251354, "uuid": "485c16a2-9d76-49f4-bdbf-d1000e3b3bc0", "comment": "Malware payload (Rhadamanthys)", "value": "08186292ba0252030f3a4807e835a826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251354, "uuid": "34c67e4c-1873-4878-b766-45c50aa23ffa", "comment": "Malware payload (Rhadamanthys)", "value": "75b82a47973b3e47029c8b91b177cfeb19903d58c9d99a2d91f411984e5e7975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251354, "uuid": "c9221a24-cfa0-46e8-bd2f-2fbbb1932d67", "comment": "Malware payload (Rhadamanthys)", "value": "0d0b12c832838aadfc63eb7dc8f03253ba6c01dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251354, "uuid": "85c3c529-84b8-4ab7-a661-78ecf7e14e02", "comment": "Malware payload (Rhadamanthys)", "value": "e2a8b58a93613c4ac73421219e677beeeb1c4b5a11481dc227ab18b998d3273373cb6316b306d922f6d44cf4db49c428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251354, "uuid": "55faaf1a-bcb0-4473-8365-9f1d6b52683f", "value": "T10E24D03279D0C072C6A754700C20EAA53FBDF47159B9A94B3BA91F6D4F306D06A3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251354, "uuid": "8420321a-c1df-4cfb-8566-7e42551f925e", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251354, "uuid": "d112ce61-b35a-443b-8caf-46878b3a5717", "value": "3072:FWIG3SkpCLOEIfLKp5Wru511Z4c0JIo2TcAwb12tZTqGr15ZeL:FWIV7aEALKp5OmR0JECstf1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251354, "uuid": "0fc553c8-321d-4e08-a1c1-0fd74b828e9f", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251354, "uuid": "b760160d-fc83-44ee-83db-3b7b44520f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251354, "uuid": "0f2e5397-187e-4d34-a169-f31881513670", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc69196c-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675264410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264410, "uuid": "dbf6366f-06a1-4aeb-9c0e-0190a998329c", "comment": "Malware payload (RedLineStealer)", "value": "6dd4e42700f658e6f9fb5cd371334328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264410, "uuid": "71f144ca-84ca-4f1c-998c-c2ffeeb2de31", "comment": "Malware payload (RedLineStealer)", "value": "768eba7cebce8cef3a57585b6b718bbcb4ce6b3a63453a81731fa1285ce39e8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264410, "uuid": "a3297940-47c3-4ac3-b45d-59c94d920003", "comment": "Malware payload (RedLineStealer)", "value": "5a6d03f176ff86dae69f36e91d46b2a974202087", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264410, "uuid": "8dca9445-7b5a-466c-8ecf-c0df18630794", "comment": "Malware payload (RedLineStealer)", "value": "67093ee5bb936be3d666052ab7a78597a3e361e0db3746c3ce68db3ba3f65f9f5bd8ea9af9a9b7ab04a2d88e940bf40c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264410, "uuid": "c828289c-e96f-4c1d-8aad-ed89d41df9cd", "value": "T1E274F12235C0C872C1E391305C24E7E5AB7EA93016779A4BBB5823BEBF305D1A236357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264410, "uuid": "285ec5b5-caed-45b6-996c-d2a79475b39e", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264410, "uuid": "ae7867c7-6ae8-4c7d-aa15-096808ead7c6", "value": "6144:PmKE6ALVh4c0+a1Sqvs/INnK4DM35jWpG+CwQgW:PmlfJh4ua1Sqvs/INnI6I+vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264410, "uuid": "aac6b403-25a2-42ee-8fbe-fa410b9e02a9", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264410, "uuid": "17a98876-01ba-4829-9133-6eb1f39fd739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264410, "uuid": "9143d3dd-6522-4225-a151-61f0c06e220f", "value": "6dd4e42700f658e6f9fb5cd371334328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799bf43c-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675266767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266767, "uuid": "fafca103-6f56-45d0-97cb-cc9ebd953fff", "comment": "Malware payload (Formbook)", "value": "58011275adaa797e50a82420cf61247a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266767, "uuid": "e6b6f103-6378-475b-8f43-7537dc2b289b", "comment": "Malware payload (Formbook)", "value": "76cded40cd51eeb98f734dafed6ac0b0562d847a48b5d42a9b55d11dd73f1d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266767, "uuid": "305cf260-275b-4101-b785-67ef99ce77c8", "comment": "Malware payload (Formbook)", "value": "8596de7f01f1c10753e2c167c0a2d4f923cbf165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266767, "uuid": "817a473b-07a6-4472-b82a-3ca994a70533", "comment": "Malware payload (Formbook)", "value": "16656d89f6769feb86e31fbd5672f711b3d7f4e6bfdad6563f77317eccf12f4451ceb2c48fe8a3707674f3a0ae1c1c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266767, "uuid": "4470a4d4-564e-4ab0-a042-abc03ed8aea6", "value": "T190055A4137B15872F0DB05B81028768C2E3D7447A6E6E2665BBB79C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266767, "uuid": "ea15929f-4bd9-4f09-87d4-696b1816e032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266767, "uuid": "501ed05e-b25a-4adb-a015-3b06705ce394", "value": "24576:BeCalr8/BJzDMPUIiiN92Ndew6Rhc4N34:Bolr8/PXGviiQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266767, "uuid": "ddf29b3c-da9e-4017-bf65-64d89b7eb93f", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266767, "uuid": "5a3ca29e-3116-44fb-ae86-1407260a31cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266767, "uuid": "a39d8cc9-663a-4517-9c5f-7214b3277d48", "value": "58011275adaa797e50a82420cf61247a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf66d29-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293081, "uuid": "50ed423f-0b64-4ee4-8513-9169808ca03d", "comment": "Malware payload", "value": "c60b17da68fad886be8bc335763eda29", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293081, "uuid": "9c8dd328-e354-4070-af62-88c86d7667a3", "comment": "Malware payload", "value": "778712d44739c782b88ec1f2c4fa36e37486401e4027bf09cdb8b920bba3cff1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293081, "uuid": "8e554f5a-7d7f-4e0e-aa00-8768df1a4357", "comment": "Malware payload", "value": "368cbaf2aa7e594c80d309a9336f25c313eb7633", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293081, "uuid": "6e943bd7-cd73-4fc1-92bb-c3cb27517758", "comment": "Malware payload", "value": "66c0cdc59ed7740a94e6c49a10b3b9c017613e9b28f0eca85c54638e076f44cddb8cf9cf1abfa1ecd45b15d9d12144e0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293081, "uuid": "e52d9dab-326e-43dc-94dc-f322c5e56471", "value": "T14D4151517BEA1B02F2FB763706F772215DBE3C58B755852E1150C1161E32C189C9C72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293081, "uuid": "f7963470-5cbd-4400-9c83-2d2cd0d0d71c", "value": "48:8wlqmDRe0Q9lnvy0Dk+ZQ9NqkzcvgWjE6:8nm9eHVyzDbzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293081, "uuid": "22400fdc-7e98-4799-a288-750c02583300", "value": 2349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293081, "uuid": "af44c805-82c5-4dd6-8808-09694d7a127a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293081, "uuid": "f998c771-d006-4c93-a0aa-1ccd74077f5f", "value": "Epic Privacy Browser.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02e5cbd-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675259128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259128, "uuid": "eb138d35-c689-4db2-a84e-a9350ceb6a23", "comment": "Malware payload (GCleaner)", "value": "f581d3cf1971af270c5abae90154411d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259128, "uuid": "77545038-878f-40a7-8d69-b0a3824ff653", "comment": "Malware payload (GCleaner)", "value": "77b9500413c6b14d8f56b0bda81f5db595d19f648605159fe2ade3ef72f26f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259128, "uuid": "5f5ddd73-c0f6-4adf-87d3-0e1ed5f0929a", "comment": "Malware payload (GCleaner)", "value": "5344a79cffc4c4a9796d11cb83e765193775232f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259128, "uuid": "4de36ac0-7069-43af-a3b4-1bb293a5dc3a", "comment": "Malware payload (GCleaner)", "value": "ebaa3c80ef895bf81066dc81ff31d19a13aae6fe5bd235a70618ea83e065fdeb8d3609540343b72b73c0135524b8a92f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259128, "uuid": "66850f40-6097-4ab7-a7f7-21d0d43428a9", "value": "T173A52352AE7A8C32D18177745F21EAB2AE7AAF00253C5611A6D77F0F363F7931D48212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259128, "uuid": "695aad69-ebd8-47ac-a939-953fad35dcac", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259128, "uuid": "ad27c7f5-1449-4f7f-9ac9-88b137222aa0", "value": "49152:icPLnQT/CSKVMoXwYyfj8APZGWHG9O4cTchOdzpgMCTuuPt9NDInLCgv2MR:XPLnQT/NsCHrm1gchEC6ut2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259128, "uuid": "8abd9f0c-10d9-49d3-8174-0854314c064c", "value": 2222258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259128, "uuid": "2c29b347-738e-43be-a797-9fd1da093c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259128, "uuid": "a9bb3528-f512-4434-a880-7ea4bc72f95b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce27ff36-a23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675260896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260896, "uuid": "9c37b59e-81a7-4fdf-b456-8b9db0acc922", "comment": "Malware payload (AuroraStealer)", "value": "efc0b97b0a694038a463da6ec2f0eff7", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260896, "uuid": "a30dff0b-7c73-4dcd-9876-c59b7b295b40", "comment": "Malware payload (AuroraStealer)", "value": "77eacb901a5b70a6bf9ea64dfd95b7cbdecaf548ad69eefeb94962597f2e268b", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260896, "uuid": "f1a9c652-5a0a-4c41-9f1a-4dea658d4d3a", "comment": "Malware payload (AuroraStealer)", "value": "b114a146e76921652e9acf0fda0a45de3ec0d39d", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260896, "uuid": "655c8ba7-8fae-4582-9e7b-e0420ddec65f", "comment": "Malware payload (AuroraStealer)", "value": "9a3549b7c62a3b758889d696a67c9af411b691da26477ff62ed25309e1a16003084f8bbcc34212fb35a05a151b025a73", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260896, "uuid": "0d616e6a-9956-4d46-8578-0262f16dd986", "value": "T115E5284BB88081F8C1AED230C9659262BA703C955F3163D77B10B7B92F73BD85A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260896, "uuid": "e92cb13c-3c5a-48b0-b24e-5c4cee1c9498", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260896, "uuid": "c49e28ae-0ce1-4edd-a327-8bceaee50849", "value": "49152:fZ+3yoz51fQ1IbhmmyYIa3sLFA8pQb2ik1g:/S1um0LO8pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260896, "uuid": "2a62d449-37a9-4fd5-a923-cc30a4a5332c", "value": 3174072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260896, "uuid": "63439f44-471b-4320-a947-a2e3110597d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260896, "uuid": "7faf17f6-cdd3-44a2-a318-2034f7256ac0", "value": "Filmora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bd75c1-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675264241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264241, "uuid": "68b98039-5655-41a1-9ea3-9f1a0cf8e841", "comment": "Malware payload (QuasarRAT)", "value": "ffb56a33bfa21c533b36979635dd980e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264241, "uuid": "0582149f-f454-4fc9-9fee-75bab1e3c31e", "comment": "Malware payload (QuasarRAT)", "value": "795976a3528516ac7da01e3d2869f4ea117ff5710d1b3b280db869fa9324e72e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264241, "uuid": "0ba32dc6-9f95-460c-84b9-00c421bae94a", "comment": "Malware payload (QuasarRAT)", "value": "55201ed8cda121f1a52f6bb50ce30c72cd7292b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264241, "uuid": "0f368b36-82e3-4f88-9bb1-543564413295", "comment": "Malware payload (QuasarRAT)", "value": "3ed47db7729c9a40a8d64e914849cb7a56d99399852e2062084538aafdda15a8f14074b5e8b731ad52a044d78eadf317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264241, "uuid": "5d87f20c-b451-4863-963b-6bdbbd002252", "value": "T134652302BED684F2E9721A341E39FB55A47D71701E25CB1FB3C48DAD8A741D0A234BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264241, "uuid": "2f8a8117-d1d3-4371-ab86-7931cc10aa41", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264241, "uuid": "00048fb7-2788-449a-b886-ff05e9c20785", "value": "24576:jNA3R5drXq1ctrv26e+hBJxGOs80ekDgOOm9/lon8v1ACG8IpL2NhbApHPwvXwl:O5KorOH+hBJxc8Nbv+/y8vJuLSuH4vXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264241, "uuid": "286a4d24-c663-44bc-9c49-12aa1efa90c4", "value": 1484388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264241, "uuid": "09e07fe1-e9fd-4917-83e7-c52c39e3a95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264241, "uuid": "bb82eea9-9b2b-4684-9210-7e732eeffc23", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defbd1bb-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261784, "uuid": "52f9de4c-c40b-4d20-b47a-09fad4fadc3f", "comment": "Malware payload (SnakeKeylogger)", "value": "1fe6d6635c79a2397a209b022c8b93ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261784, "uuid": "9c1b7822-cf82-401d-bda4-5d38fd9f93ad", "comment": "Malware payload (SnakeKeylogger)", "value": "7995b25df7376ae34f085f413abd187afd4c49296cb8f0502154bc4e7f517671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261784, "uuid": "36ef2f4b-252a-4fb6-b015-a7e704ff6693", "comment": "Malware payload (SnakeKeylogger)", "value": "c367a3905af3a364366df485123ca85eaba96e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261784, "uuid": "f31d5281-b8a9-4c53-b186-fd0f4268bc92", "comment": "Malware payload (SnakeKeylogger)", "value": "3b4a04d222bbef43819d5b712cd0566c745eac9e18551b07585f6e1a3b62a3275c3b8425058b73be5fd639e8fe4bf396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261784, "uuid": "97a434c5-f40f-4f64-96a6-b31667eef046", "value": "T169B412013BF987ECD97D43BEE0F2952452B42E392E96FA984F9D31E81037307865196B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261784, "uuid": "3660b145-86d2-4314-ad3c-2fcfc0857b38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261784, "uuid": "5d6817b0-7ed8-468d-82f9-89fb3476f3b7", "value": "12288:86AtC1Sq3fbyMumk9d9W/7C/Zhr8z9i7+pvFCWtO:86AtC19fGMPmmT2Zhr8zw6Rkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261784, "uuid": "4b5d94b7-1574-4658-8ff8-16ede742a0fe", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261784, "uuid": "460d8581-00ae-438d-ba84-5a6cde0060ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261784, "uuid": "3f5c7ef4-fd6e-46e6-8abb-1be86299f870", "value": "Rl2sxVWkRi0F8rN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72ed38b-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675262119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262119, "uuid": "e7a9a2bd-ed34-45ad-aa3d-50461b85f717", "comment": "Malware payload (RedLineStealer)", "value": "20db61ccb52632444a492cffbbc986de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262119, "uuid": "206cf5a6-7446-4c13-9c55-370a828e1a19", "comment": "Malware payload (RedLineStealer)", "value": "7a0b21299484bd83d27963c5ae20bbe1ff83961cf156e7a54fefb463f9d3f477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262119, "uuid": "f633759d-b9d7-4ae4-9d64-f712f345931a", "comment": "Malware payload (RedLineStealer)", "value": "833e7f22a08c4962b54ce1bdf81608362d50dea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262119, "uuid": "44f2d91c-14f2-4a58-90ca-16cd9a3cd9ec", "comment": "Malware payload (RedLineStealer)", "value": "bbd928c1da0e341e4c8cef3d42406275e955d0b88140fd1c5015e4355888bb0de22ebbbfa7cb5820f496848bac1df6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262119, "uuid": "624d6324-3bf0-4ec2-8fb5-806b860cca7f", "value": "T14E74F132FAD0D07BC9B2553048209BD5BBAEA5321874961B77941B7F9F702D2673A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262119, "uuid": "e10bc89b-3877-4921-aee2-989ede6b0853", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262119, "uuid": "09076768-1240-40f7-9db5-1d3bf9f5dfd0", "value": "6144:pWguCR+LCgOy9jeL0h8Y/NnJxdZFWSiR1e6q+w:pWtE+WgOyj448+NHdbWSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262119, "uuid": "533eba6a-4973-4130-95cd-4aa2942706f6", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262119, "uuid": "6eb401e7-84ca-4879-804a-d9be2cad9b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262119, "uuid": "fac2c6f6-a817-4b7c-82d9-e16e2bd332e3", "value": "20db61ccb52632444a492cffbbc986de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a2117-a243-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675264427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264427, "uuid": "ca455b45-f139-4664-8a26-5d0454f90249", "comment": "Malware payload (Mirai)", "value": "30b29b6aa1277d96e8f8072dede07201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264427, "uuid": "ac798f51-d849-44fc-8fb7-dd5f65b84928", "comment": "Malware payload (Mirai)", "value": "7a21d139a118c2cf026168627caac7063d89dcaf021c34928e86574ea560e162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264427, "uuid": "b2b8b595-94b1-4161-b809-cb4e4246878d", "comment": "Malware payload (Mirai)", "value": "d6b87439f924359bc4403c50f6a36960e8fa230d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264427, "uuid": "6b670f84-b0dd-4297-abfd-c5a467db4d50", "comment": "Malware payload (Mirai)", "value": "48668870000db2fa1cf6595db03abc62c78b8949c7da3caccf1c400b1d3e2e87108c99699851d75082b5a1fe84343812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264427, "uuid": "913e871d-0d77-496f-aa68-d522d194a5ca", "value": "T1E6432991BC918A16C5D422BBFB2E41CD372623E8D2EF3207DD212F10778A92F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264427, "uuid": "7ef68c7b-d4e4-437b-adef-cd3c36fe4e12", "value": "1536:vzO/yM6usAyPWppG+Qqmumt5/WLTtY4slZ:vzO/o6Il1db/2YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264427, "uuid": "8394dd10-fa0e-4d9f-9f23-4ba4070509d1", "value": 60376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264427, "uuid": "618c7932-9860-4e27-83f5-29b199fa5475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264427, "uuid": "88e151a1-cbf4-490a-ae50-0da048a2de96", "value": "30b29b6aa1277d96e8f8072dede07201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af38bef-a21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675249134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249134, "uuid": "53175470-da47-4fe5-b1f5-67df29701099", "comment": "Malware payload (Quakbot)", "value": "f9caf2313a2bd50be958042e12419aff", "object_relation": "md5", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249134, "uuid": "ab0e24e5-59fc-41d0-a499-a9f6fd53d767", "comment": "Malware payload (Quakbot)", "value": "7a4efd0b6ceca6ac39f93acae4e5e8c6e8fba17ac089bcc35893de2d45f690a1", "object_relation": "sha256", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249134, "uuid": "d1fd93df-5a24-4b1d-95d7-4f857ce647d3", "comment": "Malware payload (Quakbot)", "value": "d0edcffe0527a28d102f7cc4003975677d41e0fa", "object_relation": "sha1", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249134, "uuid": "968a241c-ec2b-4f00-9378-4b925c739bfa", "comment": "Malware payload (Quakbot)", "value": "4c559f59fd304d42e376b305bd6bed0a3e45d12015773f57d41d2a83af672f5d7f038b5fcfdd790a0804df4540c3791b", "object_relation": "sha3-384", "Tag": [ { "name": "1675243711", "colour": "#90A497", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249134, "uuid": "43876d56-ad74-4fbb-81af-5ba4fe9d946b", "value": "T192C3122D99F6D29DE537B760F42D3A40A6194C5AB67771B020EC236ADB5F026CB0D233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249134, "uuid": "b68e013a-f963-4cd9-b838-0f08eb87bc7b", "value": "3072:N+8J8U0KFOnp+YTfM+wYuf8XVEZFDD9OF74cQyIzQRuKigNGpL4Xs:N91spPfMNYuf8FIFD5OayrHJsLEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249134, "uuid": "eddd8416-73ba-4b1a-b328-340284e93455", "value": 123388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249134, "uuid": "fd3da82e-8576-4607-ad86-2e31f743b286", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249134, "uuid": "71497502-7eac-4037-8113-8cc845b4052c", "value": "65643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8d3bcd-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675239369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239369, "uuid": "e891a533-d0e6-4a3f-878b-a1ee5462f4a7", "comment": "Malware payload (PureCrypter)", "value": "d6f8fe93185b1f97a8ded2e50f4affb6", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239369, "uuid": "0951516d-bee7-44df-85b1-bb6336f57d23", "comment": "Malware payload (PureCrypter)", "value": "7a5b8b448e7d4fa5edc94dcb66b1493adad87b62291be4ddcbd61fb4f25346a8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239369, "uuid": "0fdf3496-d339-4c2a-9e6a-ea7bb41e8496", "comment": "Malware payload (PureCrypter)", "value": "c2af7cff7678443b4a8aad601e8af7c9965bce20", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239369, "uuid": "f956de8b-721c-4e76-b7f7-e7096133e743", "comment": "Malware payload (PureCrypter)", "value": "76e55f70e08c390450baa7eb8f50a2bfa934002124d99431bf8eeee4badd34b69dc19e2629f5ff14616b882cda04731b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239369, "uuid": "50cd2187-5fb5-49fe-808b-f6e729fad7ca", "value": "T18894123CA051AF70C14AFCFA8FB7139119E1AF37295AB0DCA0A027659F82934D2F9075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239369, "uuid": "925ae9ad-8ade-4996-b6bf-c050af7f4e44", "value": "3072:jSO3hXUswB+yhvWp0KnRRd42KpIguhaEin0mNXSbN22WBeq:/5O+yV8TnB4pIsEc0mhSbI2Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239369, "uuid": "f84086f4-9214-4791-9c60-544fb05390ff", "value": 433630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239369, "uuid": "6bf99611-f6fb-4be3-a568-980a135c4366", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239369, "uuid": "4b7b1fe7-9b55-4946-9140-f564f96ce47f", "value": "Air waybill number 290132727 Physical weight 1 05 kg Seats 1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b80afa-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675239246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239246, "uuid": "02afcc4e-b7c0-4f09-bff6-93814ae57e47", "comment": "Malware payload (Amadey)", "value": "f9167334aa7188f57755ebe55a4e98a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239246, "uuid": "6031bd6e-7dd3-4ab9-9a32-b65431addbc2", "comment": "Malware payload (Amadey)", "value": "7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239246, "uuid": "76571a8d-e5e5-4d06-9286-960fea89c9bf", "comment": "Malware payload (Amadey)", "value": "d340ed530dd32829f614bd0d0850cc51f8e4ac4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239246, "uuid": "1b6132d3-0a24-42c8-8ff0-c8f915b8e80a", "comment": "Malware payload (Amadey)", "value": "2f9efe48b9af6f88bd3f429f3f116b82eaabc1b467db96ca236568c6885b883027f394f80d23d59ee3c58978b8817ecd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239246, "uuid": "7bdd5892-1f51-45bf-9cc8-bc47b1b1fdcc", "value": "T1F93409217D16C031C96061B729B9BFF2C19DA8259B7049DB7B800F7BDA122E67970E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239246, "uuid": "eab2f50a-15df-497a-8618-f1666e5b65d1", "value": "dd0e4efabc62274a7cfb37b4b7a2951d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239246, "uuid": "eccc410f-ae94-4669-8177-d9c365d1a158", "value": "6144:RSRg+A7AZGFDubDXagraG0JzSRuVyLWNgrQqgE:RPsEjgwJ4uVyCNKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239246, "uuid": "4cb64798-49d9-4708-9a69-77aa1343f805", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239246, "uuid": "3701a7e0-d13c-4f81-a172-0e013f49b3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239246, "uuid": "55038581-5539-4d63-8cc4-eab3a5467c50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a3f36b-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675266628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "6d1fab23-4a34-4487-a4d5-4f8683507077", "comment": "Malware payload (CoinMiner)", "value": "059541770a117b85bdc08ee5bfb52113", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "fab3aff6-eca6-4df6-aeb4-670df3a96c50", "comment": "Malware payload (CoinMiner)", "value": "7b52316f133938e5dc839b5ad6b2bf79bf42338734cac32c969c50a5fa9207bb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "5a635950-9756-475c-8782-e513728c0d6a", "comment": "Malware payload (CoinMiner)", "value": "772c845ec8a7ed09c4bc324f8e9dbed608e86c90", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266628, "uuid": "c4c23537-cb5c-423d-9bf6-be529cb062d2", "comment": "Malware payload (CoinMiner)", "value": "44ea6afa0281698e7b2af1491d82fd7ce8201512a8e4ce079d68279dd7d14f70ea796ec12df0c72578b47c09b9d69d5f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "d45b54bd-1516-421c-bc39-6866daa3fbc8", "value": "T16DF501336798CC6CC4292C34C39AADF79393AC74DEDC076B3391BE0A36729955966C06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "7e1c2f2c-70ab-46ad-8914-086c2fc860bd", "value": "7762d546395f7f025bc63e3f9058f75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "0bbbad6d-8b8a-41b9-8b37-2db7e7373076", "value": "98304:ezWGhYCYMhaZAB55d27f9lElH6Avb1va8jdUVt3K9p:eqtCYM+A1dA9lElaAvb1SQdUVxKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266628, "uuid": "685f2fb7-3b90-473b-81b7-66c98376b75b", "value": 3537696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266628, "uuid": "11d3cdc1-e647-4125-84be-b2321d023cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266628, "uuid": "b427841f-c453-4e4f-84ac-0331bd87b67f", "value": "059541770a117b85bdc08ee5bfb52113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e49d91-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292902, "uuid": "4fc32cbb-347b-4991-b3ff-f91aa95cd8c1", "comment": "Malware payload", "value": "4f6093ff2a252b2c7f338a780985cf60", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292902, "uuid": "92b2c9d7-065d-4ce5-9b3b-e33d05c0523f", "comment": "Malware payload", "value": "7ca7aa2b1a3e1d65a101c53dab91ead51c53596b4598f2404f0652cbb3d57863", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292902, "uuid": "a11eb500-5838-4772-94d6-fa392feb7b78", "comment": "Malware payload", "value": "bd36386a7cfbcd8fc86beffa5655c08e3e05905a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292902, "uuid": "e9a989ff-80ba-4afc-b3e2-ee8aa558afbb", "comment": "Malware payload", "value": "ce684f7e31bfece426b5c85fbb26e75acd02510b1bf8dacfae5d964ab4970041731407e04c1e12dcd906fb6cf4aa3bf1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292902, "uuid": "0e88cf8c-d952-4db9-b521-dece05e9cdb6", "value": "T18D363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292902, "uuid": "87223f53-eb5e-4075-953e-f18757cfa873", "value": "98304:Tv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX0:TvpvFa+g8RWLdPk/84tCEr0RtNiC5eSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292902, "uuid": "604f2790-a7f5-4736-bc4e-efd8761684ab", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292902, "uuid": "03f8e764-13cb-46ab-bccc-c25c094561b7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292902, "uuid": "b6060e62-9d99-451a-bcad-755ab73fad88", "value": "7ca7aa2b1a3e1d65a101c53dab91ead51c53596b4598f2404f0652cbb3d57863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87454f2-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261692, "uuid": "02cd3b39-8f04-4daa-b338-0e92c3699788", "comment": "Malware payload (SnakeKeylogger)", "value": "ba44caab199597c8785a9ef7fef6cf98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261692, "uuid": "908b1a6b-cab6-41f2-b3d6-3123425a7350", "comment": "Malware payload (SnakeKeylogger)", "value": "7d1c3591a7cbff524d0dcc03cfaed0fc1b7915e78b2a624747fc6dd4b3a765e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261692, "uuid": "2f486ade-504d-4d09-a3bb-145c74b50d12", "comment": "Malware payload (SnakeKeylogger)", "value": "b9abd5215bf89d17ae4dc6f320af5147f6ed3e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261692, "uuid": "4ae8472f-941a-48b7-80d3-aa28a5e93dde", "comment": "Malware payload (SnakeKeylogger)", "value": "fdc53bdc6cb3832107ae0a435f81d9841c0ff0dbd1c1efa7a7af03434c647fdbeda90f7094910842197b9aa75f907ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261692, "uuid": "8ca0af5d-238e-443e-9c35-35f68a2a598c", "value": "T160F4498137B15872F1DB05B91028768C1E3D7443A6E6E2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261692, "uuid": "90216064-ff0d-4640-854f-b338f9515e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261692, "uuid": "27148fa0-36f4-4865-8b6e-88f6269d9549", "value": "12288:meca5cPYJMD7FNjBoqJDk2mpDt9hHwVFWfatVBhnluRnr8z9i7+pvrc4N34F:mecayPYJi7FNjbDkDp7hQV8fuVHlgnr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261692, "uuid": "40c78bc5-ad80-4d03-91f0-923e44f0a6e9", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261692, "uuid": "fe06700d-d952-47a6-91d6-fec68ce03120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261692, "uuid": "97538074-3daa-4684-bdeb-ed3784843c20", "value": "ba44caab199597c8785a9ef7fef6cf98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c477b4-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257143, "uuid": "0cea4d68-e2c6-4ccf-9036-3994b90bd93f", "comment": "Malware payload", "value": "f3ef809f9235900c0b086e1d22891321", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257143, "uuid": "6ac9d453-ff48-4034-a8f3-0f6cb19dcc63", "comment": "Malware payload", "value": "7e27f1b12fe021a61fcbc5b349c75d49f0a41d6ea2556799d15948ce255c57fc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257143, "uuid": "fba2a563-4684-4342-8821-538acdb8bf93", "comment": "Malware payload", "value": "0251416274a1934d9461906e878858dec6be1a76", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257143, "uuid": "606eec9e-8ae2-4bbe-aa68-a17b7343ef68", "comment": "Malware payload", "value": "e383580961952356ba0af9932f4588592a31330921bc587b7ec2bd908f4270181740a75a90578cd7914a542058d51b43", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257143, "uuid": "e066a292-316a-4c0c-9848-b390d6be90e1", "value": "T1D732090BD7E0837BDC760B7E78AA72400334B356AB43D32A06E541596D9B3788B67F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257143, "uuid": "d97c6afc-59e0-4bbd-8f7e-442d0b86dba0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257143, "uuid": "a0851b01-8b5a-4814-9557-44e0669b8912", "value": "192:jKav8vl059O9z6b16UDauuuuuuUnGh4A7uf65I5BLZBGnn15sXQJ2NpQX:WapPcz6QruuuuuuUW4DC5I5BL7amQJ26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257143, "uuid": "591f6102-65f6-448e-937f-2fcd121313ee", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257143, "uuid": "faec5488-49b8-4ca9-991c-9c0c58b37d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257143, "uuid": "2705e3b8-6d42-49a0-8da9-c3bdbe6862ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551793bf-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292906, "uuid": "f736a4fe-09ac-4143-ba28-c80d189341ca", "comment": "Malware payload", "value": "ba636c94d47964d10299ff270e4e11a2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292906, "uuid": "2e82c4f7-cff7-420d-8155-69dfe2ab04a7", "comment": "Malware payload", "value": "7f046adc930c4337616808e607999b4069e41ee8a41e8da019f934ba58d1ec66", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292906, "uuid": "934de40d-1231-430e-bb59-71507fdbf8fb", "comment": "Malware payload", "value": "490591df8411d7e890779d05be00448521fa6cd0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292906, "uuid": "6eaf6197-67a4-4c35-9293-b9e1073ac118", "comment": "Malware payload", "value": "ae4de3a49cd53d21580e2bfba3cbbcf8361cea57317a078d735db5c36bbd66e5c0b3ae717c8757b0e47db803cc501628", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292906, "uuid": "1d557f1d-47c7-4e91-af5d-7f5948e6cbf8", "value": "T1AC363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292906, "uuid": "b27b6627-33f7-46c4-8851-da716db83e17", "value": "98304:8v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXd:8vpvFa+g8RWLdPk/84tCEr0RtNiC5eS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292906, "uuid": "c0469fcd-cd9f-4392-b3b5-d9f49fb4c76c", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292906, "uuid": "38c3d29e-9956-422e-b60a-3b4cbac0eee7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292906, "uuid": "5835fa66-22d1-4c13-8968-37ff9855910c", "value": "7f046adc930c4337616808e607999b4069e41ee8a41e8da019f934ba58d1ec66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f9d1c0-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238764, "uuid": "933c1ef1-bfca-42c8-8a46-884c9f9a88c8", "comment": "Malware payload (Gafgyt)", "value": "869ce6507ba31979d9707292f6cce575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238764, "uuid": "4963e647-acb7-434e-afba-4551080448ba", "comment": "Malware payload (Gafgyt)", "value": "7f2df7d0132d9679a359c69713a248b722d93d20d6538e553e0aa9daf6f8afd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238764, "uuid": "af0d1268-25f1-4298-9da5-db0112699a63", "comment": "Malware payload (Gafgyt)", "value": "66654d493b8db8fe72a85d06fd6ac7f3ee125a1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238764, "uuid": "0980ba90-2866-4025-a5ee-26f000fdf3d7", "comment": "Malware payload (Gafgyt)", "value": "7b2221e8da0f2c4ceac555c24c2b6fa3348069f83dc755c7316e330644b2cb21df5b89296d8e203a095e1fa70990835e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238764, "uuid": "1c0323c6-3148-46b6-b1ec-34269f237475", "value": "T17C831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238764, "uuid": "ff0a7a12-a515-4d92-a9b4-6321c1c74c9b", "value": "1536:BQOc40ozMPjej5qckA39ikRFaonrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BhrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238764, "uuid": "364856c7-b7cc-489b-a960-913b27ed2aec", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238764, "uuid": "322b8b99-1613-410b-adff-802feceb636d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238764, "uuid": "49630843-1c6e-41e2-81b7-8931e0a5ee54", "value": "869ce6507ba31979d9707292f6cce575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f25b9b4-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675264253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264253, "uuid": "1a6b9859-af4f-483a-8e9f-fd0413c600e4", "comment": "Malware payload (AgentTesla)", "value": "bf16c7a4eea17df000c3bdcb82eb7a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264253, "uuid": "216a5523-ff90-446d-8934-76e15ffa552c", "comment": "Malware payload (AgentTesla)", "value": "7fc0957ebbd39c15f25edb094b1e2d25ff356efcbb3f4a2bd4daf9dd8c63307c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264253, "uuid": "80ba2ad1-b0a8-4f48-96e6-097418bb5cb5", "comment": "Malware payload (AgentTesla)", "value": "b4bb41c2ba1e80cc8f12e70224e92680a50de365", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264253, "uuid": "3b4b1b41-d6b6-4990-a634-451e962d4e65", "comment": "Malware payload (AgentTesla)", "value": "d8c689a7b9778ed8b6bbff7552bfab5b7b80830d25d746d07c71c63a7dc1f063a81c775ebfa37d050ada969fe9a0a352", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264253, "uuid": "3b7d1414-5054-4685-a9e7-3b6c9a0ce7b8", "value": "T183254CC2B2B088A6F99B04F16C2D766016D27D4EB894810D577B7B5567B33A330DEE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264253, "uuid": "5e883e40-6313-4bff-9d97-036dca063034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264253, "uuid": "46d9d903-70ea-475e-ad47-c504d137b790", "value": "12288:Ztz8L6gu+xMRSR5S+mWMv1axFKzMDDQTU3x0hqG4yPa:kLzyRU5PjM7zMDDrcqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264253, "uuid": "7dc0a003-0a96-4554-bc7c-fe9c2c7a1590", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264253, "uuid": "2db5f941-177d-471b-8c4d-24355ba0e382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264253, "uuid": "c9c7e063-53e9-41b0-84de-82d44b06e491", "value": "12220173387_20221124_13363111_Hesap0zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea2fa3d-a1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675231611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231611, "uuid": "cf85e28a-aae3-4f0e-88b4-349adc91fa4f", "comment": "Malware payload", "value": "b77375da771fa71e670aaae2cf99954e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231611, "uuid": "a78fe627-a718-4e88-ac78-f7cbc14751c0", "comment": "Malware payload", "value": "80a3b3e641d7c7e5f8414295f07d3d61d350f762bacb091d0fc951dea9d9443b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231611, "uuid": "bbbc315a-460e-49f1-9235-b8ce6db09fc6", "comment": "Malware payload", "value": "f51c2aebf278c2ed92042e808cfe66581b40f334", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231611, "uuid": "640d8a72-f0ad-4623-84d0-adcc1dae5cbe", "comment": "Malware payload", "value": "dd1faa76f417e71bb0df2e23f74d1cc42abee36199b38a6319551cc8831de3827ec0eb123778d529fd527c6039b16c42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231611, "uuid": "8ec4ae08-be5e-4212-af5c-79a473fe458b", "value": "T11022B411ABF4833AD7FA2B360C735341463AFA49E822DB6F4448815D9C62754CAB2F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231611, "uuid": "6f77de23-b6c4-4014-b62c-85ffa94dd18a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231611, "uuid": "6984bec6-e0a6-4970-a314-e18905a7b7f9", "value": "192:SzomGqecws+qa+bjlx1XQ61qftV3LwuPaaU:Sz4qPws+qa+b9XQlbwwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231611, "uuid": "1abce390-8d9c-4b69-8607-96ee765c5901", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231611, "uuid": "fab298cd-0be0-4046-a68c-1e225895a074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231611, "uuid": "1aa688e0-31a4-4a6c-a225-760262c66b41", "value": "hiden.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8760f5e5-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675267220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267220, "uuid": "57b6b15e-3c31-4ee6-b954-d54f7a6cd462", "comment": "Malware payload (CoinMiner)", "value": "a7e4888f6fca45f3c4e22d7179f28687", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267220, "uuid": "f08e4e1f-72f1-4733-a001-ee99d2b0d288", "comment": "Malware payload (CoinMiner)", "value": "8132c345cfacf7ec1cd8f2c9ccb77f958eca46d63a2aea80c5d5725083d1b747", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267220, "uuid": "bc447de4-02c1-43a9-8998-c727d6745b25", "comment": "Malware payload (CoinMiner)", "value": "44dabe68627607a4ad446a05f06bd8f15f8b89b6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267220, "uuid": "39f4014a-efb9-4091-97a5-07386fe0bfbd", "comment": "Malware payload (CoinMiner)", "value": "169dc8265105cb4af4c5ccd28c81bda1d342396820ce011ee3b90c70cdc4975698202557c48fd7e21576a5ef7d1ff247", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267220, "uuid": "0c27e9a0-ee7b-43a9-9d99-e4ebbdfc3dda", "value": "T1E1D5BF2439FA601EB173EFAA8BE478DADA6FB6733B07645D1051038A4713981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267220, "uuid": "0e380767-9b14-4eb7-b17d-1b54ffe9620d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267220, "uuid": "9912c140-aec9-454f-b738-e563fa00c0a8", "value": "24576:a9VMGe4+PT1ZEo/spGfhztVo80bodNPUYqp1YHufSZsmgWkhW0bT5ZC+98DADveP:w9eHZEwsIyJECrpSuKDgW4S+93iQew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267220, "uuid": "2c44bb1b-bf75-484d-a3d3-794d18d1c369", "value": 2958336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267220, "uuid": "27e00922-f205-439d-b97e-201c716f55f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267220, "uuid": "017e4c86-966f-4738-b222-dd752392df94", "value": "a7e4888f6fca45f3c4e22d7179f28687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54adb439-a284-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292475, "uuid": "c1aef6c0-5f55-446e-8e77-155cd394515d", "comment": "Malware payload", "value": "2cd19bede0ae89ca23d2cc4fcd879b78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292475, "uuid": "a7087105-647b-4a24-98cd-d71e973dddd8", "comment": "Malware payload", "value": "814e17d7d81cfe14c630e794eb896ef062c9ea374190dff374bf13e1f816506a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292475, "uuid": "4213c3fa-1905-444a-be36-49fcc780fe5f", "comment": "Malware payload", "value": "2f9701b32427095e9b2533b6358e8bfd001e9110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292475, "uuid": "eb15e6dc-4eb5-40b8-917f-196ea9a47ede", "comment": "Malware payload", "value": "011a4e016809646d0b1065e3e047f0ca50abd966bdee3d29435209d3e89ed07e1cf5ee946144af37772dc4fb2161190e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292475, "uuid": "01a85e73-3823-4b8e-bf5f-1488274e07b7", "value": "T1AD74F133B580C032C46716716924D795BEBEB4311D3999EB7B940BADAF707C0A63638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292475, "uuid": "bb6343ce-dd3c-4e3d-ac62-a9f04639afe5", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292475, "uuid": "7383fb6a-4fbc-42fa-af14-86796f2730b1", "value": "6144:j3cCbLV38iyxoDTQYUa03G3dyqLpOpy8VEiF3+8PC9wFvdww2YcdJ:j3cwJsiyOIY63G3NpO07io0C9wVdw4QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292475, "uuid": "d979f8dc-6930-4ba6-b7fc-e19550d77b78", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292475, "uuid": "361eab36-ab01-4311-8097-66294fdbd436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292475, "uuid": "442b3f26-2679-4e11-a383-340df1de23c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3fa017-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1675262396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262396, "uuid": "9ea6984e-e51c-4fcc-b8c0-0ffafb2c5d29", "comment": "Malware payload (LummaStealer)", "value": "16685b20847f33924fb8d849229c41f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262396, "uuid": "53c28ca6-61d6-4bcd-976a-cbee88a5aafc", "comment": "Malware payload (LummaStealer)", "value": "81b16b8e152322da3b81e7703e430c77d3f06e53b0ba24a5a82e0c3e371c9a21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262396, "uuid": "e74f0e51-bb94-4fe5-aa77-12b01ce71e54", "comment": "Malware payload (LummaStealer)", "value": "c37f16cecc342c1f9361a759c1f232f069a8fba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262396, "uuid": "dfbf3dc2-0b24-4519-94d3-ab3a32c1dce5", "comment": "Malware payload (LummaStealer)", "value": "c451f60459ae20231fc631de8cf65caa6e82fdfb10ffd085650fd0701c49b51f1c74d0beae37cbb6e0f5826bac237e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262396, "uuid": "65598d4a-e96b-4862-bf33-c80e31bfc014", "value": "T1C5047B15B8D2C031E5731A3206F4D7706A7D7E301FA259EF6B605BAE9E306C19620F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262396, "uuid": "22b4ff6b-dc65-4466-bd95-db46b1419bb1", "value": "a15f46648d9363aa7d2886234670aa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262396, "uuid": "fb6fe382-dad8-491b-a991-8250027e01f4", "value": "3072:5BnBuDhmb9H7V1oVt3J1HsgujusEAqFlxM7bYyaAWxLYWG21N41AnLPW2A5kVXDO:fADwHqdskF28AWhYWX1NoAn51o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262396, "uuid": "2e7ea99e-09ac-482c-a2cb-7108df8a7842", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262396, "uuid": "ae12a8d7-f247-4969-9eda-353a27a9f684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262396, "uuid": "4c63b1c0-d943-4f5a-9687-d8884fe0e89a", "value": "16685b20847f33924fb8d849229c41f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b7d606-a21e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675248591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248591, "uuid": "fe30e6bb-e7da-496a-a401-3db2ea06de6e", "comment": "Malware payload", "value": "d88049e4c56ed532106cd5e6718f6e68", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248591, "uuid": "0e680aeb-50f6-4b91-96b3-618d5103a3fd", "comment": "Malware payload", "value": "8266463370836dddca0e9acfeeea2326ed7bf7c7560bcd4b434ed74b93ac078e", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248591, "uuid": "23529fda-76ce-465c-98ae-ed0d70a34c3c", "comment": "Malware payload", "value": "828b4880aa3206ea353267ad319b8feb8af15ded", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248591, "uuid": "923e75a5-901d-48fc-bce0-e3fe6b840917", "comment": "Malware payload", "value": "b50ff94ef30fe18cf0daed1d329a5a69cbb6e30764db3fa82ecd23fa6a43744ddf2e393c37c33a73be07e3d0f8ffeedb", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248591, "uuid": "4785727f-3fcd-4fff-94a3-f6fe63e1a1c8", "value": "T1DBC42303AC22E88E342105AE03EEF6E4A543E58B04582F974DFCDDFB5F7AB635588591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248591, "uuid": "4f44bca4-e521-4d71-9f02-62ec09c94a18", "value": "12288:PipCdRR6Srthne9n+Qvavvb3p77c+Bp8o9rIf/iZ4cE8aOgRXMLr0z3:q4P8Sr72n7a3rpX5Bp8o9rIfq+cE8aO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248591, "uuid": "8f8585d4-c528-42d5-b413-d3b230cd0fdd", "value": 583463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248591, "uuid": "38cf5818-9201-4e1a-bf0d-be1cfe50f9ba", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248591, "uuid": "d3bca451-7058-44a6-9963-c1cdaf1323dc", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa54bced-a255-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675272433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272433, "uuid": "1561e91d-c997-4dff-b3c4-3728b107edda", "comment": "Malware payload", "value": "e475784ad51bddfee0bb35cc28363c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272433, "uuid": "47e8f0ee-bca5-44a3-8b15-3351b839fc85", "comment": "Malware payload", "value": "8272658bdf1d631594666080991ab30aa7b7ad203da8a332035bcf083c36b2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272433, "uuid": "1afca236-a417-4836-bc94-da1b233d4e87", "comment": "Malware payload", "value": "6ace23c88a1d9d88e43f702c2ce312d8551b7000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272433, "uuid": "75ff3495-fa82-4f55-bde9-b15c233a5a45", "comment": "Malware payload", "value": "29b8c4220f5e9c86af3503d93393fc1491e3477ddd0531693b9837f5746342b19d18fd62359183a18ba552ded8095d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272433, "uuid": "0117865e-25ca-419a-bc25-860e9ddb5c5e", "value": "T14F7633D07DC1EA3AFAE04971DE3A0E12A8CEE6F09F050F0F77599B5D227C8169A45E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272433, "uuid": "12df4e12-8461-493c-b45b-de54416987ae", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272433, "uuid": "cb0b14d5-7d43-4ad8-9985-23e7da4483fe", "value": "196608:91O/MX3u729ihOzXNEB9Qz8/Mum4hP2DT1LGqn1PZL7SynqBw4c15:3OkXkGryB9Qw5L+BG6PsynhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272433, "uuid": "18e25215-d09f-4f6e-9167-f8aaac22a1a4", "value": 7613686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272433, "uuid": "abcd308c-7a2f-4b49-86a9-6111327a1fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272433, "uuid": "1c32ed51-6804-40ac-a892-63fe9e74046c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2539a0-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238724, "uuid": "d6e73c0b-d961-4aca-bd58-fd67101754e3", "comment": "Malware payload (Gafgyt)", "value": "ffdf6a175030229d6ad7abcd8a7303a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238724, "uuid": "c41a7ffe-7b40-4359-aef8-1f9b63434b94", "comment": "Malware payload (Gafgyt)", "value": "83397dd6e3b39cd57e770bac7d7fdd1d99195d3ff54cb63fe22b90aba1fe158d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238724, "uuid": "dd0698a9-3aa1-4c5e-931d-1d60e2f34ad4", "comment": "Malware payload (Gafgyt)", "value": "fdff2b7f5a4cad91146985c7fc9ff0486d15a9db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238724, "uuid": "3a8c3dc1-da43-43f5-86a8-953d055f1f3f", "comment": "Malware payload (Gafgyt)", "value": "7fafb8647a31c00fa9a01e5488175c5d359e6f456e4686aff8585188e160351962cc03ca5ea6cc4d7d765de98dee8320", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238724, "uuid": "92bc9833-89c6-46c1-8fab-45cbbc2e624f", "value": "T1D0930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238724, "uuid": "ac150299-6b4d-4b50-a80e-37cfd4ab71c6", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxNePczYrmREqQ4b/X7XSee:OQ2HYBv1WToePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238724, "uuid": "5248caa8-69c6-4242-80bb-fb6464504b15", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238724, "uuid": "5b911011-98ae-40a5-a809-4bdc970c8d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238724, "uuid": "59ae8b38-072b-4729-b12b-a35b978970fe", "value": "ffdf6a175030229d6ad7abcd8a7303a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db53c66f-a213-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675244168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244168, "uuid": "55574538-2555-4317-8b4c-2e29edea3ec6", "comment": "Malware payload (AgentTesla)", "value": "8d2180f18719e7d1dd059d4da5d21e13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244168, "uuid": "2747add6-a1ac-4eec-a2be-f60c099b73b1", "comment": "Malware payload (AgentTesla)", "value": "83bff0961aeb0ddc995cf636241d80c3ba41bf750255995319f661c4a82b794c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244168, "uuid": "24975217-f9fa-4aac-972e-3be531288738", "comment": "Malware payload (AgentTesla)", "value": "022aeaa198bda115d87483dd6d263a4230de5779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244168, "uuid": "2fcd1f5c-c717-41b4-a213-2d491ce60a4f", "comment": "Malware payload (AgentTesla)", "value": "90eb57d3cdb20fe41c82bce6efb7d1e804d8a0d3c49696982ee5be97e1275a9b5c7162a686ed537f119e52bef9d58bbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244168, "uuid": "bbe53eec-8fe5-400c-a81a-ac255a4f2c51", "value": "T137F4230073BC6255D6E847F15623825043B17A069A22E37E5CD9F2DB6C7F7D089A0F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244168, "uuid": "6d1a3cfb-0e5a-4945-84d5-25c24bd67d6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244168, "uuid": "4bf809e4-1d05-4516-968e-c6185fa60c6a", "value": "12288:GrKJMtEwcU3gZ+GQzjkATGds/QkjENtqGRGRXkbrRVUQnHC0t37EdViqBr:ws6AAgZbQzlGMlwNtqkGJMrRVPnii7E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675244168, "uuid": "dc2e761c-1e52-4ea8-9139-35f21d68f40f", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675244168, "uuid": "76e32874-9d2e-4b92-957c-f635717bd409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244168, "uuid": "489b0080-3bc6-458c-8267-1aeeb3b3e835", "value": "8d2180f18719e7d1dd059d4da5d21e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f931ce45-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1675261828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261828, "uuid": "c806571e-6763-4801-8656-78af067cf985", "comment": "Malware payload (Matiex)", "value": "a68893e5a83010fb5bb3e5f302f1d9e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261828, "uuid": "f1c59201-416e-4fcc-a791-1dbd2c73d8bd", "comment": "Malware payload (Matiex)", "value": "84713794adf24d58fb273365dad3cf164e859ec678447aeb261edb0a3c0a8e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261828, "uuid": "01672d87-d7b2-4aee-9756-ecfb5789f6a3", "comment": "Malware payload (Matiex)", "value": "aeeec1d07fa64030b7521841563d6a5076fa6f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261828, "uuid": "f05d5009-53e1-4dd8-b485-9f9e4ee32076", "comment": "Malware payload (Matiex)", "value": "203b610888e8eeac2177e4c23644f8674dc9e96e880a411659f9585dba867abe5701703e95a5d5e7fb44d8dcbcef0dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261828, "uuid": "f301f4d2-9463-48e6-87f0-0bc05c634164", "value": "T12BE4F192B3A840C8C06BD674CD605627EA72B8A457346BEF5660CE790F33BC5F83A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261828, "uuid": "f34fcc13-548e-46bc-b40c-cceae3c7d607", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261828, "uuid": "421c5617-1c6c-4afb-83f6-ffc2267449a9", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261828, "uuid": "b1f0e661-9a73-4e2e-baf9-89e818783c11", "value": 720916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261828, "uuid": "1a189d94-0297-43fd-a26e-3b9c8890dc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261828, "uuid": "9b96cd1c-f553-427e-a3a1-c6703e9599cb", "value": "a68893e5a83010fb5bb3e5f302f1d9e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaa9bb2-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675211740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211740, "uuid": "7b79ed0f-b15f-4faa-956b-5d4ab9a17bee", "comment": "Malware payload", "value": "789851764373e496c4d3d014852e5d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211740, "uuid": "0bfbfff4-41bf-4885-9567-df764da33359", "comment": "Malware payload", "value": "847e3e3c179c31428cc742d1389a56e84d6886a8ecedf785071613e3a0e7f31a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211740, "uuid": "ce925208-7f63-49a6-9485-263451c76a44", "comment": "Malware payload", "value": "f2663ce5d189ecec1bad4c605e509ddda3996073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211740, "uuid": "aac23a01-e0eb-4e44-bad6-3e01fb398707", "comment": "Malware payload", "value": "91a63fce1a3981900fe93f80a54397e5b0ad57b515cfff862ef48de845218fc9f8bcdc96aff63e0a634b2a55be4a548f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211740, "uuid": "a040e3b8-0167-406b-ac0f-f9d91e6ac78b", "value": "T1DA747C19F7C2C0F4D99608BD0DA6773BD93C46584311AAC3E3A42DA7D9713F2693628E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211740, "uuid": "3dc1a2c9-3e50-4657-a69b-6805a7850c9f", "value": "c494a1f3c9328d5cedfb51957f1e1e61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211740, "uuid": "6df41940-8375-41cc-afdf-56f7e6be1908", "value": "6144:tHbsDnLtoIjniqR9UJomO40rll4EzaVOyqW+a/VdHFei3iwXzFfnmicJZGX2yNaw:5sDLtoIjn37UJo5LlZhAhdHFd3iwXzFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211740, "uuid": "ca7a1210-6d00-4786-beb9-b9e08b7e5743", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211740, "uuid": "33b76f10-551f-4a5f-8c80-8a92650f9ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211740, "uuid": "dbb3f3e7-3ddc-43cc-862c-bcb2e39c61ed", "value": "SecuriteInfo.com.Variant.Zusy.404518.5024.11844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a5a094-a28a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675295245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295245, "uuid": "360d68c7-8e00-4dc3-a85a-d442f536d572", "comment": "Malware payload", "value": "ac0751f08a82ff358334d75dcb33dd93", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295245, "uuid": "84eca3b6-81a3-43e4-b5f3-dcac93888e09", "comment": "Malware payload", "value": "849b413d49b5bb957f65dbcb91afafae46797a557ddab0dc0c0f98710ce1fcd0", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295245, "uuid": "d3ad2be8-e981-4ba6-8535-5fbfcd63703a", "comment": "Malware payload", "value": "7a4dcdc102d4dd989ce542d25d71cd4a9ad25674", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675295245, "uuid": "0fd27585-55f5-4221-9b27-70c42c4b974e", "comment": "Malware payload", "value": "4660a6332ee02d53c26d8310314c9fcb87024f7db249c37187a86193bd6fed1fc07fad26e8d4ee6def1ee6a25d5bb7ac", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295245, "uuid": "645e3af6-f728-4c51-8312-3d3bb0642bb5", "value": "T192E44F2DAE4CFEECE20158376A3BD9585F805CC8F931ACA5C1EDDC52F02476C6D5298A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295245, "uuid": "df679882-fb70-4ac1-ac2e-6ba8edccf2ae", "value": "6144:45GqjX7v1KwwLUfCjUIZtHXiWBF5b+AOsWu2fNYWxBlogvFZT0cp1veAEZKpDyX3:49T7AwwgKlvHX3eD0CCrZ6QGoyDgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675295245, "uuid": "77efb34d-3300-4162-b0ab-047507d13064", "value": 704296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675295245, "uuid": "1a0839e0-f55b-4471-912c-9ed0ab676c27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675295245, "uuid": "98b87ab0-f32c-459a-855c-ff4093f74e3d", "value": "Nr-301022023.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84959ec-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261826, "uuid": "b105129d-6a7a-46ef-b5ca-d8327e47d8bc", "comment": "Malware payload (SnakeKeylogger)", "value": "c035e1bc5f37c474441db456d903eea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261826, "uuid": "fa14d51c-e2e8-4da0-ad05-e79024b8ece7", "comment": "Malware payload (SnakeKeylogger)", "value": "84e348e49442b996738cb0d3d4fcd275e3db781fe805045e139736d9eeeca695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261826, "uuid": "d5341d08-abc2-4893-8457-93f4de04f27b", "comment": "Malware payload (SnakeKeylogger)", "value": "bc6992a6e31b6d67b6732c142ec47bebde49fee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261826, "uuid": "74c6ab32-4c74-4db8-9391-3cdfa456a5ca", "comment": "Malware payload (SnakeKeylogger)", "value": "25130883b08eb7da2989aa117bb8be9726e240d12380c2334606f6f290638189e226a8a95bef7e0f117285ab377d8e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261826, "uuid": "520df24b-f8bf-4147-afb8-7959a2f8315a", "value": "T1FAE1E915A39C4337EAA34B379CF36392023CE7518D13CBAE4C90824E9C4A7D98561BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261826, "uuid": "74be5494-26a4-41d8-a815-48c5d69016b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261826, "uuid": "f1948d4e-4ce0-4119-9750-37b3f3aa0a71", "value": "96:iUBTdcgDszgY1KsXrXhRQYYB3Tt4BtEkdexegbFnU:iUBhUdRQYYFGzAkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261826, "uuid": "c7193e05-a88b-49cd-a01a-7c1fe8c77080", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261826, "uuid": "02e79304-5748-4a02-b238-129456b38dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261826, "uuid": "e62924af-87a1-4be7-aee9-506902bdd736", "value": "Zasneipp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cd2d37-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675256108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256108, "uuid": "06a06fa2-7e0b-4660-9e4d-e8a538dbcc5e", "comment": "Malware payload (Loki)", "value": "a62b834fd42367f384b1a6a7250a3e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256108, "uuid": "9b15efcd-7e06-4764-95bf-3d606f6769cd", "comment": "Malware payload (Loki)", "value": "8609e1d5c447b9a77c1e151786125c55fd229f7bc7cd492e8b9bb766cda5d8f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256108, "uuid": "4d67eab9-3d32-418b-97c1-ce92d23d7e36", "comment": "Malware payload (Loki)", "value": "0e94fe518c1aaefda7b451640e83dacb850acf24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256108, "uuid": "957fe0d5-a5f7-4fed-b864-e1a633567820", "comment": "Malware payload (Loki)", "value": "0cdc2aaa560c36c5eaaebf07debb6d6f50cd992712d4d78f1a456a436f86d719fba8c4eb559e146a385d0c5cd8cf99d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256108, "uuid": "6d4fc413-0a3b-4fdd-9092-64fa35ce6bce", "value": "T1B00402207FB4C4A3D6A342301D329B622FFAA8247475872BA3509F597D77662DE1E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256108, "uuid": "7a7a24e3-0ff4-447f-bfe5-db7327b39118", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256108, "uuid": "6197f81a-617e-49ec-a62b-590226df12ca", "value": "3072:HfY/TU9fE9PEtuIbp9SrK0uwo9zVjotEIg02SdJPW0Ib1OeaLvIqR3IaoLhmOW5d:/Ya6Mp9DLDzVjJn02SLWbp4LI4MhmTDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256108, "uuid": "890c5089-aacc-4abe-94c4-2db5ee235610", "value": 187854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256108, "uuid": "71fe1f39-6318-42c4-99c8-a779c6004cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256108, "uuid": "5c27ecaa-53ac-4bbf-b8c7-6e26857f5359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6e1f34-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239717, "uuid": "4d511c4b-187c-4b3e-9c40-e3fe19a82fcc", "comment": "Malware payload (AgentTesla)", "value": "3b902c4dfaf76a570e2cfe22d3af6b41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239717, "uuid": "b63ad49b-8bf0-447a-bdba-4c25dc72394d", "comment": "Malware payload (AgentTesla)", "value": "86473f0121fef6e6ae4eaec27c7876ee61c341d42d95a7ff0572ca755bdfe904", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239717, "uuid": "63c143b1-c8ca-481c-9af7-3a39f1f2fa7a", "comment": "Malware payload (AgentTesla)", "value": "1597a85c4adbedc56edf24856ac557d61728a4c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239717, "uuid": "4a21eed7-9a0c-4904-ae09-5e73a67f2174", "comment": "Malware payload (AgentTesla)", "value": "8df19d95a4d76309c4d558674c18dd3909b42eab02917d1d9138fb8d0da96a3597ce797cd836014ae357a64eaa569114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239717, "uuid": "fc6c958d-c0ae-456d-b007-e10d9d62b04e", "value": "T149054A8137F15472F1DB05B9102877882E3D7443A6E6E2665BBB39C49703AB7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239717, "uuid": "c1173c7b-a263-41fc-9bbd-425fc2142263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239717, "uuid": "7e1244ad-2d9c-4696-8c7a-98c8ac7e7807", "value": "24576:ae1ahMcqOMSwWPAivDKZQRuEqNDAr8zw6Rhc4N34Lf:aVi1OMSBvXRuBNEr8zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239717, "uuid": "0bc6bccb-5de8-4589-87e0-9f4f5df473e9", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239717, "uuid": "2c4b154c-92b8-4ef8-83d5-ef8fda47aff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239717, "uuid": "7e540804-0b49-4c57-a797-9f9fe62e55c3", "value": "PI no. SO-invoiceP342542 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427178b8-a27b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675288579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288579, "uuid": "1d3fff17-fcb7-466c-92db-537a98b9cd73", "comment": "Malware payload", "value": "f6df6ab495cdabaa6015e73429ba1c9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288579, "uuid": "618cbdd6-ec98-4e77-a7fa-1d27b1149fe0", "comment": "Malware payload", "value": "866940bb59a32647c96466349066246b172adb7a5010678241be3e9663b1d637", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288579, "uuid": "e55d99d5-a5f4-4609-a729-4ae434883760", "comment": "Malware payload", "value": "252125d718e9a38fcfb6bed08623a2e04aff95de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288579, "uuid": "dc055bda-4d46-418d-9f92-0a82c4fa3854", "comment": "Malware payload", "value": "326ab56fe4f2e34a0d222f14c909ca5d8d2470c683538b82e043c2ce82057cf4e45d95201757853295f588ae2f0170b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288579, "uuid": "3b12f26e-0d15-4d4f-ac30-087e317468f4", "value": "T16DD53B03B7E2DE91D354773BE48B3D1107528A15A7D3F30F3ABA632158133A16A999CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288579, "uuid": "b9acc7dc-c351-4bde-8dfb-ad278582c676", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288579, "uuid": "82daea54-977a-4db2-9838-92202073c3ac", "value": "49152:CtZYtc76GfGeYW7QOWPnO6g402E2ItTbLz:CtZYC7zInOuEpdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675288579, "uuid": "935c1d99-b8e2-42b9-8f39-d3430c3b08dd", "value": 2748928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675288579, "uuid": "d330cd05-568f-407d-955f-30b6527f743a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288579, "uuid": "3cd7507a-6104-4e51-a221-f86ffdc3cfd9", "value": "stage10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba8dbd8-a1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1675229619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229619, "uuid": "2f7a74b6-7bae-42c3-a2a3-09a95cce0c5b", "comment": "Malware payload (Adware.Generic)", "value": "4b4c98ac8f04680f7c529956cfe8519b", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229619, "uuid": "ee23935e-220e-4cc8-809a-2f7973d18582", "comment": "Malware payload (Adware.Generic)", "value": "86f0a102ed4a4f82f843484cc045df5bea53118d25496086a68a7f791a3ab27b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229619, "uuid": "672dea8e-7e63-4ac8-bf2c-a3292dc3aa49", "comment": "Malware payload (Adware.Generic)", "value": "e6dccf4b1fc5ab116b6bc1321346b35dbf42f387", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229619, "uuid": "05ed6ac2-ef70-4268-8421-c08d004e747e", "comment": "Malware payload (Adware.Generic)", "value": "e5f8c8549304dcd2233aeb5b5294c1650b7275cd06d71dce5a86eef01dbb473eaea0ff397eb3e4617c3a69684f661fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229619, "uuid": "b34ec773-10d6-4fc9-82b2-24bacecc305e", "value": "T1B80402AB37A4E4A7FDB243300EF98B27CFB29968105D97834754195A3D16252AB0F7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229619, "uuid": "b3df083b-e21e-4ae7-be10-5cb6c69df945", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229619, "uuid": "1359ce6b-3fca-4be2-aec9-4bb92aa22073", "value": "3072:DYjClDhQlDvrcnVbOZh8gjVCMDSgpFnS+bKECYt+ei/Bx+GCokRwmpwegaZzTsfn:DDOYwhdlFbfEeOBx+GGwelWfCEoKMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675229619, "uuid": "24092099-4626-431b-9b3d-0040f95ef41e", "value": 178330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675229619, "uuid": "495f83c9-26b1-45da-a7fc-412a7011c83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229619, "uuid": "22aaafed-2076-4844-b365-0196c5ad0d08", "value": "86f0a102ed4a4f82f843484cc045df5bea53118d25496086a68a7f791a3ab27b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11364117-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675262297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262297, "uuid": "732b56ef-a335-4add-9783-a07c3b52dfa7", "comment": "Malware payload (Vidar)", "value": "a1c8731309c7aafb9f47f50cf4288f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262297, "uuid": "2fcb6ce7-ccbf-4a73-9f48-bc0319eac802", "comment": "Malware payload (Vidar)", "value": "870dc8112892c35a362f0fcbd5e4bfc3a85b8a818e27a8e1b1d411d71f48a16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262297, "uuid": "2b8ae4f1-8f05-4573-9e4d-e9c64706af03", "comment": "Malware payload (Vidar)", "value": "8d2d3baba8d735875f29d5ef64daa82d8b45fac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262297, "uuid": "83f9ef2c-5d8f-4d42-b600-95a27f3306c6", "comment": "Malware payload (Vidar)", "value": "d35994f8c2b15bcb4a5837b23c92d94332f929bb10feb5b4a88d9c0d76c3dc48fb31d392d4283486ed93b3d4f2e7bbfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262297, "uuid": "ae855d4a-263c-47a9-9515-58c70190eaeb", "value": "T1A194B0C262B27C21E9168B319E1EC6F8755EF5524E187366221B9BDF1DB02E1CDA3703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262297, "uuid": "7072b295-30d6-4c42-b284-943380299348", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262297, "uuid": "d5aac6d1-e3da-4773-94f8-9cedc9783a40", "value": "6144:ad4wLlnVCAtGvOM+LvL0eGJjTlGm6/JlFutixmldmqMoI58Mu:uHBV7GGHUeGJ3kFWwqMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262297, "uuid": "b46fa054-e5ce-4fae-a69a-d6b99e5bdf44", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262297, "uuid": "f25a9d4a-8802-4083-8c1c-9fc74fd29029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262297, "uuid": "cb85dc6e-87fd-4020-b451-de760a1ce792", "value": "a1c8731309c7aafb9f47f50cf4288f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591597ac-a24c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675268431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268431, "uuid": "76a8d987-da39-4a27-9f24-f8992e261047", "comment": "Malware payload (Loki)", "value": "41ce5abc5e9571290d551fc1782f5e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268431, "uuid": "d179264f-287c-477c-8064-09a21e61155e", "comment": "Malware payload (Loki)", "value": "871acce977914861a1950cba15794da45a72695d77c4e5b2566daae8b5ac6b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268431, "uuid": "86a0295f-d9c2-4206-889b-73cacc59ef45", "comment": "Malware payload (Loki)", "value": "04aab81fa54ba42e579463d6745122d4a9ee49c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268431, "uuid": "3f957ee1-4e50-4268-a3ab-2076d5ee5802", "comment": "Malware payload (Loki)", "value": "dd3002d20f776236a54cc0ac9e74924c0ad5f472a245d562bcab9be256a44690a38c85f2dcd381dfdee8def14f309abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268431, "uuid": "ccb00767-62b5-4dfd-bac6-aed1685e32c1", "value": "T1BAD4BEE11638BB0BF06F0BBD907040529BF094DBC9A9DBE8FF7241E66F252972151687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268431, "uuid": "6e664b26-b7ed-4cf7-bc29-548b73cff2f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268431, "uuid": "4a951202-e614-4dea-b3d2-d49735aa8149", "value": "12288:u29PU9aPU9y07amHSIvOsBgo0q4wMczal6NBeTsNC8/i9YuJBp9sbX82UfMoTTWj:u2ZIvOsBgo0q4wMHl9szuB+baxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268431, "uuid": "efcb113f-01b7-4c93-9237-e87b7878ed46", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268431, "uuid": "a8cb8bfb-d43e-4cc9-9c8c-b7dc2d93008e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268431, "uuid": "0a525a39-5d5b-4e86-8973-d8ca9e06d577", "value": "HEUR-Trojan-PSW.MSIL.Agensla.gen-871acce97791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2484ac7f-a22e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675255458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255458, "uuid": "56f405a4-7933-4cda-a030-fa00da0ee8f8", "comment": "Malware payload", "value": "0cc5612e909e1df2c53ae56ad258bb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255458, "uuid": "d660e7c3-4f52-4075-bd92-7a1624a8b972", "comment": "Malware payload", "value": "87c79d29737dca30e36aac1c90ac3eab82f71393b815a9d7c086565e257fd434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255458, "uuid": "e82e3979-6866-4361-ad29-bc3f8c64ea46", "comment": "Malware payload", "value": "f134a96132867224b2e0a0a06a6e21714de859d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255458, "uuid": "c5abf7d7-cff1-4ba6-8373-598f18fd32ba", "comment": "Malware payload", "value": "7ddefaab5b9db88204487284476eee4b8a7dbed22aa056806ce1c6156f3f3e9148dc2daa53abc46b023fc0c1f13e13a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255458, "uuid": "49aa4e53-1bdb-486b-ae26-15dd6dab94fa", "value": "T11775BF3FB268A53EC4AF0B3245B39350597BBB65A81A8C1F07F0090DDF665701E3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255458, "uuid": "615ffa5c-5f7b-4b53-9c2a-9908072bf5db", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255458, "uuid": "35ebb3a7-dba6-4159-b6bd-b912a8e14902", "value": "24576:14nXubIQGyxbPV0db26yZm6lubtQo+8YzqNAh3XBQ0FPcQsY8Nl85Xab6s5vT:1qe3f6h6lut9+QAPcTYy2W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675255458, "uuid": "6a7fd55f-f86a-4621-925a-09eb3420f17a", "value": 1668264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675255458, "uuid": "de65a328-7b2d-499a-b577-8abd8cdb8645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255458, "uuid": "2563295d-80be-464a-a3b8-b01653001b81", "value": "Your File Is Ready To Download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc43847b-a212-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675243687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243687, "uuid": "46eb5c74-c340-4f08-9da5-bbf04a1cabd0", "comment": "Malware payload (AgentTesla)", "value": "2d9978e3904a9c5613f3863a3c210a9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243687, "uuid": "79e1ce7c-a156-4b4a-9de7-81cded4657f6", "comment": "Malware payload (AgentTesla)", "value": "87ca3582edac50a44437f9d050df3d61fdf541599ab1d37c6fb9e9984dd1e417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243687, "uuid": "2ff2e43b-2b64-4c24-8e43-fccf58b2a359", "comment": "Malware payload (AgentTesla)", "value": "c30cf32461d2b06f4a5fe4059e440aaded3de643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243687, "uuid": "7bbe9c17-227d-4b35-a806-1b9642eed4b7", "comment": "Malware payload (AgentTesla)", "value": "97de8d5ad1e55c8dd5a0825657d6bfd8e9bcf6c45578fb3b8205f358620f5059c97deb6a69a7075920cc12096780d9fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243687, "uuid": "4544a99a-ba56-414a-bdea-548f669f6757", "value": "T1E3055B8137F15862F1DB05B91028768C2E3D740366E6E2665BBB39C497436F7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243687, "uuid": "e14a36db-66f7-46b8-a66c-c5b0ca385806", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243687, "uuid": "0979fa25-31e9-45ac-b58b-87f9482705ed", "value": "24576:XeIagddY8iT0WMrUwBosVHREbJ76Jr8zw6R7c4N34:X+6dYzYWflsVH69Mr8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243687, "uuid": "762e9a27-763b-4505-bb0d-60ea6bac8b75", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243687, "uuid": "177ff282-dc57-4a6e-a45b-2a986ccbb6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243687, "uuid": "eac29c08-7deb-4bcd-93cd-7e2ddc4c995c", "value": "Material Request-MR_2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57aab3e3-a228-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675252967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252967, "uuid": "676f9b71-78b9-4aa4-af88-e44d82802d65", "comment": "Malware payload (VectorStealer)", "value": "4099fa98b2eaca5bd5835d3e0f9d900b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252967, "uuid": "4bd8d12e-e613-4127-b1cb-c13c821caf84", "comment": "Malware payload (VectorStealer)", "value": "87dd5c2be1b1701d69a0ed8d49bafaf76b70d9977a5bb5bbb848f00d5e33e71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252967, "uuid": "cd4d7848-3a93-4885-a707-0df8e0e77d0b", "comment": "Malware payload (VectorStealer)", "value": "65c0506dba6b8af19d1cda319f8b8eba7cef34c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252967, "uuid": "0abe8ce0-6ad8-4d8e-bca9-cdf463273dfe", "comment": "Malware payload (VectorStealer)", "value": "78fb54303a3b655200fe425d247db598cfef3c988e5a2993583e3d2a662f8f770152c832baf64f1ed6f984bca5adcf9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252967, "uuid": "e2e86be1-2f0c-43cc-b55e-3df95d3fc785", "value": "T1DD9519DE02F4008BD16886B4A988EFD19560DCB5BB41CD55BD81FECF6D323E610A2DE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252967, "uuid": "f4308f69-d9f9-4fe7-8ab9-69abc60f5b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252967, "uuid": "44b22f40-7623-416b-be40-465df8f84ad9", "value": "49152:ecnHZwVb0BF4dX4/bSH1gW6H655TSgD/gF:ecH4IFWX4/wgWRjng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252967, "uuid": "4333322f-9bf9-4a53-9f21-c7ee4a0cedb4", "value": 1918976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252967, "uuid": "2bd5e447-e7c9-4e41-b28e-4cf10d699540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252967, "uuid": "1c9c198d-2986-4c07-8834-252a5310e11e", "value": "Booking-order-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5892ec10-a234-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675258122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258122, "uuid": "89a96312-89fc-475f-a08e-21f44dc3a528", "comment": "Malware payload (PrivateLoader)", "value": "055fc87832ccb0e40d13eb6cf0b67136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258122, "uuid": "93828074-d205-4d19-96d2-e857e0d34940", "comment": "Malware payload (PrivateLoader)", "value": "880716d3e1fe4e69e32f45fbd59b7de7e9d0df1f6912e5f7b39bb4907ede3874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258122, "uuid": "314db0c8-3fb0-41db-a644-23f10874f848", "comment": "Malware payload (PrivateLoader)", "value": "b6751740b05eab608aad776eea2e8a3f35871c71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258122, "uuid": "b0c47832-6bb1-4b91-a7b4-da706bc21e1b", "comment": "Malware payload (PrivateLoader)", "value": "4cd99669d46ff273e4f49607bb8ce6d01096e8276248ccc26e375c97ecdb55743409e35e20d3e2b754046a667dac741f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258122, "uuid": "54ed66b7-8029-4cd4-a72e-e56e6cdff824", "value": "T1CC1623379A951166C0D9C837C427BD9371F2067E4A83AC7851DAFDC626335E0FE026AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258122, "uuid": "0c3f7d72-f862-4eeb-bde3-b3eda447d104", "value": "3084ce279de8f767d7f3adb11fae9540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258122, "uuid": "218f7d77-d589-4abb-bc60-42fbdde1f598", "value": "98304:t2mXqUjEBZCW7038QcdfQZcht/c5ilvTilNZwB5E:t2mXpwZT7bdfQZSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675258122, "uuid": "cb2c7f88-3c8c-4c76-a09f-7730f807401a", "value": 4040704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675258122, "uuid": "2307d38c-6d7c-4aad-a205-e48b03b44835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258122, "uuid": "7dd8932d-3471-4544-b33e-c1606e17e005", "value": "055fc87832ccb0e40d13eb6cf0b67136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f4cea1-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675278886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278886, "uuid": "92d23527-f7c6-40b7-91b7-4bb4d8f245b9", "comment": "Malware payload (Amadey)", "value": "8db963d0665bb5c26fb5d2ab604cb400", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278886, "uuid": "3507634f-3978-4fc8-8b49-ebac887d554b", "comment": "Malware payload (Amadey)", "value": "890419fd4f82f0315466cf198906337d03e85dc989422b423bb789bb9424ec37", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278886, "uuid": "e29b3398-b6a1-4fb1-9ebe-0991aff9dc10", "comment": "Malware payload (Amadey)", "value": "38fe86cdaa4e95e208d5df122f9d0ab63abef54a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278886, "uuid": "fe13ea96-74b9-4254-865e-8cca7eff5cd7", "comment": "Malware payload (Amadey)", "value": "ede94821e61eee3444b1a5a31038738006d80e6f316c8df6a8d6bc711f2ed647245d635b1ebd9f2a5fd113b154b810e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278886, "uuid": "2b49ed8b-07dc-4064-aa05-1b940b95525a", "value": "T171658DA170D2C03FD426143505B8D920392DAB23DBB5D7B7A7974FBC5A3C1C19E30AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278886, "uuid": "e857235c-42f1-41eb-923c-14bc13f46911", "value": "1e1fcb89a726a5bdb6c6a80375477ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278886, "uuid": "3c16bcc2-b6fb-4c9d-bd2f-3e6c7ae17b93", "value": "12288:Uxp2vD+GO0912lY9/unw3i0UUNqIQrMQf:U+5Os7Junn0UUNj8Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278886, "uuid": "4f7383e3-b048-446a-8005-b2b7e4ede74b", "value": 1429520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278886, "uuid": "2efae3d1-b6ae-43f2-8496-9a6e3dfcefbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278886, "uuid": "095f941b-a82c-4727-b324-f5634a751b81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1a2812-a273-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675285351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285351, "uuid": "5f4f16fa-c420-43c0-9f2e-8d6d92182b82", "comment": "Malware payload", "value": "34d138ad3eb5046bcaf5785c3611f24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285351, "uuid": "ea1c5402-adaf-43f9-90f8-cee0f8053509", "comment": "Malware payload", "value": "8936e62371ab6a0a2dd2a125134cfe2e3679c98774f4afd430944d9cb5e92f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285351, "uuid": "42ad94b6-ace4-4e3e-8802-22dc1632b534", "comment": "Malware payload", "value": "2ea9e10fd5ff18e0a819ff5b55b102b7a00c8c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285351, "uuid": "677f109c-7994-40da-a2ef-ce9b9221e9ca", "comment": "Malware payload", "value": "ca75fd5b0104a82babd765dc52d433d2ddfd00d2942ca9f638c765d4b59b7fc3bcd737bbad1766eb144e530ba29b35a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285351, "uuid": "875e8a2d-12d1-4f22-a1b3-c6a45223b86a", "value": "T13674F13274C0D072C4A720309974EA96BFEEB5305575996B7BA427AE8F307D12B3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285351, "uuid": "93e5f905-0adf-46a6-96c1-bd7640066222", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285351, "uuid": "3d75299d-bcd3-484b-b746-12378fc394ea", "value": "6144:RPET4OLa32q1xPly2/QehwyT3WZ/+duFQSP5DWcRXz6t:RPEbG32qP99yMWkeVjNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675285351, "uuid": "d2004050-78c2-4552-97cf-98ae62d01c69", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675285351, "uuid": "34898953-52b2-43b2-87cd-9f07a275967f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285351, "uuid": "bd566428-3904-4faf-964c-f3b0698f77cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c5b9d6-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675255970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255970, "uuid": "e6acc457-c491-474f-a1ae-03b6e73166b9", "comment": "Malware payload (DarkCloud)", "value": "a3604bd65f5c838f4ad5e07720baebad", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255970, "uuid": "a2210ca1-d61a-4512-961b-e9c591c1cfe2", "comment": "Malware payload (DarkCloud)", "value": "89893824aeb1a646e9a6eaa776a21550d6b0724ff5448b9a6aeafc63888a3728", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255970, "uuid": "bd0519af-fa5e-43bd-a9f7-987d7e688c05", "comment": "Malware payload (DarkCloud)", "value": "ecbcad6c32a6ce003aacec655449e293da2d4630", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255970, "uuid": "ad130f00-f36f-44d4-82e6-a5f4086449a4", "comment": "Malware payload (DarkCloud)", "value": "e3fed03a6c6fea281238a5e4793cf881924e7c8c7fcb2b8a16b569b007fdca7327f5193c2675d68b914ed89eb8eef585", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255970, "uuid": "473cb81b-3e6d-4ef8-92ad-110b85062ba8", "value": "T12735CFD1069DC6E5E8F60E380728391467999C97837DA17EBEC714BF84F674B40B83A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255970, "uuid": "b57b5875-379e-4a80-9833-7f94d8f23754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255970, "uuid": "d048362e-65b9-49eb-b2f6-53fd91737192", "value": "24576:VjL6P/gRMaCxfebpa23paOLsoJi/rVevpD6b3ewHdqoSPD:VjL6AWx4paSFLsoJIrVegb/+PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675255970, "uuid": "ae7ccc34-4cf4-4e3b-a8de-a777ad10eb5d", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675255970, "uuid": "6db8555d-aa14-4767-b3ec-d93c76dc463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255970, "uuid": "0e6e94dd-f8ce-4fc6-92be-13d8120b25e3", "value": "TAIWAN YIBAI - PO# RSPO2212-0107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5fdada-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675267225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267225, "uuid": "f45a7d79-7cf3-4bdc-b07f-0a57108b7459", "comment": "Malware payload (RedLineStealer)", "value": "27b32ef4ae6a1eff38960240802f9033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267225, "uuid": "e05b1073-4473-4160-add1-f4e484a2f8af", "comment": "Malware payload (RedLineStealer)", "value": "89974c7e54e50a51c8264b0d9df2651a762836ff394a33ff5ab6c9e59aa515d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267225, "uuid": "72be6800-b2f1-4ada-8cfe-4134a6d80b37", "comment": "Malware payload (RedLineStealer)", "value": "10c851b99a7186876ce8ec47224df1983ceae6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267225, "uuid": "38f9b12a-2c92-409f-aff8-93933f54bcb3", "comment": "Malware payload (RedLineStealer)", "value": "322a09cce6953db3938b186f254ec9da6969d84a56288475269fa2b82f2cd3b694f7f05ef80f1eb58f7e8287884bc567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267225, "uuid": "0f677e43-c07b-41c0-bfa3-366e8da87264", "value": "T1E824F135B9A1E072C11B58742968D291AE3FB9325936E90B7B890BFC4F717C1532E34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267225, "uuid": "f1ff5dd3-9588-4264-9365-65ac850b440e", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267225, "uuid": "67a20cce-316d-4a90-b230-d05d2533a663", "value": "6144:LgL5QULgAGY0ofmxs8ZQ/rfpuAPnOE1TW:LgNQULRGY0+lOSTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267225, "uuid": "4ea9042c-7d0d-43ce-bfea-ca5a9f12a985", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267225, "uuid": "0e07c5f4-02dc-4cc5-aeec-00a7f0d69925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267225, "uuid": "77e4f218-977f-4359-92da-d3e84b2b89d7", "value": "27b32ef4ae6a1eff38960240802f9033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593ce584-a20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1675241802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241802, "uuid": "ca8faa10-2a90-4d34-9872-0c8068572ca8", "comment": "Malware payload (ModiLoader)", "value": "afde364aee4a09ee066be56ac65d7c97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241802, "uuid": "27d2ab5c-4842-43bb-8e93-de0561b3bedd", "comment": "Malware payload (ModiLoader)", "value": "89a0b619faac303d57d409fd7849b98b9239e4c16f49d4a0f9eb43a7df93cabf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241802, "uuid": "66c1d131-5b23-4a6f-b47a-9a0c26edf781", "comment": "Malware payload (ModiLoader)", "value": "1572338e17c4afc4c938c7e8b23221eb22034350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241802, "uuid": "40784fea-2a2b-4742-984a-e2c71b1f3617", "comment": "Malware payload (ModiLoader)", "value": "d351709d75fd0c17ba1a3fe128773ef205e9546d652c3212b45bed87405f23d69af48957c2245be9b90a0052d3f0bbf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241802, "uuid": "d4ff8ab3-9879-4369-a92a-b7da046b9620", "value": "T1ED159E27B6E044B3F1672E359C6B97959D29BE006D38A582ABF43C4C8F37741B8252D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241802, "uuid": "a0dd91cd-61db-42d4-a67d-bc4dd9547790", "value": "fab723900b8ba2b2a2705c88827e03ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241802, "uuid": "6e910929-d156-4294-8e37-6d30b668c13e", "value": "12288:BENV/fB+g9GgglTA/CsFA4Mv5Eko1M+c/ibBdxQ7zPZ+mLJtzR:Bo79CGPmtqc/i7IBnzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675241802, "uuid": "8d1c1fd7-b263-40a0-9065-14b7499c156b", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675241802, "uuid": "ae8b91f5-b4fd-4c52-b8f3-efbf5395da44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241802, "uuid": "d2ce0cca-8b89-4f4b-a5f8-06590e9965ca", "value": "FAKTURA D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5903eac7-a258-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675273585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273585, "uuid": "7088974d-25f0-417e-a750-b86c73f69e51", "comment": "Malware payload (GCleaner)", "value": "54e44588278ce8e1a5eb21d60b9a81e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273585, "uuid": "1d01d277-7212-4d5c-9649-c5c04232e96f", "comment": "Malware payload (GCleaner)", "value": "89aa14244c148b300d38dad2f96bb3014e1f838cef02fd697d219c9553d39b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273585, "uuid": "b81ef7e3-2fd0-432b-8c12-891e52e2a1e2", "comment": "Malware payload (GCleaner)", "value": "c94a49ef0645723c86099ac177a7683102db0597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273585, "uuid": "0507feeb-d894-4876-92be-d2d0068956cd", "comment": "Malware payload (GCleaner)", "value": "43113cba178b28e1c394c2da2042bbcc3fc20b7f36f432aa2d4e04917e8168dae6bb77af19d3287b836d528713e229ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273585, "uuid": "eabe83b1-c9d8-44af-b645-87f072ae26b4", "value": "T1E8A533065E3DCD39E391AD780A07D722AF723F5526BE520232E93D8B37BB7816C49641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273585, "uuid": "2e8a8d18-ae27-4e20-9d6a-48e68ebe28bf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273585, "uuid": "9ea84926-fc41-4e30-9e99-2d6ae2efdc76", "value": "49152:icPLnQ2n7pdpFGECDvZFVqWCS3drAPw8ParrfUGIzfCFCBlwVLCgv2MR:XPLnQ2nFdpoDvZjLJ3V2w8qUBzfC9v2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675273585, "uuid": "1c19cc21-a707-412f-a5ea-bb229e7a6cad", "value": 2221353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675273585, "uuid": "20ca7e66-fb30-47f4-9091-e3d2c4c70212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273585, "uuid": "12c0d565-6f7a-40ab-994b-da8c662b9a49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efae7ec5-a1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675227022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227022, "uuid": "7b318deb-f7da-4f89-994a-0fd09f90b1ee", "comment": "Malware payload (RemcosRAT)", "value": "4bc918bf6311c5b753c353efd306547e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227022, "uuid": "98d3cde3-9041-4dcf-affd-6335339ceaff", "comment": "Malware payload (RemcosRAT)", "value": "89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227022, "uuid": "deb1e61c-be1d-453e-89e7-6611c5b97ce1", "comment": "Malware payload (RemcosRAT)", "value": "9b7301fc448a6d9564e6b984363190ffa88ab891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227022, "uuid": "79b4a447-a096-4586-b480-ee005595c76a", "comment": "Malware payload (RemcosRAT)", "value": "ec44f0561b1ab8972b51e80ae726bcc05ac24f83575bc62a77365ef6adc36511968b1a9500b49860728ca0697079254c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227022, "uuid": "d1ad0ca5-c0c2-444f-8648-0614bb7cca58", "value": "T19D358D8137B15462F1DB05B91028778C2E3D7443A6E6E2669BBB39C49703AF7F294F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227022, "uuid": "ec7bf8b8-8149-4f7c-b9f5-121c489cf334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227022, "uuid": "ab972940-b6fe-40bf-8730-36ec216a1c01", "value": "24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675227022, "uuid": "ed222656-da91-4242-9a8d-e1d004c27a0b", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675227022, "uuid": "b7f439d3-74b7-4748-a882-9dad40c31ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227022, "uuid": "7f5c396e-0fbd-4874-9cf2-0ee1a71b958c", "value": "ORDER INQUIRY 20230201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af10ca88-a227-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675252684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252684, "uuid": "5fbcb87e-1b91-4a9a-873c-d4e9fe9e77af", "comment": "Malware payload (GuLoader)", "value": "32e7fc1cc638e4797f4b9e698a53861b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252684, "uuid": "6d1d693e-5c51-4847-a215-082562a2cf7e", "comment": "Malware payload (GuLoader)", "value": "8a791fa3ab2c55621329d599f73d731da3fafd96365a53b7316d2ed68827759b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252684, "uuid": "efc52921-5ccd-4109-9c23-cc5da9372391", "comment": "Malware payload (GuLoader)", "value": "5924c0764b5ba75f29a551e147625864b3e253f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252684, "uuid": "2d328fd1-05e1-4ff6-b84c-37f4f95ad58a", "comment": "Malware payload (GuLoader)", "value": "6257f0f0e2540af5ee14575ece3a99c9ab15e81090fd0ef9cdf8fc001719db6ea9e4d49dcd5ba21dbf6121f8274e7f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252684, "uuid": "23564cd0-f921-4568-b518-1de15936f1e1", "value": "T1D5F45CD1E50383ABF8B2883750C5990912657C22BE734AB69FD43E4ACA7B30157B3E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252684, "uuid": "56ee1686-b862-4bc3-9646-c22eb201a62a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252684, "uuid": "5b624908-7221-4922-aa53-1b3ec7822d7e", "value": "12288:WzUrY4PwkBYXwReVqWToHVdhgYycNWhYSLa4pa:WYVPNBYXwsTmVPo5Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252684, "uuid": "ea284f0b-12d7-4045-a1c9-65c59fc4c215", "value": 770256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252684, "uuid": "59284c22-30a0-498d-9d06-0239724942af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252684, "uuid": "b4aaf6ec-78f4-40d9-a453-6106246ef599", "value": "Request for Quotation from SAILOR - STOC22001139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634151ab-a26f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675283480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283480, "uuid": "e0bc8fa7-cd57-4206-8d49-3a454a358ca7", "comment": "Malware payload", "value": "4f8d0d9157298433bf22955d30462d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283480, "uuid": "f46a9443-99bb-4b4e-b77b-54141bd3d35b", "comment": "Malware payload", "value": "8ac73cedb35abeb387e8ae77f418305d3e389a84756488c84338b58721edf373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283480, "uuid": "0e436f22-094a-487a-88dc-ad4967cdcc31", "comment": "Malware payload", "value": "5fe06ac65da8bbc98689c496ccfe36eae898e698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283480, "uuid": "d36a92e8-0e4c-4743-958a-802ae9f8923a", "comment": "Malware payload", "value": "33676792befe9ef3dc46f0de069feaebe72c105f63705d874081fb19b07fe875b910af45e7c2283f304e504246014c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283480, "uuid": "f3fd8632-a9d0-44d1-a443-2c560b24fe51", "value": "T183431844BFEA5A01E2BC8F34A8F655150634BA63E532EB1F48D568EB17327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283480, "uuid": "f290482d-f47c-49d2-88f6-63eaad9a981a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283480, "uuid": "05386700-084d-4c6e-8343-43d3e61179e4", "value": "1536:hUsoDnb4DNQ7SCCHDrwsNMDPXExI3pmZm:poDnEWOrHDrwsNMDPXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675283480, "uuid": "2e3efe6f-fea4-4ef7-acfe-d8638390a413", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675283480, "uuid": "563600a4-afce-4ed4-9285-548089daa53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283480, "uuid": "77de4a05-df32-42b4-926f-050082e524c5", "value": "LocalStaFvjUblU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b0d98d-a284-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292556, "uuid": "21cc142c-44fb-46d9-be37-516bbf634dcb", "comment": "Malware payload", "value": "314f5645239d8c49ee143b69f34efd72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292556, "uuid": "55fd8de5-aaed-49bb-bde3-21344aab1de5", "comment": "Malware payload", "value": "8b2b8884b6b54ef17b84a5ee315b2945df268dccfdcdcdb5e9201c10edbf20ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292556, "uuid": "29a8bf49-cf2f-46a5-8136-ce6bc1649ec2", "comment": "Malware payload", "value": "13d49928344d8c7ea9be325a36418cf5e586ce71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292556, "uuid": "c02e33b8-306f-466d-9b34-b906ac8890cb", "comment": "Malware payload", "value": "cf72fcb1dfd94ba42adfe1c13ec7473546ece9e1138fe8f097ea07167b0c39a128c6544e47827d3a602b5328874b3975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292556, "uuid": "551ad81d-5637-4004-ae13-7bb96c919545", "value": "T1C19622A14352EAE8DF5B497EA475F980B10B2449B03E0ED244ECED1B50E11A9F58F7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292556, "uuid": "6e9b7498-f317-4cad-ab16-2d882e281bf0", "value": "617157d4575ac8c2cf6618c9730ab986", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292556, "uuid": "cd5a93f6-0de5-489a-80b5-76cf8d3fab19", "value": "3072:eRH6Uf+yOUPxnxQDMcNPlBauCB6jBeQMYdGeMfuhYKTuE5yVRhOF7t8:eRH6o+yOQn0PlBZCBjPeMfoT5krN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292556, "uuid": "94df83a8-80b7-41f6-8192-68ccdfc0903b", "value": 9437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292556, "uuid": "759dc237-5a55-4e35-af9e-fd07f4c609ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292556, "uuid": "78bfa419-6c93-41b2-992e-047d92acf196", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ee2154-a1e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675222198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222198, "uuid": "9a1ffe0c-7699-4ccc-b5a4-c0dfdcd23384", "comment": "Malware payload (Smoke Loader)", "value": "a583f7a2e7e1de0b5194ce50cbf3cb9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222198, "uuid": "75d19e14-b58d-4a65-8b6e-362281e98c27", "comment": "Malware payload (Smoke Loader)", "value": "8b2ff0caab0c22ae4f4359fdd36f1f7df480a56ef608d37e26218d84477caf09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222198, "uuid": "60eb5e1c-d36d-41a2-be81-90a52c2a2eb3", "comment": "Malware payload (Smoke Loader)", "value": "e9b28e95b77e1fa6396fbe1b7fecce33d73b0a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675222198, "uuid": "c565b5c0-a108-416f-a918-36904466aae1", "comment": "Malware payload (Smoke Loader)", "value": "0152293296eef9d8397a7ed0dc8bff77eb59feb4d340b6e20d9781253864d792c7f323076f48963da7709027868c5724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222198, "uuid": "f460a5b0-e487-4f71-b224-030997ec6e43", "value": "T19E548EC272F3BC62E9228A319E1EC6F4751EBA524E1A7366131B9BDF15B01F1C1A3741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222198, "uuid": "31782aeb-d081-4634-9c37-ea412da41621", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222198, "uuid": "8fc0d26e-95db-4060-ad03-5bea789621d1", "value": "3072:+cB4COLciRcXkVCURqR9qO7Ml6Ems0HzXxmqPUx6WfQz86W3MM6:aCOLcDUVC1R9bwMlsWmqMoIN8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675222198, "uuid": "eefd01fe-792e-42bc-abe3-e93d0cc20a20", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675222198, "uuid": "073fa675-d732-42ed-9802-4f340cb398ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675222198, "uuid": "e4d43bde-752f-4be7-a1b5-4f7813056d19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3141eedb-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1675267076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267076, "uuid": "b54be4a0-2dc8-4a61-97b4-0c577ae32ba5", "comment": "Malware payload (XWorm)", "value": "cd2ef15ee8941d702201beed301ccb5a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267076, "uuid": "94b6e013-8ce6-499d-bc0f-6f96a430b1bb", "comment": "Malware payload (XWorm)", "value": "8b53957ed788eb8960276a54086da37286c04c5d6532a6f7e8289466fc56f42a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267076, "uuid": "6a5d676d-3d8b-421f-8daa-54a217d9fbd7", "comment": "Malware payload (XWorm)", "value": "7cf7030848541c0b667398fd09461c716aa01144", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267076, "uuid": "fbb77ef3-ae3d-4f1d-8b79-697126f0a204", "comment": "Malware payload (XWorm)", "value": "e04b2610289909a52d38a786e8eb227205593989ecff43a3696491c7b57c223413c0ac351355b2914c9798acbe750547", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267076, "uuid": "78352f9a-b692-480b-bbd1-84e1e54301e6", "value": "T18203C078FA02F865C29EEE3E2168D1D4FE089191B250F51F1059A3ACDBC46D74799DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267076, "uuid": "ff3a3bf7-4d8c-4300-b9ef-31586f9c6778", "value": "768:UiFd+uwGLCquAKu3D8oQWllXjenzTB9v60OMjmxpRGOyhemGMgYbl1:Uq+4LZfKn2VefB9y0JmfRLysZEbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267076, "uuid": "6281d7ec-1c84-43f5-9da7-06e97b585aac", "value": 37942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267076, "uuid": "af664b1e-c5bc-4420-82c2-95ec962e37fa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267076, "uuid": "25fb190a-fbf6-414a-b1ec-c015babedd96", "value": "cd2ef15ee8941d702201beed301ccb5a.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea02e07e-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675262232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262232, "uuid": "58e5b4d5-d360-4998-8af3-74f4a4f00911", "comment": "Malware payload (Smoke Loader)", "value": "19b3bb5e1b49fae5683771a114eb2b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262232, "uuid": "4b5680e7-294f-4d63-96f2-052e785da5d9", "comment": "Malware payload (Smoke Loader)", "value": "8b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262232, "uuid": "f7e2b025-de6c-4649-801e-c8d6d77a2a11", "comment": "Malware payload (Smoke Loader)", "value": "0e090e04a3ec9b4617968193ab43f94f13fc80e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262232, "uuid": "a708ecef-a04d-4336-a980-63181d09cb59", "comment": "Malware payload (Smoke Loader)", "value": "3720e025fe3f227078e3fe5c51f1f141f4d5887f5d182ac05381ec376d3aab6b50dc181a5f11c3432b0437c2e48952bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262232, "uuid": "79ded442-4250-4769-9806-eb43f1751833", "value": "T1E134D0223AC0C0B2C1775C706C20E6906BBE79301579A9577BB997BE5F702D0673B35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262232, "uuid": "3a36bbbd-b0b6-4b8b-8057-23f4fc34ca62", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262232, "uuid": "5b80b704-7924-4b2f-aeb0-a7ddd19e8c6d", "value": "6144:xmPx8X8hLNI/n9A93N5Ip0wTuRMbwrPn:xm5FxI/9A9wpFTu+bwrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262232, "uuid": "6879a792-a225-43ec-a1c8-c766e3ad4bab", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262232, "uuid": "2f372fd4-41ca-4e92-a724-bef4f4e49e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262232, "uuid": "e2c9464c-756e-4dc8-b6d6-9a8266f23ce0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dd6ffa-a212-11ed-88f6-42010a9c006e", "comment": "Malware payload (ReverseRAT)", "timestamp": 1675243372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243372, "uuid": "cdea84af-52d1-4b38-bb72-c9a3e9ce9fc6", "comment": "Malware payload (ReverseRAT)", "value": "0baa1d0cc20d80fa47eeb764292b9e98", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseRAT", "colour": "#B2CFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243372, "uuid": "28cec073-7f0b-4a97-98cf-25cac53da6af", "comment": "Malware payload (ReverseRAT)", "value": "8b87459483248d7b95424cd52b7d4f3031e89c6644adc2e167556e071d9ec3aa", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseRAT", "colour": "#B2CFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243372, "uuid": "61631d70-ec0a-4708-8e99-e0306918c652", "comment": "Malware payload (ReverseRAT)", "value": "1683c8c0a2653ac2afb190901edcee82dbc840a8", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseRAT", "colour": "#B2CFCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243372, "uuid": "a9c8292d-3e61-4c4f-8ad5-84bb14c7454a", "comment": "Malware payload (ReverseRAT)", "value": "7a4d82e59eddd6d3ae1ffe393853cf95a533a7bf67dfcd87b77e0ea402c2f3201403fbf68217031ad3d66f1b2adcd002", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReverseRAT", "colour": "#B2CFCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243372, "uuid": "0bfc7102-5cf4-4b21-9404-14f18434a5b9", "value": "T1E523421A5398E651F73D1EF590F032C4C2B7AA7DAE425D8A4C94489EBE30F09F53C52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243372, "uuid": "3f0d3cf0-d2d1-4304-b4d6-40f9cb567cca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243372, "uuid": "57a514d0-022c-4c01-b261-2787cbd211ca", "value": "768:hDeVdgTESCaJOOmgly6+DS0zLb0lOfoDMvojfOaPJU3pfFbxeZGazfAY:FouJOOmcH+Fb0GnWoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243372, "uuid": "6ddebf44-0a6e-41be-8efd-a8a954beefde", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243372, "uuid": "e443786b-4db1-4708-8168-64a09f3c6202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243372, "uuid": "9d5aa110-83dd-4160-a814-68e3ee016103", "value": "malware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db90ba6-a233-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675257648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257648, "uuid": "5ee3b654-dcf3-49ec-bc89-b2d7d035fb3d", "comment": "Malware payload (Smoke Loader)", "value": "a6c199ab8ad332ce48e87c2012dd4099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257648, "uuid": "902d4e07-06f1-470f-a033-1c97e7aa994f", "comment": "Malware payload (Smoke Loader)", "value": "8bade989f9a1de05a51970df7374c32376e1f8bdf4b8b1b669de1ad2ed95e549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257648, "uuid": "8d899779-13a5-4cd7-a10b-2be59cf77587", "comment": "Malware payload (Smoke Loader)", "value": "2255b6693b9f747308fa969ed28a6b7607ce1995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257648, "uuid": "2fc46823-cf1a-4f6b-a111-a31dabb2ffac", "comment": "Malware payload (Smoke Loader)", "value": "28d9e29ac379494f7bb07caca69aaa007ac566e1190cb0566d9a6998b967991f40ad90e8f6b03c02ba7bef20553a24aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257648, "uuid": "7de769e7-4175-48a2-9fdd-1e4f8c580760", "value": "T1A134CF3275C0D332C5A754705D70EA947BBEB4324939950B3B7916AE9FB02E0673A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257648, "uuid": "a1f6a106-4a6e-4be7-a61a-eac35cde9d07", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257648, "uuid": "8cb4caf5-198a-44d5-beeb-ddb450e52cd0", "value": "3072:WSUG9LRWveM8zLAVW7+5lNHZ6XM7OQOY/Gjg8/vAhO3qLjVIt:WSUn2MQLAVmqNHZ6XM9OY/GjgYOO3sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257648, "uuid": "5209817f-e307-4ba4-8824-a6bb1e49e957", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257648, "uuid": "480b050f-5d45-4325-9d2c-1fea2b1997a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257648, "uuid": "646379e8-9db6-493d-9a0a-d6233aa9a138", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48109abc-a259-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675273986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273986, "uuid": "50e5cb53-ff2b-4596-8768-106ab7c73a2e", "comment": "Malware payload (AgentTesla)", "value": "a00027f84cb7990dc192384cd71fe032", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273986, "uuid": "4f732b18-d8d3-4077-b31e-0c8110add447", "comment": "Malware payload (AgentTesla)", "value": "8bb887edcf47e357508480892ce596926afd345fb04de8543ae20e9348e87983", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273986, "uuid": "31c7d655-2cec-4cec-a82e-75ad9d31bb4d", "comment": "Malware payload (AgentTesla)", "value": "df70a5568f9f1d2697be162261c6664566a93ae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273986, "uuid": "d6a874a0-2179-49dc-b9d2-8a973f00e16f", "comment": "Malware payload (AgentTesla)", "value": "1bda353a7340c0a180d02e20638c0227f5fc29abb89286c3d8aaefe69d54bcbc43a531790b6713ef8eea8510819bd98d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273986, "uuid": "27e342ef-00b3-4e1a-9172-6b65806e820b", "value": "T18144121822D4C46BF8A357324F3E5B16BEFAE5192CC5060713515F6DBDF26825A0E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273986, "uuid": "d5b7f757-d362-4dba-88e8-3a1b4a823b6c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273986, "uuid": "79f2bb83-4431-47a0-91e3-85131f7be426", "value": "6144:vYa6i9/WTPJ4n/rfB1ewt8ikb02oWPm/tH6uxRwlr60hKL:vYs9/WTPJ4/rfB1ewtK4vSiHjxRwlrro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675273986, "uuid": "9e07a6b4-f396-487d-abdc-0adf1f858c91", "value": 272343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675273986, "uuid": "e3be4051-d96b-49f2-a719-a19602b24fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273986, "uuid": "83f75d91-4e17-43c4-af2f-09be7364c2a6", "value": "Swift MT103 jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580daeb1-a22d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675255115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255115, "uuid": "5e27dc34-ad62-4957-9ae2-3d284519ecb4", "comment": "Malware payload", "value": "5f15801917605efead7ec9b4da4efe33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255115, "uuid": "4a182de6-acd4-4f17-92f9-48ae0d7491b1", "comment": "Malware payload", "value": "8bce18b833d1f4c5ab301b6f1c365bef7ca236969303ad081ceb54d65bdc6854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255115, "uuid": "9ab7fe18-225f-482e-bc76-1e9b8ba02149", "comment": "Malware payload", "value": "68ccf71592aa66f088d2589db5133187e84641c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675255115, "uuid": "8c5c7797-a7ea-4ccf-a519-3d24c3f96848", "comment": "Malware payload", "value": "8ae1b0012e3d7b70b9a0a8095bba50601aae2b98e8e8f91cc93a39b92dc8c414f2171f7d4453c54a82295161449aacfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255115, "uuid": "ce77da3d-32fc-4f5c-8f2a-75868ad86f91", "value": "T1BC35932AA201D957CB926073DD4BD2FA9710373C97F344BB3A481ED8BB3A5D5B661203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255115, "uuid": "08592995-973e-4f92-9bd6-0d75953ab941", "value": "12288:g7GolGoR/MzSGiXWt4DFaER5aci2naIX7BqhuX73rZ7JNeuMixpD/:gaogoSzgVpaCZTXDrZ7quXTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675255115, "uuid": "80046428-40da-46c2-9d82-e42cff754c33", "value": 1131620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675255115, "uuid": "cbdb692c-846d-4c48-b7ae-94ebe454cfe5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675255115, "uuid": "31214c23-2a96-4f5e-bc31-ea42e529d44a", "value": "SecuriteInfo.com.Trojan-Banker.AndroidOS.GodFather.5351.8360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0649129-a238-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675260068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260068, "uuid": "a65b29f1-4e31-4133-9a69-9a300a71a4e5", "comment": "Malware payload (RedLineStealer)", "value": "dbb01a65ca2536b32db5d9421b445fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260068, "uuid": "46429797-a097-4013-9134-ee3152288bd1", "comment": "Malware payload (RedLineStealer)", "value": "8c36805ad37b778662390098bebe20d48257b7fa0e1f9a87d5c30d2e84c327f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260068, "uuid": "e1e59f90-cdd5-44f0-ac19-29dcce71f20c", "comment": "Malware payload (RedLineStealer)", "value": "3a96271febf43fa2b13565d72b0ef8055fa0d5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260068, "uuid": "e31236c3-da3d-4fe7-bf68-a3f04f5f5346", "comment": "Malware payload (RedLineStealer)", "value": "b2748e2110ea598870e768f94f954b534ff73255133ac9a3f09e1a422109e2e8b75b1eb1145930b3235fc8ebacf047b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260068, "uuid": "755602df-93d8-485c-9201-d190edf17aeb", "value": "T11D74013375C0C072C4B744704824EAA53BFEB531253A8A577B952BBE5F72AD0A63A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260068, "uuid": "d2c6ab84-ad29-43ed-9cd0-cc3d5d95dbca", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260068, "uuid": "b8bf7ac8-8473-4ad2-bd98-9f7b6b8981b6", "value": "6144:Bm7ap/L7VAfCsEhCZfBUn+b96N/lfmVdqOHgNzCz:BmuhHVAQmBU+R+/lCdHCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260068, "uuid": "34c9bdc8-9bcc-4be5-a343-3b8d18358531", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260068, "uuid": "d69ba72e-711d-4282-acbd-28153dfc9d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260068, "uuid": "aeebfbbf-c191-45d7-a37f-4f623e79da9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a85bd6-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675239989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239989, "uuid": "40e9dbcd-9d26-4bb3-8c13-828944ba5455", "comment": "Malware payload (SnakeKeylogger)", "value": "ad1ed82db0339586fb7d08b62b2ce4a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239989, "uuid": "6578ca44-6325-4ec2-b0f0-671694a4ec9a", "comment": "Malware payload (SnakeKeylogger)", "value": "8c4cee768cd1192f59d56900a165ad1541cd7c567c39ad8a4cd8bee889571b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239989, "uuid": "c14f6901-9580-4894-bb08-64569867ca5e", "comment": "Malware payload (SnakeKeylogger)", "value": "5ca6e377a60b4d9a4dca1567eda2cb27563625ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239989, "uuid": "89e6ffb3-52cb-42fd-bc8c-b7a8a1090a1b", "comment": "Malware payload (SnakeKeylogger)", "value": "96ed1e8b292ebebba3e9d3dd376dd493352c69b4d04d1d28faf274ba65660660aefc518b9e0352aef1e7a62abd4e1585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239989, "uuid": "bf69ddde-ff7a-4367-9dac-bc9f857ab818", "value": "T155B423607B95C027ECEA45B54E77D9EAF6EBB40305E4694A07600B88BDBF2006D5FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239989, "uuid": "54667b5b-a599-4467-baa9-72d5e20790bb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239989, "uuid": "e899ab2f-f508-4835-a532-e660aedacf8d", "value": "6144:/Ya6aIFqHlxukeDB/X/VAqcaO93FlosKzfWfamGnRILKQ997sXHbZ12klBQ/36+p:/YsQqqket//aq25KzfWymGCg6mBQAZkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239989, "uuid": "6af2cf72-a42a-457f-a12b-516a03f0c502", "value": 539795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239989, "uuid": "b7ddb169-5de1-4156-a59f-54e64076989a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239989, "uuid": "072f9b6b-f413-4406-a670-17c25f1e7a56", "value": "SFGH09876433456789876-0098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e5328b-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675280099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280099, "uuid": "2cddb959-268b-453a-8294-212766383c7e", "comment": "Malware payload", "value": "dc4f787a69d7754228d326dc59931763", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280099, "uuid": "d69fae8a-f363-4b4b-afbf-6a2f7c566a74", "comment": "Malware payload", "value": "8cfdcb7586a064eb55acf04fe0c02500c5c563e8799a82093001c71e464b06c5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280099, "uuid": "8d1e882b-a8ff-42fb-9f36-8e5301b1abcb", "comment": "Malware payload", "value": "fb25df53baaf9d835cdc9a849ef21796e76c2062", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280099, "uuid": "af872edc-f032-420c-a07b-eb57cbf860df", "comment": "Malware payload", "value": "df708dc2cf48f2bc965bd704c5133a9f764741559704cfac1d47a15bfb5dff6ab0049a005055fd72b2b5579d01b02b5d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280099, "uuid": "d9a192c3-46ec-493d-bf91-68ec33fa02c9", "value": "T1AA85BFF876047DE6266F576BDA96ADDC03B626739A8BA4CC806477C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280099, "uuid": "6af11a6c-03dc-4fdf-9488-6d011797ac36", "value": "24576:gWMQwxw0TmImE0c7eylbGvK2UdywK1qYzsE5PLxioYx7qP59MFbV8xAFVsoMqjgB:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280099, "uuid": "3433ea58-0a17-4539-8130-3db9fb3be247", "value": 1757762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280099, "uuid": "cddd8d8e-6fe8-430b-bf4e-75f972a3893f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280099, "uuid": "ae9b1fc4-2502-4142-a837-5033667c4b5c", "value": "RFQ EFT-PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c14cde-a229-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675253473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253473, "uuid": "ffec9da5-c069-468c-9386-c94beaee71f2", "comment": "Malware payload (Smoke Loader)", "value": "b1685a4ea1f4c0626157053bf23617ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253473, "uuid": "6f47bb82-c135-4446-b2b2-33aa8818d6f6", "comment": "Malware payload (Smoke Loader)", "value": "8d98ff38cd57eca0641f68e8ac710f45330bd623ab684c8ea2b4e23d8975b4b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253473, "uuid": "ac7c66eb-c13a-4b46-b4e1-4e7ac9e821cd", "comment": "Malware payload (Smoke Loader)", "value": "196e39e2adcb098c20db971a858edcd96a8081d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253473, "uuid": "fbcb1b09-4741-441c-b2a2-4ef231a4d6da", "comment": "Malware payload (Smoke Loader)", "value": "7b7a2fbe0082dd67d56337d4dbaee3c34df64f5e7dc4428d66749884c140ce80b5aaad1e63cb1baeb1d39676657e8a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253473, "uuid": "e8cd4653-6d1c-4c88-b8f5-a3bf3bf09cc5", "value": "T18A34DF2274C0D072C4A750706C30EBB56B6EF4315839994B7B9997AE9F706E06B3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253473, "uuid": "75be7d96-1729-4e70-a0da-bfc905573911", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253473, "uuid": "0e0c6c7e-abc2-443f-bacb-758638ee88a6", "value": "3072:RW8G5lRMx7Ql8KNL6DWHe5c3L7AoLJlDKQNhlxvpRNDRYicN27GjDGx:RW8jg8gL6Dej77vlDF5pRNKMGjDGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675253473, "uuid": "32f7b031-9afd-42de-96a8-039861cf262f", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675253473, "uuid": "99d01ebb-7d81-433e-9b57-9159ca455173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253473, "uuid": "41d9d13f-66f4-445f-a46b-fa0d54cdfedf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a7d3a-a205-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675237990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237990, "uuid": "77a69453-7063-4da7-aff1-bd448a89de51", "comment": "Malware payload (Formbook)", "value": "4e1472627dcce65ab74fe9da68fc99e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237990, "uuid": "fbfa4bb9-b381-483c-a617-e39df9db067d", "comment": "Malware payload (Formbook)", "value": "8dd634edea7c470fe551cc425ff6851db72af868b04b747e5c516d4743fa3055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237990, "uuid": "42bc924c-cafa-4240-8a42-6f7f251b5629", "comment": "Malware payload (Formbook)", "value": "a92c13b20e79b52833f9e265c6663d0c5cd6fe3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237990, "uuid": "4d076de3-ed62-49a2-8cd0-915216b93ff6", "comment": "Malware payload (Formbook)", "value": "6902983b02fb9dc472493fbcea149c8e537f6bac428b84fba95699e60cb245bd1e230bcbb8c4a03c89adceb2c3a41c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237990, "uuid": "6581c71c-d52f-41c4-91d2-95b02a9133e2", "value": "T1B06412E67604C427D8165BB7EE7E9E126EE5DE2214688B0A03A0BF5E3D715D0CE06373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237990, "uuid": "e3c45b4c-e593-44c1-a556-80f210858f01", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237990, "uuid": "f460cc91-1ab4-4acc-b369-1191260ec7fe", "value": "6144:eYa6yXKfBYQl0udmPr8O3w9rointuh7/DcSWIePobageuiVU82oCQVqq:eYaKYgMw9Uth3cVyxIR2ouq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675237990, "uuid": "79874f70-9ba2-4e4c-bf72-c020422f3732", "value": 333693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675237990, "uuid": "066969a8-12d3-4771-b97c-eeafee1fab22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237990, "uuid": "1e096af8-d34a-4547-9914-9456233ba756", "value": "doc2023013099877730091113.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4ce6bd-a22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675254612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254612, "uuid": "d35ad6ed-e9fd-4e29-9f81-8943751f09ec", "comment": "Malware payload (RedLineStealer)", "value": "5bbe43e7d2aa036b1dc9601cca8f6c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254612, "uuid": "1def38c0-fc8e-488c-be0f-0cd670adea84", "comment": "Malware payload (RedLineStealer)", "value": "8dd8a1c9cb745d294c0a776f24c0f9d1f231bad472dc842809670e34e4cdfaf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254612, "uuid": "06178d48-9532-411f-bd2f-d3632e5b7246", "comment": "Malware payload (RedLineStealer)", "value": "4b273ddd1f73bf276c10f00c09687ac272aadf9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254612, "uuid": "5bbcc54f-c9a5-487b-bd33-0673a3809f9e", "comment": "Malware payload (RedLineStealer)", "value": "9b485e3541d023799b601386056d026d193bfccf04a3cd66088d3eccccdb14de069a6e72b0cd6c6cb997fdd513579e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254612, "uuid": "fc5bd5db-c69b-4d19-8924-ea8e7d66b175", "value": "T17074F1323590D032C76700705834DAA4BB6FB43E577AA8BB3798176E9F306D2662635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254612, "uuid": "6fde6612-3939-4e97-ab84-071d576ae0d8", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254612, "uuid": "ad39e887-3ed1-4af3-8a23-39a0c037cc0a", "value": "6144:GW8GeOdLAq4z0ywGVzYuyWUzMYZZOibBGwQEPIYmgE:GWlTdcq44cViWUzMEpbU2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254612, "uuid": "3706650f-a5aa-4327-bdef-b769890a5178", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254612, "uuid": "81da3a39-98f2-40b4-9cdc-b90276f8aa02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254612, "uuid": "a8edb3b7-5fa3-4869-98a2-e859a0412ef4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6255b43c-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267158, "uuid": "1c78c3f8-d065-4fbb-b020-006cf673079d", "comment": "Malware payload", "value": "a7863fd82f651d44d6dbd17d920d4eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267158, "uuid": "2677ca50-01b6-4772-a717-0aafcd3d1f06", "comment": "Malware payload", "value": "8e3963d762b35218c2f5388dd93a19793cbf79548130f2fa7e6f732d8df12bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267158, "uuid": "d63880a6-c29a-4a42-a371-5667e9295cfe", "comment": "Malware payload", "value": "69d259e1cbc0d4108276815f6bc55dd8274e2830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267158, "uuid": "b6d66175-91b8-4230-a8a7-b3a105d5849c", "comment": "Malware payload", "value": "f5d8af2200e75cdbe263d0c4b49e886346d7c3e9f57eaeb587f9e0c9028b157be9f266f5e862e1885a7036a670c5fd88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267158, "uuid": "81341ca2-d13f-44d7-b2fa-e2f0bb1d38e7", "value": "T173C1EF415FEE50DAF227073017EAB3B71665F8B1552E62F834844A595F31BD0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267158, "uuid": "a348c77b-f8fc-4fb9-9be6-6828a9689290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267158, "uuid": "99b416e2-2ed2-45a0-930d-7d4dbf562796", "value": "96:K4YL79OlBCFm5PxbNYVlFA8e/on1Bv8d3ojMrl:5Y39OuFmBNNYVl68e/onb8db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267158, "uuid": "91f3901f-590d-485f-879f-1511557c127b", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267158, "uuid": "7195843d-bcb4-46bd-ae3d-a52d43174537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267158, "uuid": "077dc325-8f04-47a1-9a18-cc1226a5bd0b", "value": "a7863fd82f651d44d6dbd17d920d4eb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f440c59-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675263797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263797, "uuid": "df0f275f-3aa8-4741-8b49-12cda2609619", "comment": "Malware payload (AveMariaRAT)", "value": "516db3ecae44ccd421d078a4e8068e51", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263797, "uuid": "4c8e769c-f7f4-400c-8a5b-6548e00159c4", "comment": "Malware payload (AveMariaRAT)", "value": "8f81a39f5643e86ef24df6a4b3939b38a1fcd270e3c0d801cdc8e9dd5f65eff1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263797, "uuid": "67e5e781-3b9d-402c-bb92-37a13673db6e", "comment": "Malware payload (AveMariaRAT)", "value": "2fff36b5a0bb2e9036c097731f7ce5d5cb78bc1c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263797, "uuid": "89a68203-5e03-4e87-a785-cf39f05c2048", "comment": "Malware payload (AveMariaRAT)", "value": "9679ae76e8359dc9b5390def86bf3e9b5cbc4c7a713c8b1017cdd9436c2a2f994f199bba204a08be440285f40031dcc5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263797, "uuid": "1f35ccd8-4c68-4589-a07e-314c4864b42b", "value": "T179C5D7F432085963C237D444B10E72592D21FA9926C77A8C53BFC1B1BE5AAE3EF48617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263797, "uuid": "fa8f7f77-987e-4c07-946d-5b7f6ca68061", "value": "12288:lZTfBXBDqENmlEo5p96SWdWuKKgbkqI1o5uBs/L5gPVzFHRsUr:lZ1XNmlB5f+tgbkqI+cBiL5gzRsUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263797, "uuid": "9f5b2513-f4a5-46ed-8403-163b5fb24dfe", "value": 2531641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263797, "uuid": "1737464a-05e2-4ef0-aaee-5570482367a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263797, "uuid": "0e7bf713-7913-4f6b-9fb0-02e112ffb464", "value": "Order GSE983V.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91f963d-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675266901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266901, "uuid": "2ac411ca-b4b4-4b76-b05b-a8da40d71300", "comment": "Malware payload (Formbook)", "value": "6938c07c6026c281be77d65359e4caa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266901, "uuid": "665451e9-2d80-4fe8-b527-ee0f88779df2", "comment": "Malware payload (Formbook)", "value": "909735e8a902e299207563464959d2b7a8d3821e74cdb1aade9a17162c599e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266901, "uuid": "3724be39-9258-47dd-8989-221e436db22b", "comment": "Malware payload (Formbook)", "value": "223b819fe128b7925e7322ced43ff23eac6c0f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266901, "uuid": "f7d0a7bc-18cf-4f2e-a59c-61246a4407ec", "comment": "Malware payload (Formbook)", "value": "d268e499b91bae9f729b1f50ab7632af26f292a1e767bc9f9307fa60046c5b81ad061d29e1aef3e824775fc18e9d820d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266901, "uuid": "b26b70b2-346a-4fb1-983c-f8e05ac06c53", "value": "T1B3055B8137B15462F4DB05B9102877882E3D7443B6E6E2665BBB39C49703AB7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266901, "uuid": "48db1369-e120-4f1f-9746-8385d0f663f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266901, "uuid": "3fc6824c-0ffa-4a38-b8b7-0b20cbce0ca3", "value": "24576:Re/a6r8kRaLcKsOKPTnbdJIeEgKc4w6Rjc4N34:Rn6r8kRaKLnbdKeEgKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266901, "uuid": "a25059f7-e445-4fdf-ac04-e13cbe2e3ca8", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266901, "uuid": "c29344e5-f573-4bb8-bc75-71bd3df17049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266901, "uuid": "e5d62e61-1f93-4d50-9a22-cb28c5b68004", "value": "6938c07c6026c281be77d65359e4caa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa24ce14-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261829, "uuid": "92824670-2c39-457b-b740-86de4206a6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "0230d956c0a82b42a1fa6cddfa6afef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261829, "uuid": "398ad7b1-a24b-45dc-84f1-c4cfde0299b3", "comment": "Malware payload (SnakeKeylogger)", "value": "91efbdf9806559fc93e798ce40d7855b806a0935ad51564b9fc0b3d876de16c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261829, "uuid": "22a616d1-1001-41da-aa08-7bf53e9107df", "comment": "Malware payload (SnakeKeylogger)", "value": "c4a7973406aa5c99d2b618b127f934ef5714ff76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261829, "uuid": "60b09e18-a656-4441-a4cf-63ded6ab5ace", "comment": "Malware payload (SnakeKeylogger)", "value": "4329a9af0c192c46fb2162434364a72060e9191252f930f480784d949e9dafaa0d718bdaef1090374ddff21511738ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261829, "uuid": "d176c39c-990d-4d4a-91bf-8703a3347b47", "value": "T173E4BE432978D59AEF6902FBE10A905437F5CCBA811CF6195BAD33C2D9E1B510C6BA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261829, "uuid": "287267ce-15f7-44e0-acfd-a02c225c8e42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261829, "uuid": "6b11eb23-0c2e-41a7-9fc1-cdbc64528879", "value": "12288:33bUNbKJd26avlKLwzyyn24mXBBLLUfo5v6nnjqKoe:7UNbKJE6avcLwzyynrmbLLUO6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261829, "uuid": "aadce198-adde-44ad-97e8-2384a25996f9", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261829, "uuid": "b551ea7b-bfd7-464d-91aa-4ad5a7ac8117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261829, "uuid": "68102597-f3b6-4dbe-9ee3-bf74249ab94d", "value": "Projekt 41-17-082 BR192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc2bc13-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675247632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247632, "uuid": "52fd00cb-cd70-4952-8a03-c4339dbaa228", "comment": "Malware payload (Formbook)", "value": "35c3e6fb76691d7fca57cab41f2a9af2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247632, "uuid": "f20ed926-cd19-4dc2-976f-06e3f60cae35", "comment": "Malware payload (Formbook)", "value": "9237ba7c56a9314a2199b4c6649833b19c566bbe13c596977847305cabcaa9d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247632, "uuid": "ffbc9945-834d-4e1b-84f5-88c252618315", "comment": "Malware payload (Formbook)", "value": "1f641acc4ad0208010cf26070892d851b581336f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247632, "uuid": "8cc4ca1b-6a10-436a-bef1-2e545368fb4c", "comment": "Malware payload (Formbook)", "value": "b68dbc7d716c92e66f346988e94589c6770dafbcaa1eb194c13214c5359ab8d68a3b4fe48c22bc10f351e1766b9770cf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247632, "uuid": "5c09176a-9f93-4f9e-ac4c-ecdb6524c74c", "value": "T162C423E6EDD9CB2786D449DD0B5563972C342C1E6FD870BBBCA07D98B8D2444A8E3630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247632, "uuid": "1e62c88b-c8d5-406a-8386-fbd5226da9b4", "value": "12288:pBQPDUaHj0CL+Zw37CDIEaMNpbYsl+2qAu21xB7Sp6Gi14gF:punHf+ZcGpaMH3lUAf1GWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247632, "uuid": "ea0f8176-e7a3-42a9-aaed-e215321a65db", "value": 551661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247632, "uuid": "e55c219e-cc8c-4c6b-b154-44120ed5eae3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247632, "uuid": "8708e166-f024-4ab6-855e-303727ac181c", "value": "Ihre Quittung__Pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0687958c-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675262709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262709, "uuid": "49fa8922-1071-4e41-87f4-d8f8e8d7aaa5", "comment": "Malware payload (GCleaner)", "value": "545ed2ce008c93b63a12a227e4542244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262709, "uuid": "a4475cf4-8fa4-4e4f-be1e-60e9ba87294e", "comment": "Malware payload (GCleaner)", "value": "9270217067be6a620126912b6d250a7711a241a2e3d258fa44d01191a231dcba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262709, "uuid": "e1f73daf-2ebb-473c-96bd-7dab6e5bc0bf", "comment": "Malware payload (GCleaner)", "value": "e4f0dd609a67583e079f94623284ad0a092a9e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262709, "uuid": "7ecd4b33-0621-485c-8231-8a71a995229e", "comment": "Malware payload (GCleaner)", "value": "350c92e3f31b94102103a34d3a2d3c08eaeaf7bc9a23a1b9de00b5f45249922c75cf1d7fa7fe26811dd646ed39f3bd21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262709, "uuid": "9e308e72-4590-4eab-a9cc-e18463a65b03", "value": "T191A533091A7E8875C2D08EB96D40C1799F55FE603AAC820125EF7C2F3BBF993BD48516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262709, "uuid": "35adafdd-f5cc-43f2-9c45-925bab51b9b4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262709, "uuid": "d48890f5-824c-4a95-b699-29eefbf6cd5a", "value": "49152:icPLnQVNTaBe5w0P/aR2vxU8MyyUB854aQHRNf3MLCgv2MR:XPLnQKB70KEpUayUB85w/fcv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262709, "uuid": "ccf35c70-5869-4575-9e57-befe9afaabb8", "value": 2245583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262709, "uuid": "d34e6d62-d77b-44d0-bab7-17efcb0c5648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262709, "uuid": "ee5861ad-00ba-417e-abb8-592026a98b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02616a6-a1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675231721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231721, "uuid": "60ffd494-1e66-4f28-ace1-ebce4f66dcfa", "comment": "Malware payload (AuroraStealer)", "value": "90afcf8555da3a44eb27c911f9cf1332", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231721, "uuid": "41f47f33-a558-4e77-85fd-a575d4a890f7", "comment": "Malware payload (AuroraStealer)", "value": "929d7d7b689e671348083c0de50069032b836d8720d5fdf9988d2befdbb0ac4d", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231721, "uuid": "b4bfe44f-3a83-4964-b6a2-af5161963a6a", "comment": "Malware payload (AuroraStealer)", "value": "88abed575491f7e48688eab6bccf8df31db0d336", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231721, "uuid": "4503da91-c574-40a6-8705-888e4b4cc13d", "comment": "Malware payload (AuroraStealer)", "value": "41ba1c356c40de093d9b83968879fa9505c97a666ae4b49175b27e1636020c93a90837467f230ac3e16378d49ac46208", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231721, "uuid": "2d642cdd-6178-4251-a05b-c2ea78e6fd29", "value": "T166E63390903D0DECC2A67374E1EA1F81F1B596886691F10B2FAC44D86DA37B6752732F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231721, "uuid": "2eee36da-553c-4fe6-87d4-f525389502dd", "value": "196608:24OGts5HIVoBLez6TDPZ+fPYoVGRKrzxWrE3ZuRYVFAJnMsbqQHJVU229zyfdt6U:24OES3BH+VG8RZDFMH+aiuVsZ2LEhmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231721, "uuid": "7a491601-74e4-4463-bfb6-f81465547fe3", "value": 14256786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231721, "uuid": "1a467065-2c9e-486b-b73e-ccf8a87b8a47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231721, "uuid": "4a0efa6b-924c-4982-804b-57c73d8a0d77", "value": "Installer_3.64_win64_86-setup+manual.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1f9951-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675262285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262285, "uuid": "72db2044-859a-4abc-8d69-0b4435ecbfdf", "comment": "Malware payload (AgentTesla)", "value": "63b24f594c12b9f0d50ab91e3f5a891c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262285, "uuid": "bcc0ef61-eec7-45a3-9722-4607c9e2560f", "comment": "Malware payload (AgentTesla)", "value": "9317d278c19c68b612b4b8eacbb956f7b82235a734bf761e4db1dd6a86d2acd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262285, "uuid": "33a4f098-6147-48cd-84b2-9f7c3b3cd753", "comment": "Malware payload (AgentTesla)", "value": "ce3d44409940d7345ff1467ebc5f1fd15dfc9738", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262285, "uuid": "c00f58c1-614b-4b09-9097-abcd5202ba05", "comment": "Malware payload (AgentTesla)", "value": "b261878d1af26bfd007dab1915fcdb801d24c485273068c9f8eb4dde9cdfc5e5e87df3cfd82dc7e361201158e590aaa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262285, "uuid": "de251204-b642-483a-b685-d9baa940556b", "value": "T18F056B4137F15462F1DB05B9102837882E3D7403B6E6E2665BBB79C49703ABBF698F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262285, "uuid": "07995ca5-558a-4784-b77b-204ff767c334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262285, "uuid": "610afa4c-e0ec-4987-9994-8f582c28ec84", "value": "24576:LeoadwIowibQwEAlcGaT+yr8zw6Rjc4N34:L2+lQwEA5fyr8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262285, "uuid": "266dc216-3bf6-45e1-975d-9fc7c027babb", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262285, "uuid": "a600a0d1-0f60-4403-b6ea-e401d7070e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262285, "uuid": "74c67b99-97d8-487e-8ebc-9bae92c9d749", "value": "3024000750004938201_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94cf782-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675268190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268190, "uuid": "65463548-19d6-4737-9ce5-7daf4ebc974b", "comment": "Malware payload (Mirai)", "value": "0158940ae40a0568fe95190b637f9245", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268190, "uuid": "bd63770e-1d40-4413-8a02-a29209799472", "comment": "Malware payload (Mirai)", "value": "9333375c73be028bc937c9a2a0deb04bc0c457a2ba875c2887a1b9b250483c9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268190, "uuid": "59564254-98b6-4593-89dc-bb63cc9b99d0", "comment": "Malware payload (Mirai)", "value": "14f4663ca254469b5b6de869649a6bd30c8fb7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268190, "uuid": "f774f7ad-25f5-4a79-9031-3ffd81ee7d7d", "comment": "Malware payload (Mirai)", "value": "e76769bd50bf828cef926aa542e38e1474240d751c142607ac4324cc5009086fd4d351defd42044302482a20ebcb978d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268190, "uuid": "82ef6d22-9926-4170-a78b-282952a020ec", "value": "T1B6432925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268190, "uuid": "6a34f8e1-b7e6-4aa1-ac6c-976c9f921f33", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDx:eL0AxvSHfymp0xgunvCkV6vTMDau+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268190, "uuid": "fee30139-d02a-4070-b4d2-d0942c7908a1", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268190, "uuid": "8e8904e1-158a-4b3c-b9bd-82038544b5ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268190, "uuid": "0adaa378-e698-4219-86ec-be646db4d29d", "value": "0158940ae40a0568fe95190b637f9245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9b3d2e-a251-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675270527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270527, "uuid": "b8fec671-bd5e-4b87-a87c-9f48b4dda97f", "comment": "Malware payload (DCRat)", "value": "65d590e07198d25d05b41c557b231fc7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270527, "uuid": "f2abdabf-5bf0-4ad1-b5ba-6948594cd56a", "comment": "Malware payload (DCRat)", "value": "936b51db1be856b313fa5cdf194410989adeb2348988c47bf59790a0f3474afc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270527, "uuid": "4313e3e4-728c-41ca-b1b1-82c0c02e0a73", "comment": "Malware payload (DCRat)", "value": "3848eb0f0db7d00b78593aa29bd4b9e4f0b4e022", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270527, "uuid": "7a936f1b-efca-4254-a18a-b6b3cf174050", "comment": "Malware payload (DCRat)", "value": "f2dfff473126e45fe19b2c49ec83203407b9a25dff354ec97979c4c57c5436e9e51f4e065dd87cd34e32a4cbc32b5e0c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270527, "uuid": "17f0591b-5e1a-4e8e-a73d-150d6a703632", "value": "T16D453A863A1AD510D46E4B77BE7377482B10EC361CC14306F34E72ADD93EB6C2A85B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270527, "uuid": "411e9b1b-0afb-473f-a9e4-8fcc55d61016", "value": "e93eece918d61e74f579b33b851132aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270527, "uuid": "6972b0ac-e416-43b2-b816-ffa032282840", "value": "12288:DVj+qgXEJ2RATf1rBH28VUuY9cd1296Uw3U8Db1QxT2pHGTOwpkgol6lJkh/3/nn:Zj+ErfdBH28VUx9zQpBAKp7g7s/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270527, "uuid": "32086c7e-a1d0-48ab-a936-d670c5d2353c", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270527, "uuid": "70cb1911-7759-4000-8a77-848d579d53c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270527, "uuid": "c9369e23-cdaa-4ce3-a93d-dedb84a42062", "value": "HEUR-Trojan-Spy.Win32.Stealer.gen-936b51db1be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfec973-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261832, "uuid": "88e0f88a-4219-4234-a924-f710edab6cd2", "comment": "Malware payload (SnakeKeylogger)", "value": "57fef8f1f5588749972ca86427a84ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261832, "uuid": "8d7ca341-df36-4a4a-a120-03575593b3b8", "comment": "Malware payload (SnakeKeylogger)", "value": "940962a877f581558d30c735c4bc00fc43f46aea046ead732611a6647bcb19ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261832, "uuid": "fc18f4c1-ef22-4022-a958-0d8718825aac", "comment": "Malware payload (SnakeKeylogger)", "value": "f02eeb37ab23baef39a9c473c0d140778eb89cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261832, "uuid": "5db9113f-deba-417f-a75c-473033d8edee", "comment": "Malware payload (SnakeKeylogger)", "value": "dcd0a0c751ae71ecbd70008a8249a5fe412bf915e3efaae89b4d7048a570fe6f8a0c1840a873f3d4dda86883b6cb06ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261832, "uuid": "10936657-9231-4263-a27a-ca838a71d15f", "value": "T197D1C811A3DD4233EEB6473ADCB353800638E75568678BDD68D0611BEC136964B73BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261832, "uuid": "e2c724a5-cd78-4341-a024-6b8ff0e4ac24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261832, "uuid": "9389db82-12f1-48bf-8b06-65fa54f7bcbc", "value": "96:y84Z26fM8osEEa79lbJWFPATRyUoSRCQ1tAkA3wzNt:qbZo7+PgUDi/4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261832, "uuid": "6a99600b-3879-456e-97b0-b4ed7cf925af", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261832, "uuid": "105af4d4-b073-467b-aaa9-b2fd0d1251a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261832, "uuid": "94740aed-6a83-4618-b6fd-d853294ffd5b", "value": "Kzzexzgao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d7f2e1-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675265396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265396, "uuid": "9585c713-d4f2-4b36-8352-95c43f821012", "comment": "Malware payload (RedLineStealer)", "value": "ecddca937a8b0b317ab2d501d00f1d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265396, "uuid": "760432e5-f08b-40a7-b5cf-bbfc767335f2", "comment": "Malware payload (RedLineStealer)", "value": "9442cda722ca104e7b828d9679eb1d271bc6f0d103779bd5aaf60ec3055b400b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265396, "uuid": "8db6a382-849c-49ad-bbcd-30bb83f238e3", "comment": "Malware payload (RedLineStealer)", "value": "ec784c7757659c0d28a855bc50a7d5b79d9e3dd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265396, "uuid": "c7e8c472-8c49-4f47-8e80-1d76cd899ce7", "comment": "Malware payload (RedLineStealer)", "value": "e7eeffe737fb8b9aac18739820cd3f000f5d1dedaa1c7a03a334fe897b41877e34040af7a3008c9170b7d244a5102ea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265396, "uuid": "ad2a9e17-ca12-498c-abe9-bcbd71571e5f", "value": "T1337402327680D072C5760079C930EBE46FBEA131E676595F3BA81ABD9F706C0673634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265396, "uuid": "fce9b3ea-8d9b-45aa-a863-6cb3f733ac6b", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265396, "uuid": "a77444d6-c0e2-406a-aff7-a194040c13d2", "value": "6144:KqsiPgLUW59Qmb6BVSRFhF913pZ26xr+Byo0y:KqBY4W5+mfFX913OiSH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265396, "uuid": "de8b9bac-b9ea-4447-97a5-6a83a1222212", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265396, "uuid": "ce1c11ea-4265-44c2-bcf2-0de0e4918848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265396, "uuid": "fff331bc-af42-4870-8dcc-c25b8ccf7537", "value": "ecddca937a8b0b317ab2d501d00f1d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9184d4c-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675232917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232917, "uuid": "315c0a0a-7cf5-45cf-b74c-6b35f6c83868", "comment": "Malware payload", "value": "fbf392dcad1d7acff0a3279b39fff33e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232917, "uuid": "affad6c3-fb50-40bf-993c-671d8229380a", "comment": "Malware payload", "value": "94cc4c5fdb3aac3605ae5dd4eb83ebbbc26615a5e5a66a00d9deb63bb35dc3ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232917, "uuid": "cc3e93d5-5e57-4165-979e-f69d2476549a", "comment": "Malware payload", "value": "10b777429ad8068e7709e1d05c1fc8e74711d5ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232917, "uuid": "1fc02978-6656-4ece-b9b8-3c57d655acc3", "comment": "Malware payload", "value": "44be2e6c33a384d7e4fe249eb3d7baed774b4cc83b56dda9bec699e5b077aa91a273c132867ecd96028e46d620e971d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232917, "uuid": "580af918-aeea-4904-9656-15d76730b765", "value": "T179738E12D28185F2D091117464EBE739FB3629A5037E9647A783FF2A1866933E6323C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232917, "uuid": "621c0946-0b5a-4783-a902-64428c4b800f", "value": "7a54b84dcb4b8a76b96885a7f6d32f0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232917, "uuid": "b9de219d-a082-4b44-8b94-a6d859cdd9ed", "value": "1536:qu0s+S3laAGcvKen/VFnToIfITRur5ZyNTeiFp0zA+V/R8:f0s+Sien/VtTBfITRur5ZyNTeiP0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232917, "uuid": "74f2cf68-f611-4b1e-a88d-28d667ab1ddb", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232917, "uuid": "28b50efe-dcfe-4438-baa8-5d4b47d18abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232917, "uuid": "692382f0-aa70-4c57-8470-312c34347fd3", "value": "STMP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737813ed-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675264180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264180, "uuid": "350a60cd-1a2b-43bd-9a2e-7ac44a53cf02", "comment": "Malware payload (Smoke Loader)", "value": "643c12fdd4a237db852b16e061f93618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264180, "uuid": "69ea8fea-e44d-45df-afa1-7a85b9d53940", "comment": "Malware payload (Smoke Loader)", "value": "953f10a7e2d8ea85f947bb4eebdcb52dc9877a01b75bca1a1b5f19d41f2a1870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264180, "uuid": "31deb2b5-da58-47ef-a699-fa745e5b4a67", "comment": "Malware payload (Smoke Loader)", "value": "d953e115fe8dbf83b9add8adb7a4cd6cb840bbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264180, "uuid": "906e5407-1091-4d0d-96c2-a76cff4a6e7e", "comment": "Malware payload (Smoke Loader)", "value": "ad21bd4c9ed48211323603f0505c3425ded20bfd0894082e2d000c4d2ecc259799b7efbddb5699e2ddd85fa0fda87715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264180, "uuid": "54c0aba4-762d-45de-884f-996149926e04", "value": "T10634DF3238C0D072C5B744309C30EBA52BBEB5315579999B7BA9D7BE4F302D16A36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264180, "uuid": "58af903a-6424-48eb-8d32-825fa32c1b9f", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264180, "uuid": "a8e6bbb2-0ca2-496c-8976-b52522d067db", "value": "3072:KvifG77F8hxF9yxL/tWbPD5ZKqjEeoyUma909E60Qoz5egCj:SifXDkL/t6PGq4HrJ90Rloz/Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264180, "uuid": "f560bf29-993f-4105-892b-0df9e8a1d8e5", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264180, "uuid": "eb9d8bd6-db78-43a8-af5f-b516067e445f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264180, "uuid": "5d010eb1-6e8e-4ac8-88f1-3ee0c5b09a0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cddaba-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675267409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267409, "uuid": "7aa05c17-8d65-4406-9470-418fd3e397a4", "comment": "Malware payload (Loki)", "value": "8d9c5a9ce7a94df0ce3d180c45c0b328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267409, "uuid": "804dee83-2ea6-4723-9215-8a760de06b92", "comment": "Malware payload (Loki)", "value": "96f0b33adcd3fca2a0193ce24095d142d15636a124a31dec0ec109ac0e0b5363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267409, "uuid": "f5ce48ee-a396-4cfe-874d-8dcc8fa598ab", "comment": "Malware payload (Loki)", "value": "0da82f448ec2262be3bd84af55ab926d0b7ab811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267409, "uuid": "4864b820-cec3-4108-b625-cb21b13a345a", "comment": "Malware payload (Loki)", "value": "ca9efe3789c745efbd0a37cddde93cea5bcdbf48dc9e02b1231a82156ad17f2a5dab5bb9a037e1a0bab44d7e4ca62d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267409, "uuid": "e133e3bb-fca0-49e9-b898-22d882af6ddb", "value": "T189F4298137F15462F1DB05B91028768C1E3E7443A6E6E2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267409, "uuid": "b82c8a6a-964d-44e7-96ea-ed9bf1733323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267409, "uuid": "e5e09339-04d7-43ba-be79-85d4ace2e667", "value": "12288:UepaXr8WfkmhRfK07ihwOAY58MEBNXylheRCeey9i7+pvhc4N34:UepaXr8WsmhuhlzqvBQte9w6Rhc4N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267409, "uuid": "5fbbe3a8-73c0-428a-9693-f1e01540b1a8", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267409, "uuid": "e121811a-5dae-4d36-9848-d6779ac267d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267409, "uuid": "d21e0cc8-632b-4c71-95b8-a28466965482", "value": "8d9c5a9ce7a94df0ce3d180c45c0b328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f6ebb6-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261748, "uuid": "f9be2e7e-8c1b-43ad-817a-43cb3264fe7d", "comment": "Malware payload (SnakeKeylogger)", "value": "233bbe7bfb1937bbaf1bfd95dd2c9d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261748, "uuid": "b4380d72-dabd-4ceb-9820-22c4d0490874", "comment": "Malware payload (SnakeKeylogger)", "value": "9720ae1fa35ab9d95c0a1bbedb6fcfe5d8af97365a5f8950ca328f6a60bf7a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261748, "uuid": "533a9e5b-81c2-4463-b4dd-33785cb7799f", "comment": "Malware payload (SnakeKeylogger)", "value": "ccde17eb5e7c155a6e79f2465f25e3037f54085d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261748, "uuid": "e1317373-d288-4eac-a16e-a6f35abceefe", "comment": "Malware payload (SnakeKeylogger)", "value": "555701d4b0eec41dc130de5acfe3d831d5b99c50d07c3e7db41719a20fb9e46548d9229d79ae0bc5014df46a142b074e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261748, "uuid": "f5c70782-e4c2-4f23-b06c-faabfe0009c7", "value": "T158D4D09C3250B2DFC91BCD76CA642D64EA20B4B7970BE243A45715EC990EADBCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261748, "uuid": "662a5bee-ca3e-4e10-8bd2-a1a65757606c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261748, "uuid": "818b69d8-3b73-4a70-b2c1-d0e07420ff11", "value": "12288:2egzMelsi1RST4bqc+wu2E7dR3Nor8z9i7+pvtCWtORD0CYefL:g31kT8qc+v2WdR3ir8zw6Rch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261748, "uuid": "d242baeb-c1d0-453d-af07-6d92357ab75a", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261748, "uuid": "67568d39-f330-400a-9d39-38cfc80940cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261748, "uuid": "9de53a58-a851-4cf1-8d3d-9078b27fea9a", "value": "orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8744df27-a222-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675250470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250470, "uuid": "5437a28b-84a1-45ab-9cf7-d609436fe88b", "comment": "Malware payload (AgentTesla)", "value": "cb24258d302a8aa186f84291d248c123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250470, "uuid": "105b6892-7240-4020-a731-28dd925e100b", "comment": "Malware payload (AgentTesla)", "value": "98b086595cf2d76a5aa7677c6e66fa49972630ad9adc81eb73079744d550e175", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250470, "uuid": "e23c8044-7e69-495b-a5a7-ce65e3bddf48", "comment": "Malware payload (AgentTesla)", "value": "dbee050d4cd139f80ac2bcdc38974eca20879cf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250470, "uuid": "954dde6f-ab6c-43c2-a45a-43950018ff6c", "comment": "Malware payload (AgentTesla)", "value": "327706a21f64add73e0829acd5498d3a8a3b6bb2d12dafbbcf64958ae3b9feb7ef7138b187870b4eb1e665c3da98e365", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250470, "uuid": "1feaa258-587f-4c36-879a-ef12d0686c02", "value": "T18382F8A842EC9323FF6E1BBD94B162C35BB2F6336901F65C784CB09919D234582A571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250470, "uuid": "dcaf3f5e-2213-40cd-89d9-da3d8b2ffdca", "value": "384:n2MZb/JZ4g3dX/jpZagmS3lSHok0NGHISSNZmfTQL3:2EwydLp/v5pGOycb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675250470, "uuid": "8a34aca6-9ebd-49c2-8304-5001e63510e7", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675250470, "uuid": "b4b8ed23-3e11-4961-9e70-d124a8648d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250470, "uuid": "5b6e7f02-8553-4e9f-9806-245b25db66a1", "value": "P O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43a04cd-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675262115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262115, "uuid": "c7318693-3807-4b3b-bc2c-8d1968373dbe", "comment": "Malware payload (RedLineStealer)", "value": "2ad01c4214a314aa503cbe66f4ba4915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262115, "uuid": "ae4115a8-91f0-478f-808c-f72790ee5b72", "comment": "Malware payload (RedLineStealer)", "value": "9904498c685dc1fa8a60b76b80aa748991e5dfb77227910ae8d4f15a27ed4eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262115, "uuid": "ab9306a2-dfd9-4311-8934-9abf6e6e28a0", "comment": "Malware payload (RedLineStealer)", "value": "6e8b9048d29259a5cac23fd6718e5cfe85d9d0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262115, "uuid": "e94951a9-4fa6-42e8-8b95-e864b7f14ddc", "comment": "Malware payload (RedLineStealer)", "value": "9752a4df38074ee4c048fc5c37e335578a225820e9e79745e537693858940f5a6a30aa8b0ad1e16f56f59c99cc54544a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262115, "uuid": "06e82e33-49a8-4726-8ce3-dbc7b253d38a", "value": "T15074F13238D0F872C26784705930EAD5AB6EF9321879995B779C07AD9F701E2B23534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262115, "uuid": "eeff7c3e-d170-41b0-b6c8-49194a47dea4", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262115, "uuid": "160dfa8d-608a-4fdd-92c8-42edf39885e9", "value": "6144:VScFQrnJLiVjhf8BS8OYiFarAe7hLJmOJp3RQMTkSihwT5g:VSGUJWVjp8BSXhOLxJphvNYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262115, "uuid": "c5636b5b-df22-49f7-90eb-b6e09b96acca", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262115, "uuid": "76e8f2c2-f180-4d43-a246-9ac3809ff1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262115, "uuid": "a2a95247-4ddd-4d28-b9db-b82596d4b035", "value": "2ad01c4214a314aa503cbe66f4ba4915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb36e07-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675239424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239424, "uuid": "f5cccdfa-62ee-48ed-9535-e0ca0046cab6", "comment": "Malware payload (Formbook)", "value": "964e022ce06a93b90688c443f2e5206a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239424, "uuid": "e4b21faf-8820-4444-872a-93a50b198822", "comment": "Malware payload (Formbook)", "value": "9930b550d3a4ad60d78f4aefda8ce51ecf36369d170be8feba6a30b57b7893f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239424, "uuid": "c30689d4-ed77-4651-bb02-05b9d226a68d", "comment": "Malware payload (Formbook)", "value": "5865d28ff881231f017d73ce877616f1e39f8c8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239424, "uuid": "08a90fdd-824e-40b7-950c-69a7bda715c2", "comment": "Malware payload (Formbook)", "value": "0a4622db7051a8f2627ddda855ace9f319b04b7f0b767ba86d05f5b04fad050377ae338aba3c9e0bdb5b6aecdb7af9d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239424, "uuid": "46146da2-9f5c-4143-a53b-2032f1eb2b95", "value": "T1A98209A842DCD323FFAE1BBD94B162C35BB2B6376401F65C788CB099199634581A471F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239424, "uuid": "a6dc1bfd-da8c-4608-b323-8f2cf1307857", "value": "384:v2SZbh5Z4gBdXNjXOVwDS3l/Hok0NGHISSNk+TQLf:esgkd5XVe2pG+cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239424, "uuid": "4d2301eb-3929-41f8-accd-538a9eb75958", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239424, "uuid": "a8a0855f-86a0-42df-95cc-acbcc28a54c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239424, "uuid": "e7e438c6-e352-4d58-b661-dec0e74deedd", "value": "Ordine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c6d495-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675234173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234173, "uuid": "df9e24bb-954f-4da4-9ec7-f9d7150e3bd8", "comment": "Malware payload (Vidar)", "value": "aa1fafc03b0578979f5f0660e8266cab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234173, "uuid": "f1bc9087-01cc-4f79-9bdd-b78228dac2cd", "comment": "Malware payload (Vidar)", "value": "99481f540a11c13b1e960815d8a0e7d26cac8953c98e4f2d3b76e0acb61c6fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234173, "uuid": "20b16401-2df5-4fa4-b299-2159be71ccdb", "comment": "Malware payload (Vidar)", "value": "2219a5f7cbfb0521d429faf77eabdeb58a26d041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234173, "uuid": "d4b1b398-d8ce-4497-986a-07058c7ed977", "comment": "Malware payload (Vidar)", "value": "388addfab7a5b40f74bbb860e456c10bb7b024d42265f76352814aa910ec00c557eb92f805a3dd5ff23cbc9e9ff66731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234173, "uuid": "bcbabaf0-49a0-4f1c-9f89-b074f8541710", "value": "T1AAB508B02B4B19DFD7560ABCD4874F52DF142274D3245980CCE5783AEAE7E273D8A928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234173, "uuid": "8d19840b-3a98-49e2-9e72-4c66c9283a7f", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234173, "uuid": "1c79e44f-a860-4d48-98c2-acbbf1ce4bcc", "value": "24576:JP2Nr/ox3EmOgBRWoIy1MIWHOq8aDCc5Orzb06Y51fdJFP9XJ2VyGbYJc6IU2rew:JP2NDox3nLMIOOq8aOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234173, "uuid": "7d87b4d5-2775-4ec8-95d3-eef7be262858", "value": 2441232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234173, "uuid": "41b8770d-48d4-49b5-a9e8-8eb412c76af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234173, "uuid": "67c7c045-2800-404a-bdff-9657b2d56dba", "value": "MicrosoftOfficeCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbfda75-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675267633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267633, "uuid": "20a6127a-e525-49b4-a5f5-6b8743cb4cb4", "comment": "Malware payload (RemcosRAT)", "value": "e247bcb666351b5b246c58d9e4137a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267633, "uuid": "1ba362db-a485-4b2d-bf76-6710975ca2d9", "comment": "Malware payload (RemcosRAT)", "value": "9952b6faf8f8cba0b3e303a0aafc05928174565eadc070ff4874db0e02820658", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267633, "uuid": "b17fce8f-3fbf-49a0-bb70-e718d2400410", "comment": "Malware payload (RemcosRAT)", "value": "2d9a1c315e746d0bc4a6d44f10b51415a2decd12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267633, "uuid": "31850b5c-8c9c-4cf5-bd04-421844267465", "comment": "Malware payload (RemcosRAT)", "value": "8aa87ad1461dd71c3236a0d6fb02da3e0014d7d7f2bdd0779b56dde0718cf8de5c0ebf72f4eec9515880f189aa85feff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267633, "uuid": "fe910902-cd9a-4218-a1e5-327ddf160717", "value": "T19F358C4137B19472F1DB05B91128768C2E3D7403A6E6E2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267633, "uuid": "5ed7e108-7199-4e54-8bd4-5e02ee196d30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267633, "uuid": "0b0b0f1b-6175-4d73-b924-4e85caa81c3b", "value": "24576:geqassUeD9lNq6PYytOOaVZ/y0hr8zw6R7c4N34kl:gUsbmlNF/RC/Jhr8zPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267633, "uuid": "e7015de9-9eb0-4dad-bff7-4ac430f20c76", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267633, "uuid": "88b327c0-405f-45ce-8b40-ae71a81c5255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267633, "uuid": "118e35ab-5b1a-4522-97ac-3dc22e608b28", "value": "e247bcb666351b5b246c58d9e4137a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5792ba-a223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675251017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251017, "uuid": "db7c22c6-080a-4bc5-bda9-39c97102472d", "comment": "Malware payload (Smoke Loader)", "value": "7d7546fa9990704b0eb29455c2207fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251017, "uuid": "5049441a-2e58-4d57-bd53-4bd7af32b7dd", "comment": "Malware payload (Smoke Loader)", "value": "998e8fb48c8ff4fcb679958d1f8162fe18dc8fb5a3782177224be57579670213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251017, "uuid": "7658e392-246a-41ae-a33c-e3ca24686af9", "comment": "Malware payload (Smoke Loader)", "value": "a679faef9f82c1c6c2c056d6f7ec45b83d779c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251017, "uuid": "7bed2ff1-84fb-401d-b480-2edc69802b21", "comment": "Malware payload (Smoke Loader)", "value": "8f7c4914eb8a2553496e09b3689cc5c3cb7544b81f913dd6699d009661d3b9e2420d628078b2e29dcd4c99b01c326c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251017, "uuid": "59d04887-700e-42a8-b631-24c629f1ee9f", "value": "T10F34DF3335D0C032C5A650F04870DA95BBBEA9312975594F7BA81F7E6F722D1263A3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251017, "uuid": "9a13f0ff-659f-43be-b55c-491448ce9f56", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251017, "uuid": "039e1c78-1fc9-41ff-b48e-f27cf38b0cc3", "value": "3072:6S5GuRLVhHdjLTLX/W0y5gquOqwttlUnZg29IcxZ4lU/41+0lef2+:6S5bh9jnLX/lhERtliZgydA1VW2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251017, "uuid": "885e9a25-593d-41ab-9a77-c60185c1db33", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251017, "uuid": "23d12ed0-404b-4ee6-a38f-96d42c5ad0e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251017, "uuid": "6e654b0e-910f-4d97-8c4f-b2e25928925c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ce44d6-a258-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675273824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273824, "uuid": "895fd88c-b963-49c0-b8c8-2b70a8751839", "comment": "Malware payload (DCRat)", "value": "7472b67b4bb85e3aefc12555fec10f36", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273824, "uuid": "db390546-6b5f-4bf5-ba7f-4066ed9ef6d2", "comment": "Malware payload (DCRat)", "value": "9a15e76ca3d8fe65e5bb57588b186b6ba8602509c0b4c8d18955dfc73b7c2e36", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273824, "uuid": "0c22fb91-7768-4ca6-97e2-e7e6cb600844", "comment": "Malware payload (DCRat)", "value": "e7730285a02fe26e27ea752a84306c4229e8e623", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273824, "uuid": "69b9784f-81d2-4b29-8a9e-22e6e8233881", "comment": "Malware payload (DCRat)", "value": "1361df6153d3b75876e9c75caae5a580bf62a6af1309f531fc420dda587a81c35623e08fdb3bd94263ab3f9261bc41da", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273824, "uuid": "70b92289-dac4-43e8-8a40-0e3870a5aa60", "value": "T1B66539027E46DD12C0295A37C9EF952407BCBD047B26DB1EBA9F735D6412BA24D0E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273824, "uuid": "394d3375-6379-4892-a814-50358f03ea7f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273824, "uuid": "68c42f32-42ed-49fc-a0ca-229d36d47a8c", "value": "24576:U2G/nvxW3Ww0t5OX6SP7prgJDBT5HHcwsQMghdR/O483h4vAe+4R:UbA30CdeDBT5cbQhnbku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675273824, "uuid": "4513f90e-33a5-4ead-b4f8-75af8cc7eb73", "value": 1432303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675273824, "uuid": "3b79b353-f9cb-48d9-b96e-825b251bcce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273824, "uuid": "ac0ee486-1852-4629-881c-8314ffe82f39", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-9a15e76ca3d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd3bd8d-a25b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675275012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275012, "uuid": "92f50498-8fc7-4554-ab52-9d0f29a1e423", "comment": "Malware payload (Quakbot)", "value": "9fa5e6b517de3ee9638eb519613a96fd", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275012, "uuid": "53ef7150-dd5e-4ff1-bc8d-8f1adabf21b6", "comment": "Malware payload (Quakbot)", "value": "9a279204e8f5e0a00753801d8568aeb12b44f9e5adbbc9af0b32f65d087b9253", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275012, "uuid": "997fc3ff-8ccd-4a65-ac8b-a3ac376d9633", "comment": "Malware payload (Quakbot)", "value": "0108deb6da190c630d155a1e18b606e8a896b7ac", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275012, "uuid": "e9a0acb4-759b-425c-b4e4-74900b2dfd37", "comment": "Malware payload (Quakbot)", "value": "576a5ec0add806233bb69e0bbe82f7ca8a6ab73c5100e15b9d03db85107997aa82cfe13c7c60af4c47d800d1f129b85b", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275012, "uuid": "7e8f5562-4f32-4a51-b3a5-fc2e7d732eb8", "value": "T1E804E11266F545E5EEE07BB24DE3971DAA2BBE27E212035F4BB6666D8D60300DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275012, "uuid": "50c23389-72b7-49f3-b14e-910c8917524b", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1asyuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCC3:Ia9xytedL1/g4iERBAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275012, "uuid": "ef4c8a78-d13e-4b97-81d7-af38fe85ec5e", "value": 181416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275012, "uuid": "648244f2-8ab7-42de-aa84-4726572d2850", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275012, "uuid": "1693f967-be26-4f0e-a765-8e1e39ed9aa9", "value": "ComplaintCopy_14729(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deba2a7-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675279982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279982, "uuid": "784cd1d5-d9c2-43a1-ae83-7ad9e175d5bb", "comment": "Malware payload (RedLineStealer)", "value": "46c61ea4869e89e690b9860fc6c76ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279982, "uuid": "f96a6cf6-52bf-4a71-9da5-0ab8d052b6c3", "comment": "Malware payload (RedLineStealer)", "value": "9a37f3c0878238fafdfcfa0bded56819ce029cadfbf110f843bac7e516763a6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279982, "uuid": "5d050671-1a92-4b02-b426-f8c9e5156612", "comment": "Malware payload (RedLineStealer)", "value": "b46bef0d01ec99e483af669806094143c94206b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279982, "uuid": "0066b2bb-68dc-49aa-b00b-401200b421d2", "comment": "Malware payload (RedLineStealer)", "value": "32b315e4967d9c0a6b52cb277385360f93087e5f3c6d3570e307fc16f77d06a5c51e2331f8cf4951a5c68764d3982f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279982, "uuid": "9d642b35-33c8-4b4b-a58d-ce890488a8f6", "value": "T1DB74012279D0C032C5A75474D820EB56ABEDA8F155795A1B37881BFEAFF02D1223734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279982, "uuid": "5faca882-86cd-4c9a-a202-09b9cd96dd27", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279982, "uuid": "077d2f48-2cd0-4355-b4c5-640f73730c70", "value": "6144:Lj01LLX0yR1+Toi+AcgodTE/gGfh+OnAsBFF7UZLb6l7/k:Lj0dD0yTIoqcgFdLn5BFQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279982, "uuid": "01722f8b-656c-4480-a4c5-eca8569ac9f6", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279982, "uuid": "7219e843-4383-4d51-8372-64077e25f71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279982, "uuid": "b77cfaa0-37e5-4288-b4a5-f716f1a6bcd7", "value": "46c61ea4869e89e690b9860fc6c76ee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc62a46-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675267342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267342, "uuid": "75a16fe6-499e-4b03-b898-1c0c77910921", "comment": "Malware payload (PureCrypter)", "value": "d5ee5d589045a6f3c03faacd54224cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267342, "uuid": "293c848b-f849-4bb2-aeaa-b1bee894a0d0", "comment": "Malware payload (PureCrypter)", "value": "9a49d80b98a62d67e13af6f4daf7c16062703b4d15ab0351da9abae21614c441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267342, "uuid": "25b7a805-fe32-40c3-9a0c-12ec56e0a75e", "comment": "Malware payload (PureCrypter)", "value": "11655170b4c96fa49ea4f1012de790517eb8a8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267342, "uuid": "676bc3da-4942-4fc7-8621-b559342243d2", "comment": "Malware payload (PureCrypter)", "value": "854b7eb1abf061f9feaeba3abbc2703d6b67077ccaeaa6ea0da42e0d21b72a1e64f3c88ccf4211bddcf4b574cacf62df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267342, "uuid": "ff1f5dd1-ec9f-4b10-ab57-b0c6a75c0bca", "value": "T109E5CF25229C91C9D17AD03DC9864AABE7B57C428374D7CB05A0BDA92F336F56E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267342, "uuid": "4ecbf050-4f32-4b15-b258-f7731f3aa535", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267342, "uuid": "255b61f7-202d-415a-85a9-ec8440021669", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8la/VdPiE7pun:Vv08Ro21Buk5/xgX1s2eXF4lzFUJDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267342, "uuid": "45b40d75-59ac-4d5d-b9af-c28fc30fe32d", "value": 3105706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267342, "uuid": "649a0b85-bdc1-40d4-8bd6-5b8f89dfa253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267342, "uuid": "86fd48b7-9332-49d1-8a2a-8c3fc3221ba2", "value": "d5ee5d589045a6f3c03faacd54224cb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aac2dd-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675263731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263731, "uuid": "5dff2457-c986-4890-ad32-5b67bb50d8f6", "comment": "Malware payload (NanoCore)", "value": "342550e9ccd167df75606545a53e9b0a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263731, "uuid": "392e2ba8-0d67-4654-8820-3fff8e9bfae1", "comment": "Malware payload (NanoCore)", "value": "9ab75f3c60adc58693a916cac8ec6dbe53f32d5355ab5db8587693c0426be40b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263731, "uuid": "a766ce7b-ad54-4072-80ee-050fb0aee589", "comment": "Malware payload (NanoCore)", "value": "30f28411b298aeda401364af8f27f164d634a567", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263731, "uuid": "89567a90-2112-4912-be27-611a9ad2323b", "comment": "Malware payload (NanoCore)", "value": "ae1420596b8eda8ae14c06c87a06503d412f9830cee739c5e62e749d28168365da6b24dae4faf0f6aaab6b5997bc8699", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263731, "uuid": "64287caa-ffd6-42f1-bbc7-3677530b441f", "value": "T13DE4BFB876047DD62A7F576BDA96ADD803B62B238ACBA4CD806477C30563375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263731, "uuid": "caba118a-7ae5-4ad0-afac-2649ddd433ed", "value": "12288:IK33yN0sc7FqjxRdCgaW6rMgsy7Q20LlUHnql7zaimJfl3Rcbws3wlELpMG:IR0sca57acRr2olO9blhcbwDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263731, "uuid": "1a460fb8-ed69-4d88-8bc0-863212a17a8e", "value": 715212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263731, "uuid": "ba49137a-9684-43c5-9f53-325d9e972789", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263731, "uuid": "0e6f4e4c-5c7d-4f42-a809-a84bdf8e54fa", "value": "Quote No 2118013.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e275a2a-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675266587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266587, "uuid": "c61afc0b-40af-486e-81c9-7646b8defea3", "comment": "Malware payload", "value": "ee8926413fc737f40b88345a4f682e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266587, "uuid": "d541d7d7-dea7-481a-80ad-7265e8dc594d", "comment": "Malware payload", "value": "9aba685a9b5b3898b172d31ed527f4b37c87dd2f29283d3258c366232ab19ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266587, "uuid": "194d19e7-8bf2-4ceb-b286-0320cef66691", "comment": "Malware payload", "value": "58eec417bebbe284e9ce56d7ec482a83936ae3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266587, "uuid": "fe37feed-55bb-4b6e-a943-494c9975d59e", "comment": "Malware payload", "value": "c5a6722af79a5fc1c11c8fab4382933644c99fd32590c54783d84068360b130ce58d1bf692f373abaca10225f86d9437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266587, "uuid": "3b5430c1-dd39-45dd-ab1d-182016e7b7e0", "value": "T1C6655A11B44C9862C7130E21BE98F67DF1AC526403E944FF53A79E107E67983B628E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266587, "uuid": "3ca9b284-434d-45a7-bf3f-1664bd63f724", "value": "24576:WqgEtqB1yCHD3AIsiNFIN6KYvuWQjiXMWIIOMt8dQIZT1i+wtr+Kz3+ULkNhI:ZgfYCj3AI5NFMIuxuMWIdMtiZZi/r+K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266587, "uuid": "c0b73901-5897-47ba-9692-5b72f2d9064e", "value": 1431743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266587, "uuid": "ea76aec1-0028-46a5-a8cb-9a33599394cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266587, "uuid": "f0cbfe01-e499-469d-b370-7165440dc5a7", "value": "ee8926413fc737f40b88345a4f682e62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b7762d-a223-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675251084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251084, "uuid": "958b96de-2294-4bb7-a468-204695a32470", "comment": "Malware payload (GCleaner)", "value": "50dd339023690d0ea443150bcff28fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251084, "uuid": "7e42b70a-7521-4ebf-9215-2b71ec41d67b", "comment": "Malware payload (GCleaner)", "value": "9b00928725abe12e81dabe7abc63afb64568a161dc0399c4cd92c5f8fbcfd1dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251084, "uuid": "b4cfe1f9-a682-4e2f-9350-a2444fe4f990", "comment": "Malware payload (GCleaner)", "value": "177469965b969ed5302d73d9f305cdac1e626997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251084, "uuid": "2798b980-1106-4f78-ae7b-b08bacec4dc0", "comment": "Malware payload (GCleaner)", "value": "f48975d9a61bdc6a94e697a6cc6588c0fe5e1cc998ae08117630758a6067b9f3a6d00a0d7b1eda02cae8476c95169d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251084, "uuid": "756c49fd-2618-4554-b87d-d27036d34906", "value": "T17DA5331532A9D932D5C197F89F70E2266D7BFD823979892254EE7D4B3B7A3C22C0C241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251084, "uuid": "8a00af3b-f100-4dc7-a487-f9283012010e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251084, "uuid": "8e34635f-0d6d-49b5-be3f-9f08e806c69e", "value": "49152:icPLnQB5MYqL+GP6/IRk5DHRiIj0IqE39M0cs+JWDh0T/1sU+jx3ROwLCgv2MR:XPLnQrbqiGCICbj449lxthIts/hOYv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251084, "uuid": "7f36efbd-9bb2-4864-ad73-94cde8c3cc78", "value": 2234537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251084, "uuid": "c48cf2da-0280-4504-92b6-5926df2bc2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251084, "uuid": "e2326ca6-2878-44d5-afc0-fac7f8ae333a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce70851d-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1675279365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279365, "uuid": "e3cc9497-9bae-40e4-a913-d7b530a19908", "comment": "Malware payload (ModiLoader)", "value": "47034c5d682f1221b95f172c5731393d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279365, "uuid": "3e9109e8-0fd1-424d-b4e5-804401861fa2", "comment": "Malware payload (ModiLoader)", "value": "9b7289ad08319ae1f731f988d955b06206b64cc7864f9af457a9fa0049a9021c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279365, "uuid": "30c672d9-16e4-49b4-bc93-4e52f276bcab", "comment": "Malware payload (ModiLoader)", "value": "cccefd7cbed8e64120f226912dc176a031e013fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279365, "uuid": "199c6a5b-17f9-4790-9ba9-2b68d02ccd8a", "comment": "Malware payload (ModiLoader)", "value": "0e72224a7fbff4bbc6159abe728d40167f5362b4873375e776bb16902812b614d92dfc1d3f71413fef6f8d33e3551c0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279365, "uuid": "7fe6ce64-b793-40c1-98a7-a868442c0ddf", "value": "T1FEE49E23A6B04577F22F6F34AC0B874D947CBE106E3854466BE539DC9A3F643642A1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279365, "uuid": "19c91a64-b821-4272-840f-5addcc9a73b5", "value": "902855fe7c3eaf97ed4a4bb759348c1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279365, "uuid": "2deb014b-1857-46c9-89e7-0ddf120e4d17", "value": "12288:Jsj4i6YhHiKdjV2SICdthJYgmBeVbPBdxQ7zPZ+mLJtzR300000000000000000R:akKHiK5UXCd1zmMP7IBnzR300000000e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279365, "uuid": "a3d55aa8-0d9a-42dd-9017-4870e1b7094f", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279365, "uuid": "ff49b14f-791d-43af-a8ac-1d59c2da8f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279365, "uuid": "8aef957b-1a75-4c97-b2cf-1b2a33dcefda", "value": "47034c5d682f1221b95f172c5731393d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52868355-a22b-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675254247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254247, "uuid": "66ebd27b-ab20-4eac-bcb9-49c56d7baa77", "comment": "Malware payload (zgRAT)", "value": "d840a2c72a512dd1216b6a9d55064bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254247, "uuid": "cfaa56c3-ccd1-46fa-bb6e-4214db175b2f", "comment": "Malware payload (zgRAT)", "value": "9b7c71c299faeabcbe450a3a14da0579db63dcb86be807c1ab47389205048712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254247, "uuid": "f5c87ba0-feb4-4db4-bb8d-e1ffc7ba41a1", "comment": "Malware payload (zgRAT)", "value": "92d6ab58ac492ed6a5819663c729678d37c4a16b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254247, "uuid": "2c8a0f48-638b-43e7-ab98-2c72166639e4", "comment": "Malware payload (zgRAT)", "value": "c3c8588f4ff6cc287e2196adf6b66451a873f38d8d4cdf20adc18685a1aa33dbf2ed7f97ba9f3feb8d83d95f4bf5dde4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254247, "uuid": "4d21123f-f0a6-4c93-b134-c1e5452d2f84", "value": "T1F1060ECD725071DEC513C576DA641D28E7A0A666430F9223D05B13EBAE0EBABDF580F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254247, "uuid": "392e760d-5976-4e30-9a45-6d97592194bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254247, "uuid": "b2eb8fa1-119a-40de-9dd4-83485b66dd1a", "value": "24576:5zD5WoDpbTNjS0kfrdX77+p4N+WaB0+X0smhKpcE0RMfAGea1713LBpN8Xw/d:HWX77+PV0bsoKpcE0VGean3LRSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254247, "uuid": "2b9367b9-acd7-49a5-85c9-3b3f7416bb2f", "value": 3938816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254247, "uuid": "8e80d01b-dd4d-4b93-ba55-a99da5649827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254247, "uuid": "efe65ee8-8911-4830-8c7d-263eb49079d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3457e192-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238734, "uuid": "cd5d01fd-2c09-4f8d-acd4-d1d0928b3524", "comment": "Malware payload (Gafgyt)", "value": "1f524fc9939826b3a8d4e761de060b78", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238734, "uuid": "76ad6e6f-4269-41af-8f98-02e3b7ad3441", "comment": "Malware payload (Gafgyt)", "value": "9bba5b1318e5895a1d09a3f2950f3db98213cfe77a50e01b28731f04b0d272ea", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238734, "uuid": "ace1afeb-b9e5-43a9-bdce-22e871a7f138", "comment": "Malware payload (Gafgyt)", "value": "ab0cb1ec974a19de1a769ee011be0f3576ce6646", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238734, "uuid": "3d3934bd-4ac1-4bcd-9240-0764e73558cd", "comment": "Malware payload (Gafgyt)", "value": "d0b051055154fad5e38cd82412e6dfcc07ce0aa6c10880aef9d8c8d825c4f2f869a4848f9f71875a5f97f790d92a375f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238734, "uuid": "2ff3a9d8-3f9e-4171-8191-515cdd318c8a", "value": "T178836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238734, "uuid": "e3c0deba-add9-40ba-8f56-93f5d532248d", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3X9uWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4X9uDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238734, "uuid": "031810e2-901d-4c49-b554-313c540c6309", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238734, "uuid": "fea056ec-9083-446a-acaa-0aa779368e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238734, "uuid": "897ead1b-6ab4-46c6-a5cf-5d61314cf1ee", "value": "1f524fc9939826b3a8d4e761de060b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601dd3a5-a204-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675237519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237519, "uuid": "a1e788e1-5673-4956-94c0-fb2ce7c5c814", "comment": "Malware payload (GCleaner)", "value": "5af185d2f2e4961351c5985b8c739d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237519, "uuid": "3aee94e3-b005-4b27-98d0-4716977618dd", "comment": "Malware payload (GCleaner)", "value": "9c449d5bbece2878ff9ee106192569f524be42b7a8714a6e95edc891ea703afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237519, "uuid": "f5d3d6ae-77ea-4ada-9c77-c18cd621e08e", "comment": "Malware payload (GCleaner)", "value": "8752ef1730eae83bd00aca05e3df7cc9a3060a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675237519, "uuid": "233276c0-dfae-4212-acf5-b599d6b98e99", "comment": "Malware payload (GCleaner)", "value": "467dba9eac8a7cd69c3d45c407169577fd01dca776f320d325d50e530a416a7dfcbc2baf37016070305be82e7c06e113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237519, "uuid": "89f5141f-7911-4316-82c8-3041ecf12d09", "value": "T16DA5236A3BB45827F3C299749922D73053A15F86203DA24570DE3F1FBF7EA439D0864A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237519, "uuid": "1a59986f-0e78-43ec-a38a-f5cbb0d37607", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237519, "uuid": "a0c68219-6f75-4879-9d23-29421944d1c2", "value": "49152:icPLnQpsOjwdb3dlRY7+O2IoDeIbGPXzbeMLLtQd6DMREB8LCgv2MR:XPLnQmOjw13dlI8DPG7bVftQCMM8v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675237519, "uuid": "ae812103-f337-466a-a515-00b41713ab7a", "value": 2196721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675237519, "uuid": "aa88c786-a3fc-4592-a381-8ca803aec6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675237519, "uuid": "b7e9b9a8-445f-42cd-b051-7c22d9b41e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee020e0-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675233034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233034, "uuid": "5afc7204-85f8-496c-a6e8-b263fa07cd86", "comment": "Malware payload", "value": "96519d0cb0d107317ccf7e52cd98bc28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233034, "uuid": "f3178ca3-a3a5-433f-bc1c-da6dc441ce16", "comment": "Malware payload", "value": "9cf6fc5cc84ca04aec3985d3d5dc466aa3cab5d6943246e47704b06dea353cbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233034, "uuid": "bc9ec5b2-9a01-44b7-9a7e-639b34ad4e00", "comment": "Malware payload", "value": "30848c71521308ae8134e54377ad797c71169217", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233034, "uuid": "71ee8210-f7a7-487b-bc73-5163b6e1e237", "comment": "Malware payload", "value": "7b118ea205952a4ff90e96bb60f43b94d3349749425ce259ecd931c4b94bb22f8a9141d21ed09cd4b95b3588f77b06f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233034, "uuid": "7e249459-7f33-4cc2-adaf-01faf51789b4", "value": "T110C13553FF1441F6C08C0E7602BE221587BEA13C25ED908EDF9099252C999EAFE78645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233034, "uuid": "7fd87380-8a4b-4add-9b26-af5385e6219a", "value": "0ed11c14a2759c69bfa93dd64e1f1654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233034, "uuid": "29c4c16b-4803-49fb-84f4-6032249dae63", "value": "48:6amN5YVOy1VEvy/dw25M+e0WB+BDq9J5SzXH:Wy1VEvayP+GB+FqX5SzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233034, "uuid": "c2732bd4-0c49-4cd6-9fd4-685cf6153a7a", "value": 6145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233034, "uuid": "cf0fd5fe-943b-484b-bf46-d923dd8cbe9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233034, "uuid": "e1b64dae-ef46-4f09-a34a-86c22d4b0e3c", "value": "padorupadoru.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b444f52-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675263791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263791, "uuid": "f77d54d3-3d4d-4f6d-b3c3-e2d94ab9ae70", "comment": "Malware payload (SnakeKeylogger)", "value": "4dc734373225518d9df9076dda136ffd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263791, "uuid": "89aa0c8d-cf71-4070-87fd-ea06dbda013c", "comment": "Malware payload (SnakeKeylogger)", "value": "9d47088eb517b680f46b11ef4c5aafddb89ec18a4ff848811cb0b274a4da7a19", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263791, "uuid": "ac82ebcb-7da2-4a20-80fa-88cb64b05859", "comment": "Malware payload (SnakeKeylogger)", "value": "389b2d1a46aa90ed76b1494af3e16fef6d551a0e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263791, "uuid": "19ea5f7f-ff8b-4acd-b972-9688b0f6a6ae", "comment": "Malware payload (SnakeKeylogger)", "value": "6150ec93d7a9389baac9be8c036161620f6db3bdb719502b1e7372701b102a6126aa9cf5b8608cfa7086d130b59d7c87", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263791, "uuid": "7c4858e2-3908-40b0-8b36-eaa77a478d01", "value": "T16484BF437934EF57DAA1C370AFF3898467477F603A2275AA25027B0F5E323C4668B609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263791, "uuid": "f48dd562-f29b-4373-a282-e73428169144", "value": "6144:haFJkKXiDU7woTZ+RwPONXoRjDhIcp0fDlavx+W26nA4OSYsnhkSjMK8FdB2JJR3:haFiKXKkBDrkQhFiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263791, "uuid": "50585f40-4d48-4d19-b478-de111892ed11", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263791, "uuid": "b2f0638b-e8c2-4b6f-bf8b-018a8d52dbb4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263791, "uuid": "17e10028-a88d-4d61-9efd-35719209e588", "value": "SOA JAN.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fa947d-a262-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675277953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277953, "uuid": "a8487c90-7325-4103-8401-b8a086db6e59", "comment": "Malware payload (Quakbot)", "value": "339568452c0cfbf03d0167ffe44cd716", "object_relation": "md5", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277953, "uuid": "8daf5f1f-3522-4ce1-859f-fd0b0c455c87", "comment": "Malware payload (Quakbot)", "value": "9d6cb3b193447e11b2e309b249d07cf3f82a677812e478cec39e2d996d2e8944", "object_relation": "sha256", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277953, "uuid": "cd6e5361-a109-4240-a660-78bf68bf5271", "comment": "Malware payload (Quakbot)", "value": "ec93ca66b2d49c233402905deedf92f05b30037b", "object_relation": "sha1", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277953, "uuid": "d85b6e09-6d32-4900-90b2-c0eaa151472c", "comment": "Malware payload (Quakbot)", "value": "bc06d6aa3cac9211b414b06a5955ff374466e2b30419c858cb4b59fbad9fc05b702b7292a1e654e5e3f9a5f43e72c79e", "object_relation": "sha3-384", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277953, "uuid": "7e024d4d-4711-4185-ba5a-654bda9dcc88", "value": "T18B04E11266F545E5EFE07BB24DA3971DAA2BBE27E212035F4BB56A2D4D64300DC04B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277953, "uuid": "9f840686-d32b-40dc-99b7-38d7bf1f4521", "value": "3072:haA0YRw9/WITtTWR7IbNzvL1aEHuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCC6:Ba9xytedL1jr4iERByy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675277953, "uuid": "87b4063e-3751-422f-b202-a808bf3ae700", "value": 181434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675277953, "uuid": "7f94c693-dca9-4c5f-8227-07f66842ad9c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277953, "uuid": "467f2be5-d185-4d07-bebe-f757e4bf38fe", "value": "ComplaintCopy_69822(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b9818-a1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675224708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224708, "uuid": "dacf3409-6a9d-49ab-b025-35dda05f4353", "comment": "Malware payload (Formbook)", "value": "ad4ffe7e9fc7e819cd483b5ea2e0513b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224708, "uuid": "1a900ddc-9442-4a3a-90b7-9f9fd1a7a5f4", "comment": "Malware payload (Formbook)", "value": "9d6e3e7c289c554340dbbe1d6d6962c0f516325ec801e841814c676a936e9fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224708, "uuid": "79a4566b-6b14-4a65-bc91-0876e8cc84e2", "comment": "Malware payload (Formbook)", "value": "eb22cc636eb30f4719390e90b27a6c8dbdf4c22a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224708, "uuid": "be0cdafe-12ff-4e9f-ba35-66ab916abeb9", "comment": "Malware payload (Formbook)", "value": "07fe14f521aeab5d387b27f222c0f1b2b7388ea8cdc34c27f618408215503f0f02a1d99ff89fb58c4d1dc07f21202b03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224708, "uuid": "c42da359-7599-4dab-84b9-5f890e9549e7", "value": "T19D740285F564C4B6F8EA0D33BD6FDC102716AD216A952E4E33D8738E78F34534219663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224708, "uuid": "4ccdb64b-89b0-42c7-b73e-fc46d0eb5f2b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224708, "uuid": "390dd492-aad4-4037-a62d-7e027623194a", "value": "6144:HYa6I3Pc/eE8VKdS1ZaBAkeX/PwTn44XfKn4FAz:HY20GE8VKdMFkePPAk4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224708, "uuid": "e969d787-1d90-424a-9c86-5bc9ad9e01e0", "value": 346943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224708, "uuid": "2ff9c7af-225d-4093-aed4-c6907a008592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224708, "uuid": "127697a7-9118-428a-930c-847c522ccefd", "value": "ad4ffe7e9fc7e819cd483b5ea2e0513b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ba5d37-a27d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675289387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289387, "uuid": "8126cbd4-c635-4e62-982c-0ba173265d25", "comment": "Malware payload", "value": "f250d93ea7ea7f0b48af1619b5005d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289387, "uuid": "9b771995-515d-49d1-8b08-ba3fb921c1ad", "comment": "Malware payload", "value": "9da8029e501dec598722b00c36d5dd843ce52412ac2c27ef9227892979d22df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289387, "uuid": "09097348-f1e6-41ff-a5fd-377e7613a68d", "comment": "Malware payload", "value": "176c279d693f671542445982a5825a46f6a7030a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289387, "uuid": "d1aded3c-5d95-4020-99e2-37342cc264a9", "comment": "Malware payload", "value": "1b54a34a92372ae774aa5349d2c74a3da9428a368846b69e1d1b815821a77b830fca029950f5695eb84c027d1d246d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289387, "uuid": "32378a5a-c308-4c33-ba03-dfadfc2dc22b", "value": "T1BF34CF227590C073C46A54305C20E6997BAEF5314A7D985BFBA81BAD9F306F0673B387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289387, "uuid": "a1acd5bf-d7a0-478a-a655-69d0f6d52925", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289387, "uuid": "88df5ead-e7cc-48da-9d09-2ee7e11a9c1f", "value": "3072:I7Py6QIY86K4LqSWVl8Vr5iUVxGfppQVldyq8ns/dO9dSU6Nl4YrHbPi:UPcRtLqSYl8e7Q3Ws/dO9ET1bPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675289387, "uuid": "09fd62d7-bf7d-4a93-b54e-6c1acf54abf4", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675289387, "uuid": "58a31e60-46df-4baa-8ef5-c87fabba444f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289387, "uuid": "134f4c01-2212-4387-8e39-49c622121dd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba27707-a202-11ed-88f6-42010a9c006e", "comment": "Malware payload (GodFather)", "timestamp": 1675236733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236733, "uuid": "21d33868-b0bf-4ec0-abab-ddd1fcd608bd", "comment": "Malware payload (GodFather)", "value": "735ede5f45394a36d3a44c9eba738925", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236733, "uuid": "c43aa735-e5c3-47c0-8a3e-c319bdbd578c", "comment": "Malware payload (GodFather)", "value": "9dfb5b4ad9aac36c2d7fbb93f8668faa819cb0df16f4a55d00f1cdda89c9a6d2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236733, "uuid": "5dacb9e3-4af6-4ad3-ab3f-dd01e8dc012c", "comment": "Malware payload (GodFather)", "value": "3d74ce909e34f4e995363e0f079666de17f51d30", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236733, "uuid": "0e5767c4-33ae-4af0-923d-41dd2ae22f11", "comment": "Malware payload (GodFather)", "value": "dc55891905fae26a27219b8d1d47e13d8f148cdd03ad3bb35aa862c92d218056a54c15ee2b1246e54850dc7d12bbd71c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236733, "uuid": "eb9c1619-6854-4b17-8b7e-dbe51a6c330b", "value": "T142C63396E78AE96FEDF783325B79029A19066C95C783D3578950B23C0DFB5C44E80EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236733, "uuid": "b9765382-1583-48d7-b608-f5e630a5c027", "value": "196608:vNQ+EyaHv2Dl1bbi/49K6MoJzMHWjffv7dbDflUlCTcDBj2o8kLdvb:v4DHv2vfe04HafXRDfilCTcDBj2ZkLFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236733, "uuid": "32c73cb7-6773-4229-803b-1df9e96eaff2", "value": 12008461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236733, "uuid": "d74890aa-c62e-4d0b-912e-d5a31507dd4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236733, "uuid": "992ca70f-9d40-468e-a7ab-cba616c98fcc", "value": "2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d6014e-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675257420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257420, "uuid": "7b6bf043-966f-4fd7-ae1f-9310fcaed33c", "comment": "Malware payload (GCleaner)", "value": "cad029777fef3d7957a55990aab0e7e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257420, "uuid": "42455d25-a263-4547-94e8-7a43e8ddd6d4", "comment": "Malware payload (GCleaner)", "value": "9f484b215311ba5c090332654cadb00929da7c39e06cda9b6faa7ee1c3c99221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257420, "uuid": "7f8f12cd-fbbe-438f-8289-7861a0c73c9f", "comment": "Malware payload (GCleaner)", "value": "19f5e8b4a6cd5cc66ee6fb9e7bd9b18cadf582da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257420, "uuid": "5f17d413-23be-41e7-85db-675ce8a0e824", "comment": "Malware payload (GCleaner)", "value": "73c27088499d7198ae9469d51638c9c5e7e3812bf98ca8ec942cdc2a5a1598eb50365b36feb988545f1d3a1db98f2ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257420, "uuid": "f9d42fb9-ffe9-47b9-b726-0f3c30d85131", "value": "T155A533072D9E5A32D1A25EBC7911D1316E779F16283E8601F9E97E0B3E3D6C3380D6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257420, "uuid": "78c39d73-5b62-4881-8c67-aa2e6bea74f1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257420, "uuid": "b841490a-9a5e-45c4-bdfc-e366d480d121", "value": "49152:icPLnQDtfb4gr955j2oJmKD98B5jsHxakh2ewmOoLCgv2MR:XPLnQhfb4ml1PDeBC2ewmOgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257420, "uuid": "9ec56d4f-31d4-4756-b731-18188ef8ab02", "value": 2247302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257420, "uuid": "5dc84633-1424-4ca5-8adf-39c977f4f49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257420, "uuid": "e0996220-8370-4dd5-a978-d022596e1d16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc06715-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261835, "uuid": "7dae40a1-7d9f-4c5d-860c-fc6e59b00aa2", "comment": "Malware payload (SnakeKeylogger)", "value": "bc69d9c6762c4c5ba7abd45a25c496b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261835, "uuid": "07aad5bd-fb87-4137-9d3e-b58298ddc45f", "comment": "Malware payload (SnakeKeylogger)", "value": "9f9096376f087124c53578505bbe2463ad769f6205014711b9fe6e2c6c5f7971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261835, "uuid": "123f005b-c4e1-46a8-bdf4-a38d678e3421", "comment": "Malware payload (SnakeKeylogger)", "value": "193bb86dae9ec4784f810b09bf4c963b5ce5ac21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261835, "uuid": "30d81444-ef93-4a00-b051-f13ede7ae2c3", "comment": "Malware payload (SnakeKeylogger)", "value": "f208eb5bd3ddc313c67c6cc378cd4dd73838bf79999c0479df9af3291763091ec0817db9c0f9eabc34b2f2fb77005ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261835, "uuid": "6edd761a-8c70-4e49-bfa6-67b8827db4d3", "value": "T106B402808D9021A6C57E4F71D2F085BD7B417112AAB1B0BB010DFDAADE919C1FC6ED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261835, "uuid": "971b6ae6-bbe8-4ff3-b139-9ea23e4e9c32", "value": "7dc8a7abc496d99feefc72c0a0d7748c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261835, "uuid": "71372ec8-a568-46da-b0f7-1061cd837bc6", "value": "12288:2CcmFM0luMoL4Ip5iYVCZWOERUB3HDrOtW:27m20M4IpAqCZZE6B3POc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261835, "uuid": "7e4bb008-9bcc-4eda-ac8c-d8ef95916da4", "value": 495153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261835, "uuid": "3410ab87-0ade-4ae9-82e0-8a7977fd5e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261835, "uuid": "55bad18c-7b32-4a0f-ab7d-0fd172ced641", "value": "bc69d9c6762c4c5ba7abd45a25c496b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779ed25e-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675238847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238847, "uuid": "47ee868e-c2fa-4b17-9d74-fa58f88d7fbf", "comment": "Malware payload (DarkCloud)", "value": "5f2799730ffccd23611b3419731661f2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238847, "uuid": "9f5ffdb4-ae5c-433a-9ffc-727ad35c1eed", "comment": "Malware payload (DarkCloud)", "value": "a081fc884467fd64301b409573f4309db7487266e68e60eeef5cf5d36b5c8024", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238847, "uuid": "ced9f794-14d2-4fa2-8c91-3c2434001a9f", "comment": "Malware payload (DarkCloud)", "value": "8c899320419db2bd7102a05823161f463058b5ab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238847, "uuid": "189068b8-a5e1-4ec0-a807-6cce2b27ced5", "comment": "Malware payload (DarkCloud)", "value": "887fd967f1ef4b33be50481aa772a6167a0b9725601b2ae6d26c5c212f77830511da9bd0833da3ff55f76b5e0bc784d2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238847, "uuid": "72cba679-a1af-4063-9716-2f4f91988b2a", "value": "T162F42314B6F96376D17D03BE01B17550837AA7C8780ADFC869CA31FCAA07F981A11E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238847, "uuid": "f1b50739-8cad-47fc-abc2-eaa7d3765fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238847, "uuid": "7abad831-0e26-4336-aab3-14de451c167f", "value": "12288:Gr8RN5VIrld1h+GOcXxh71xIHVyTzfK94eh/D45BWCivEIpVRp39i7+pvXCWtO:Gr8RN5VW7+6D2VgzfK94mKW5Fpvp3w6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238847, "uuid": "f4e8a8fa-a2cc-4e7a-9769-8211bc006653", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238847, "uuid": "25a5a657-64bb-4ba5-98c9-7f9bf8a2a4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238847, "uuid": "c5e361ac-07be-4c5a-9354-5c98f175e471", "value": "TRANSFER_REQUEST_FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10dce29-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675278913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278913, "uuid": "51a0e13f-5fad-481a-b859-80173468f702", "comment": "Malware payload (GCleaner)", "value": "31130891f2e689ef9f2cb1418c6613cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278913, "uuid": "d3fd184e-5451-400e-8da6-f121ac563e8c", "comment": "Malware payload (GCleaner)", "value": "a179b2c47fe117c176b60bb81b2c2b3620d0f7593fafbeda3402b3a3acaee5a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278913, "uuid": "3ffeda3a-a954-4f36-84b0-bf736b88917e", "comment": "Malware payload (GCleaner)", "value": "a90aec718b7316aa98f30c0e788aaf2cf7e0f662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278913, "uuid": "e6590c3d-84b1-4aa1-a934-4dc9fd852c48", "comment": "Malware payload (GCleaner)", "value": "999105d07b6eea395ec867a8c92db0aec2a384f342fadae7cb34855b1ecae5eaccba37d6b6d49e2fa60f314c8323a6e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278913, "uuid": "92034b80-1212-45f5-acb2-bf4fd1e2ceae", "value": "T1F2A52303E97DCD37E2E0AAB82D24F221EB62AE94293D451775EA7C57373D1D36C08606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278913, "uuid": "bc690aab-d74f-49b4-a00e-641774eca602", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278913, "uuid": "0976d28f-843e-4098-8e43-1394aa738456", "value": "49152:icPLnQiJj1gTcC3wrj1Lclw1duwkdl4n3VLCgv2MR:XPLnQa08NcqYl4nZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278913, "uuid": "64feafbb-747e-446f-a30b-7904ac87599d", "value": 2211764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278913, "uuid": "4d353242-7ea9-4c41-8c60-69bcaf932b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278913, "uuid": "3f55fb59-9e58-46aa-ae53-31485ea17939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa356e-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675256089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256089, "uuid": "b751c7af-46e1-4b89-ba32-12222af66442", "comment": "Malware payload (CoinMiner)", "value": "770e86e91865ec221f0c83f3bb5b7ab5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256089, "uuid": "1163e24b-22b3-4303-9519-979a8b824193", "comment": "Malware payload (CoinMiner)", "value": "a1b4dc3dde2dcd561f0e2644074039b1c47b0688dd4f17ac7779dd2ffcf3fe2f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256089, "uuid": "765a994b-1ffe-4de9-b5e9-29e77a3abee4", "comment": "Malware payload (CoinMiner)", "value": "e5b9d575c135af12ae1a9228642548402ab755fc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256089, "uuid": "5f5eba64-3206-4f48-9921-1085a3908776", "comment": "Malware payload (CoinMiner)", "value": "7cc91ff530af0bb4bda4e76e92a98463004d7907752f68077e1ae5956d96fce3c53e51166545ada900086bf090aed6ec", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256089, "uuid": "3659efc5-dccc-4412-9e0a-2e4fbe730b2f", "value": "T187732800F250C13BF0F680FFF6FF5699196C9FA4434598D7A2E0688F6A256C5BA36097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256089, "uuid": "83e10bbe-43b3-4196-b55f-a059c6ba0b2d", "value": "dac8ae7c837e7fe3a3ea62e0b6800155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256089, "uuid": "ac4d0850-fcbb-4e2d-aaff-8b59b75d362f", "value": "1536:gh3Mz8y5D0FLcNU33CxcuxrMhenfFB3CeeeeeeeeeeeeeeeeeeeWeeeee:ZwLFLQs3vuxrPnfFB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256089, "uuid": "bf7c48e7-d228-42cd-a406-30d54f9472a0", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256089, "uuid": "0965dd17-dc26-4a97-935f-a5043dc392e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256089, "uuid": "41190796-5c41-47f3-ac9d-4df8ca770f97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4129eb60-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675264096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264096, "uuid": "2fd6637f-2d0d-46c6-9700-eb787c8710c9", "comment": "Malware payload (RedLineStealer)", "value": "086b098ac9c5ec22dce0bc377f933057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264096, "uuid": "43da49df-626d-49cd-9f28-ee8c088e7b90", "comment": "Malware payload (RedLineStealer)", "value": "a1e9fa5b4568321465296570494bf193ba177d5f8ec17c20da3d10098fd59194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264096, "uuid": "0b88cacc-c671-4c47-b557-49ff0db1b77e", "comment": "Malware payload (RedLineStealer)", "value": "a79ba80166943c423efb82bdffb52f5e22e8a9d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264096, "uuid": "c00c297b-57c7-4097-a9b6-b5584ddb03d6", "comment": "Malware payload (RedLineStealer)", "value": "1b5017fe0998b59efc32f17c6d3d4add71a1ddadf04efac612d5964460876d2804f0dcde36e39f45f4bcb581a3203065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264096, "uuid": "23455fe7-e36a-49c1-8ec8-4465d5540daf", "value": "T161C49497BB60C9A2E09421F2C1DF4A39A3F167E71773C546ED061E920AC13851F5FB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264096, "uuid": "d811d2b9-a28d-4cb4-815b-3915f21a68ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264096, "uuid": "6a836c40-1ddc-4c42-97a0-315582b2133f", "value": "6144:fxu6QBqCJgCyrusKWPAjqcaMbriIrkGoDotDZquopo9k/+iSmmnpdqicn1IPP:F99nR1oiIY/ot8SEicn1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264096, "uuid": "6b5400d0-0615-427f-86a3-d19d49646672", "value": 546920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264096, "uuid": "359f0450-625f-4340-816a-47a4ecc52413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264096, "uuid": "c57b6087-66b3-4043-84dd-c66e2b40c00a", "value": "086b098ac9c5ec22dce0bc377f933057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f00f0c-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675266625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266625, "uuid": "09f26b48-1977-4c99-a4db-3377d73dc7f8", "comment": "Malware payload", "value": "7aa1038fb3ffb88c09d95efaa7a3f365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266625, "uuid": "94b09541-82df-4f7b-939a-09823ddd6aa1", "comment": "Malware payload", "value": "a20359e90975bec793d241abaa1f11219debfac449ad0360f5b44f1d4bcb487d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266625, "uuid": "6cf2f47a-8397-4b53-bd66-22e648aee346", "comment": "Malware payload", "value": "178ead5f554cf734620fe7672b7116a1c36c6671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266625, "uuid": "3cbb7292-2b98-4c2e-a17c-d2b633769e87", "comment": "Malware payload", "value": "f8c614b56a6b12f23c154b398935cd5d3aa8bb880acd5bc8efb53d2ced9ff4c45b6a67e7be09db38e9f81802ecd8bd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266625, "uuid": "0d4b9967-ec5e-4b51-8ccf-83fdc5c755af", "value": "T1C5F50245A2C2AE76D4731C7E6CAACAB4371433C8F5762C8A3665910DE3393B27CF5099", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266625, "uuid": "3a6e8975-2dfe-4ef4-89f6-fc594805d258", "value": "d92c982cc460383510f914e9a2d56c20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266625, "uuid": "69ad295b-077c-437e-86b7-171a0bdba80a", "value": "24576:BLpjnE+yWn4eiX7BMV2E4PvLsVJQEXSN7Az9q3Lt1ZO2rwkwU/UUUUUUUUUUUUUa:BLN/4773PviJFCN7M9+hi2rvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266625, "uuid": "07e78657-83de-4a8c-af24-97d145056699", "value": 3456338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266625, "uuid": "43e45029-5253-4553-8f0f-5ad6329515f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266625, "uuid": "6715feaf-5de4-4c7d-a451-da64231e0028", "value": "7aa1038fb3ffb88c09d95efaa7a3f365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6135aa68-a1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675233226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233226, "uuid": "6211c3fd-c7ab-420f-9f97-5413a3b271bb", "comment": "Malware payload (Smoke Loader)", "value": "116517df55e4c73851445014695afd32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233226, "uuid": "f28f3561-50b1-45d2-9a5b-05c6d1432d3a", "comment": "Malware payload (Smoke Loader)", "value": "a22c776d52c74734ef93bfe83de79b591a91fd3e2e4d756a24521c39c99d442e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233226, "uuid": "bd9e6826-57e2-4817-b11c-56a36c6012b6", "comment": "Malware payload (Smoke Loader)", "value": "6e268637b40db5773454045bcfbf0a92d15b961c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233226, "uuid": "ec6ae67c-6537-44c2-90dc-82fb382a5272", "comment": "Malware payload (Smoke Loader)", "value": "3c9a9f539c0ce70e6c44f3134a0cd5bf86e8894eccf690e76e6e7f876e52ae582915604445dac711e88db9c2c381c780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233226, "uuid": "64d2441a-7c9f-4737-ac93-9cd37f59ca20", "value": "T16334D0227180C072C7B714709C34DB94BBBEE432493A595B7BA81B7E9F706D1663A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233226, "uuid": "458750d3-af7d-4955-b28c-deea09407dd1", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233226, "uuid": "0d6854b5-15e2-4eca-8af6-34216ed9e718", "value": "3072:+6BGUKOr39O9WLC7WNR5rlu2cj1or0YWwTOk4uosjiAU9X70:+6B/tOkLC7kVub1ootwTO3z1AU9L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233226, "uuid": "a4338a8a-f808-4d7e-981a-fa67512c0437", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233226, "uuid": "c27ccf03-3821-4f3b-994e-e01ebd5ea4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233226, "uuid": "46977b7c-30fb-43a5-8b66-ee6dd427051a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976e8f76-a24f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675269824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269824, "uuid": "ae642a66-1bf8-496f-80f5-c77c195b8627", "comment": "Malware payload", "value": "1dc562d9b3a21600259d2e4c736f803e", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269824, "uuid": "9eaee29f-9414-4830-8a8f-98c43b75f773", "comment": "Malware payload", "value": "a285b419dff8e67bab8678441d670efb2ef573b8ccabad5dbb355c1ae805a6b4", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269824, "uuid": "5a1ecf2d-d846-447c-aad4-b7c1547c3ee8", "comment": "Malware payload", "value": "5b3adc48e6da012f630cee37ff8d6cbd3a852e83", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269824, "uuid": "36672f06-d0a6-4161-9e5f-38e1797fa36a", "comment": "Malware payload", "value": "a7dbd2ddadf39aafc29632bad5ad87b4fd76e95a4a2eddcd4cea497c884a9176a671c2c41681f507827f2fbf905be767", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269824, "uuid": "9ddfd7e5-2a99-48ae-b0f5-df7aa8689bb3", "value": "T18004BE0662E295E9FED07BF60DA7465C6A27BE23E122039F5EB62A6D4C74310CD0474F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269824, "uuid": "b4365efd-b971-4178-9844-19df96e5b24c", "value": "1536:la+us0Yfpw9/WFi5HrTy2NtTWR7f2f5RNzQiiiiiiiiiiiiiimL1Vmww9ua:laA0YRw9/WITtTWR7IbNzvL1aEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675269824, "uuid": "f9e4065f-cf51-4fff-98c7-bc710a6a9d12", "value": 181416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675269824, "uuid": "792a5cba-8740-495d-89e5-15e0ee716c98", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269824, "uuid": "8a1f42be-dd15-496e-a4a6-0f4215a05f24", "value": "ComplaintCopy_15943(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfe8558-a226-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675252038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252038, "uuid": "2c56803a-fa6a-4a9c-ac75-194b1cca742b", "comment": "Malware payload (Loki)", "value": "cf3c57e573d8825b2c398b8b187b3ecc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252038, "uuid": "b077cac9-159e-4a89-a82a-938f6fbebfa6", "comment": "Malware payload (Loki)", "value": "a2c0610976c72c78927da80bb092501ce8a6f882b6241dc0517d3fa137ab8fe5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252038, "uuid": "28f566b2-e79d-4f83-bc23-5fd48bc60ba1", "comment": "Malware payload (Loki)", "value": "e80a459884ec9021de7c4f6a1e0cb8e12637e6bf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252038, "uuid": "c01c5c31-23ba-43c3-827d-256fa1fdcc91", "comment": "Malware payload (Loki)", "value": "2f5486b45ab31b6516789f07ce84e0c935e9f144ec7d6c5a82cce4fda9b854b5a21b4eee7771ebb3f2feb667dc433047", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252038, "uuid": "55e5a2eb-0ef7-4cab-8edc-1394c7403e8a", "value": "T189228C2DC604FC36C32205BCE06842F4F31C206AEA92BA0D1941F29E4BA17D357D96E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252038, "uuid": "1ae57c41-7025-458d-8248-cb4213835379", "value": "192:ScIMmtP5hG/b7XN+eOZO+5+5F7Jar/YEChI3wZ:SPXRE7XtOZ7wtar/YECO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252038, "uuid": "23161cad-4bb8-4466-9b7e-7523f46ee8b3", "value": 10355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252038, "uuid": "6e5c3097-d244-4170-9aaf-83b21c306d6f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252038, "uuid": "bc29458d-159d-44dd-b815-ee8fdc560de6", "value": "TT ADVISE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d95ac64-a1ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675227207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227207, "uuid": "21b52921-feb6-4753-b724-c9b0f20fa946", "comment": "Malware payload (Smoke Loader)", "value": "ddd5e96e3757683deb8a9c56473e5db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227207, "uuid": "179a1638-545d-4d10-95d0-4f80fad15019", "comment": "Malware payload (Smoke Loader)", "value": "a3a2952ce4c81448208568386122c5b4769d4520409c23d22c33cb950165512f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227207, "uuid": "055eac10-10e9-43ea-b0d0-0a77c3356eab", "comment": "Malware payload (Smoke Loader)", "value": "ece442d1df3b0da6ef9b13d869f96590fbe36dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675227207, "uuid": "91fa80df-2293-4e86-b642-5a5c8d6d1a62", "comment": "Malware payload (Smoke Loader)", "value": "0f14bf426dc9f476ac9700cf8536e04c8eeeda352e97127eb33d999fbc2dd9b31f2fc61cb839ce03a9c7b38b28aa7203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227207, "uuid": "e479075b-f279-4e8b-9359-dda4b31e884c", "value": "T1F0548DC276F2AC62ED6286319E1EC7F87D1EB9524E0863E6131B9BDF55B01E1D1A3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227207, "uuid": "90bddd37-d2c1-420b-911d-37d97f923a00", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227207, "uuid": "db117608-6c94-4c71-8191-05ebceef4967", "value": "3072:Z+DBh7sHLLNRcODfV1Ai0ykmpFB2r6k9rmoEOmqPUx6WfQz86pnE3MM6:yIHLLw2dJ0ykMFB2boOmqMoIME8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675227207, "uuid": "91b746bd-f9f0-4683-bd7d-7e540dad38c4", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675227207, "uuid": "77614954-479f-487c-9f96-9c7d30654321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675227207, "uuid": "353afe7a-de09-4ae2-a68e-fe2d510f0634", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8dc51d-a22a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675254052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254052, "uuid": "ceedd615-90f2-4b22-a731-6c2a4b89a76a", "comment": "Malware payload (Vidar)", "value": "48b3b94e04f92007f716b4a1ed0d2e06", "object_relation": "md5", "Tag": [ { "name": "fake-install", "colour": "#480B7B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254052, "uuid": "3a70313f-a23e-40ae-a287-ad17f275e644", "comment": "Malware payload (Vidar)", "value": "a3f6b6afa8b967d5ac1cc3f087dff66de4005d45790805ecde3327ac657df3b5", "object_relation": "sha256", "Tag": [ { "name": "fake-install", "colour": "#480B7B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254052, "uuid": "52fe50d2-2e0a-4f64-a8d1-7a7f394b17bb", "comment": "Malware payload (Vidar)", "value": "e0547bd24a5f1c29f8b31768719f46781d038d9b", "object_relation": "sha1", "Tag": [ { "name": "fake-install", "colour": "#480B7B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254052, "uuid": "4f78caf0-8f9b-4051-98f8-b355fd99c3c8", "comment": "Malware payload (Vidar)", "value": "ff48988e1becbeef5753fd1193755bdde1cc11f470e74f2bc83c83b9b7d54ae53dfa926723f4e48d92242d96f8cfaa35", "object_relation": "sha3-384", "Tag": [ { "name": "fake-install", "colour": "#480B7B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254052, "uuid": "d49048c5-e19f-489a-a075-19ea3cbd6c32", "value": "T1D9964BBAE72BC322FE123C7D36CA8513E174DAF9D09750DAB6299D7049C3AD0572B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254052, "uuid": "8943ea4d-c14c-4c12-8f89-e4be25df1a68", "value": "98304:BivSF+Fb16ObQKFb16ObArP0SPcWAt+eGSmy2P0TjYRMkyN:4hb1HbNb1HbAbrytaHMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254052, "uuid": "9618b4aa-6536-473f-88f0-4bbadc1d670b", "value": 8979933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254052, "uuid": "b7e2a4c6-06e2-4576-ade6-8b8fa8b5496c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254052, "uuid": "4813edf2-5e31-4ca8-90da-97a3e544a168", "value": "Nvidia_Install.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e652a2ad-a238-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675260078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260078, "uuid": "86648558-2303-4717-9285-0bf64ab48f2c", "comment": "Malware payload (AgentTesla)", "value": "33d8bc5acfed0cb7244c31bff7262dea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260078, "uuid": "4f84b4e5-e3ca-4a2c-8833-9e321a46c125", "comment": "Malware payload (AgentTesla)", "value": "a42d6f6f5a32c599afde3c3093e4ba806f172caa9479353cf97ea6e41d315bd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260078, "uuid": "0a42679e-da70-465a-98af-935df4426ade", "comment": "Malware payload (AgentTesla)", "value": "197025c133ab796930ff1a62991755486fcdb761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260078, "uuid": "d8666947-f1c6-423b-9a21-c2791675c01e", "comment": "Malware payload (AgentTesla)", "value": "e24f8c5fe2749ee5b278e5fcafa084692230c7f270da5bfc668f497566af3365bd7a11f6ee8fcb651438e639f8a03d87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260078, "uuid": "8b4c00fb-689a-4312-97d3-9613d755383e", "value": "T19BC4221132F8937DD17F47BE906AE878D37C6A85E917EB548FE954E8A50B7004A22383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260078, "uuid": "80353665-55cb-4bda-8f53-a92307e10116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260078, "uuid": "6f6b386c-6127-41b2-8c4b-b3878a42e94d", "value": "12288:o6r8zd2vUjT8mcR8ahI3/cudSxzjgDKJtAo6iDONECFemL9i7+pvHCWtO:o6r8kvMT8de3/CvtwiDOZnLw6Rih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260078, "uuid": "1585a87e-7648-4b67-be5a-d8b521700bc2", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260078, "uuid": "b48dff47-f587-4476-a3d6-6cfeba619f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260078, "uuid": "60d27f01-db55-429c-8ffd-d30df02ad499", "value": "TTRe01302023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb832127-a27f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675290608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290608, "uuid": "bffd83c1-4b6f-4f79-9449-aaf8a668d006", "comment": "Malware payload", "value": "f8a67734f3d66d28a13e9430891870ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290608, "uuid": "2c55afd9-3ba5-4184-bc8f-e44d4686ee37", "comment": "Malware payload", "value": "a47b5037a02aa17376c43e0848cff490d707b95d6b79ec030da451072534bc33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290608, "uuid": "6d9c3f86-4043-4f71-a301-ff780a0005b7", "comment": "Malware payload", "value": "80150d62f3fd9be63015d17795d037c4c42ed0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675290608, "uuid": "121ebb2b-77f4-49a8-a9b8-04d26eec8ccb", "comment": "Malware payload", "value": "e3cd31bbaf59e720f3111bd2f7ba6e229202e03153976bce63f6108265b79a1a8ecb93a8815defae5ce6e21270cdfe24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290608, "uuid": "0f581a95-939a-4e0b-babc-fe179102d5f3", "value": "T18CA53326927CC836D3E19BF4AE21C6622F799D54106CC71174E97E4F3A3E2D3B908768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290608, "uuid": "4ff8a1db-3128-4b1d-bd50-76a43baaa28c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290608, "uuid": "cd408c09-732d-42a5-afd2-9935f7ab55e2", "value": "49152:icPLnQ/E4z4tIM2vGV0hUb5lw5VEo/owmTzBLJ39LCgv2MR:XPLnQf7vGV0hQwz9//mTzBDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675290608, "uuid": "d3b0ca4e-49b1-4748-bb2d-b2a81e804d06", "value": 2217490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675290608, "uuid": "5013cfbc-e9c4-42c8-a411-3387d849c26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675290608, "uuid": "c018abdd-7b9d-4053-b889-97d77d0f45e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d13c30-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239617, "uuid": "cb8ee2ef-7d7d-4be9-93f2-d8bae9fd0837", "comment": "Malware payload (AgentTesla)", "value": "b801ff9a5b80df3688626afeb4259c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239617, "uuid": "5fa517a7-6758-4c71-83de-832b0983e41d", "comment": "Malware payload (AgentTesla)", "value": "a4c0a2e97a562d24986b2d7e24a451f74000f4beca6418bc7b457f145d69b69b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239617, "uuid": "62c284af-116a-48d6-804c-068660e72fb1", "comment": "Malware payload (AgentTesla)", "value": "26ee437672aaec7da0d11ab288c1c2e756fe070f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239617, "uuid": "55181391-c330-41f5-a82b-cbc68d990230", "comment": "Malware payload (AgentTesla)", "value": "cbc615d501e85f08dbe4ec813d687347f05b1f81ae142d6a9a9a9fc4a95ce6a39e6370fb79dd53721cc49582c7bd4dc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239617, "uuid": "bc55882f-e791-4fae-9f8b-e9df2e4e49f4", "value": "T16E642384BAB4C8A3D0620BB12D2B6F576FF6E95105B84A0703787DA47DF4AC34D1D7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239617, "uuid": "a5c5c4bf-6a47-4bba-8376-8db380c7a9dd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239617, "uuid": "7b2b2b40-9423-4ae3-ae56-9d65ae65585d", "value": "6144:PYa6Lh1/NqPeQU1AmAq+95kte5IoLzEt9IXGV5Zwet8CS/sK3/k0iwHMoP:PY5h5cGQUfI9i6IoCICdK3/k0iwHMoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239617, "uuid": "d1b68714-a028-4b94-a6c2-e94e9afe29be", "value": 311943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239617, "uuid": "61522f09-7c7c-430d-835c-0c299908c198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239617, "uuid": "b2af9254-d7a2-4383-b128-cc4e07d4f74f", "value": "TT Swift ($ 23,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6925bf54-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263733, "uuid": "bcc3efb7-bae6-4a38-80e4-1dbd6cbb4f08", "comment": "Malware payload", "value": "6e38878d87442e32a4c627fc3bb2a4bc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263733, "uuid": "980faebc-99a7-440a-aebf-24c666d78eff", "comment": "Malware payload", "value": "a4d65fad6f66f3eb0f97fa808c8cd6ea1206e420827ad3c631b64f1430e998ae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263733, "uuid": "f9a9619d-6779-43f0-bf27-8f8771b231f0", "comment": "Malware payload", "value": "2c78d420cacd4a8cda26f12025d691aa61ab58c9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263733, "uuid": "3dba1afb-e8ee-4279-953a-4015bb737301", "comment": "Malware payload", "value": "ca74655682f8cb549e086acfec0352621e8415b0b8f272b6622b0d682b03e1796abbb857ad781e60a49c3af4e2d1f66a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263733, "uuid": "50efac33-703c-404a-b34f-0fb807fbfae2", "value": "T17355AEF875047DE62A7F536BCE96ACDD13B52B629ACBA4CC8064B7C30563375EE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263733, "uuid": "a1ef3f15-4ebb-4a22-b3b5-c70c7dc8dfff", "value": "24576:t4zfYIG6vPpuMwvr8M5jlr7ENkLtrS6pwku13i1ApYq0coDyjZvWWgZjJGXSWlgl:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263733, "uuid": "06b79794-b26e-499f-ad1f-8cb401e7ec0e", "value": 1338613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263733, "uuid": "99bec2ae-c62c-4dc2-9f9f-d8db1fa4630d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263733, "uuid": "dfd15e45-242e-4720-b927-faaf85973008", "value": "Order No 2118013.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b0941e-a262-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675278042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278042, "uuid": "6925bd3f-69c7-4b78-a4bf-49311749b79d", "comment": "Malware payload (Smoke Loader)", "value": "f9b3cadd2e2b543d4cf395137ea78bc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278042, "uuid": "730a1f83-4043-44af-9141-6abce8d6a92d", "comment": "Malware payload (Smoke Loader)", "value": "a4f2a562deef645c7e4444e99c24f0775fdb2b89460752ec796a5f08644ef1e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278042, "uuid": "71d16fdd-10e7-44fb-9ef4-2612c38b720e", "comment": "Malware payload (Smoke Loader)", "value": "5238b7348c57d5f45478a9af58442e71123448b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278042, "uuid": "aaa59e07-43cd-44bd-8bcd-89653bf338c7", "comment": "Malware payload (Smoke Loader)", "value": "92287bd8472485df59d4484609b73b1e61968e71e4de7cd94cfe145f5428ad2e61e370a0b7d57d1e8999d8c60e3c432c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278042, "uuid": "b868bcf8-3d3f-4bca-817e-a73755ec50ed", "value": "T1F924DF3276E0C073C4675530A820DAE13BBEB5320679995B7BA817BE9F307D06739386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278042, "uuid": "f0ad470a-d756-4960-b811-89c09797411e", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278042, "uuid": "95f491a4-28da-480c-ad33-202c3d5afb9d", "value": "3072:TjIKxzvMadYhduLRSW1X53ACyLCG26KjO1RCszgonepbJ1Wi:TjnosYmLRSwOGi93YonKJ1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278042, "uuid": "2ef34e49-60d9-4a5d-980c-3895a85fb3af", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278042, "uuid": "3b648608-68f7-42f3-8224-ccbd61fc0255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278042, "uuid": "ae08dea8-7ef6-41d8-8b6f-70eaa4b488c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bf84ba-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675256101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256101, "uuid": "88556aec-97d1-4b03-abf3-5e050c729ac1", "comment": "Malware payload (RemcosRAT)", "value": "2a0c96488c0bf6d685ffe058c1ebb06d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256101, "uuid": "ed204d4e-f896-43c7-8a89-b58cd7bd191b", "comment": "Malware payload (RemcosRAT)", "value": "a6bdc7d25ae942d15182d26e449c329340db53470a079647d3b6ddb06b7e28d5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256101, "uuid": "5bef1ceb-4a76-4450-9da1-64b09a5bd580", "comment": "Malware payload (RemcosRAT)", "value": "9f1cfa7df0680a3b65a192ee8039465d129b62b7", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256101, "uuid": "37d459e2-388d-4259-8370-0ac14b3315b8", "comment": "Malware payload (RemcosRAT)", "value": "8b0428030f2fce3bead8999f00ffe16d9091ffc803f86e04ac9bd4707a1d63ff13536fa4fa5848f66055b34a9d5bda7a", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256101, "uuid": "1513a2c0-baa3-4f34-a0d3-2abd4b57a60d", "value": "T157F5B6203EFA901AF1B7BF759AE475969EBEF6633B07954E1050038A0A13A40DDD173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256101, "uuid": "b2b20947-baba-43ae-b7f6-efccba27428c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256101, "uuid": "453ce5ee-9919-4c4e-831a-a7e289d4f2bd", "value": "24576:EAzFN9Z2XBQFio7Q0sE93KBLPdA6sU1rdUEHbR2XSQXuCRP7+jNJCRZgC/LUa9kJ:EA36kio7Q0sENKHi4wkhlKYQkjRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256101, "uuid": "4098ee30-dfff-4175-a4c5-4c6eebae970e", "value": 3473920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256101, "uuid": "ec945f9f-7df1-4b81-8419-c94aeba81aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256101, "uuid": "9ece97da-2700-4c39-8db9-1b8f62f2fbdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44755b2b-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267108, "uuid": "6e09ca10-3d09-4cac-84e8-da0230f39ab2", "comment": "Malware payload", "value": "4b1fdbfd686593eefa98cf2e33c7eb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267108, "uuid": "b8760356-33cf-462b-8788-b206403bd20f", "comment": "Malware payload", "value": "a736f55777bd99aadcf8b50ad707678375386faf8ce640bbd0288031c3827a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267108, "uuid": "ebdf1d30-95ec-484b-9e92-8cc1f03b95c0", "comment": "Malware payload", "value": "af2e656387687a4de1f9aed8dcd87eac694fd748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267108, "uuid": "f5d9f6f2-f862-4e40-b626-52414d87a8e2", "comment": "Malware payload", "value": "356194243c5518f09816103ea2710421fe8a0d30ba639e84429ba5ddecfeba6f1dd0be2f97ae458f02b2fa0072bba405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267108, "uuid": "0526d0af-5e90-430e-bdf3-e81b8d01c3c0", "value": "T168B5C06511BC01D9E1BAD13D8A869A4FE7B1BC851334DBCB45A149EA1F23AF8367F310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267108, "uuid": "94c1b890-1247-436c-900b-9ac5fea2a7f2", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8la/VdPiE7puq:Vv08Ro21Buk5/xgX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267108, "uuid": "f8484625-900c-4992-890c-cfa5e57b7bd0", "value": 2493330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267108, "uuid": "8dbe1f4d-f00a-491b-b872-964698831af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267108, "uuid": "fc2b748a-f89b-48e2-90ef-f34cdee4dac3", "value": "4b1fdbfd686593eefa98cf2e33c7eb34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017b8a9e-a22b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675254111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254111, "uuid": "76551fdd-8297-40b7-be2a-6290d82e4a9c", "comment": "Malware payload", "value": "a7e3053e42acf58439446691c06efbd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254111, "uuid": "aff30046-86cb-4e89-8125-4d1201cf72e0", "comment": "Malware payload", "value": "a7506a81e5dae60b7176f308ee3aeb5cff4b2eeb7421d010b31f8d12e06f3267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254111, "uuid": "8fe5cb5b-bfa2-431a-97cd-0364df11be7a", "comment": "Malware payload", "value": "95381979594c7514c5b859bea6fd8e439a8ed1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254111, "uuid": "b0db387d-b46f-42da-b80a-86429ba412c0", "comment": "Malware payload", "value": "372b9fd8f2209053bf74217552a4d6bd61d2c2a2e34a221adc1ac3b99ed3719ba811fc27061a47b78e4f083886a3964b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254111, "uuid": "b2451dad-7153-42a8-aff3-169c66f722b6", "value": "T1D87633F077E09A7AF83A44B1FA096FA2C199D65D1F075A1B439507286C7F4C9CA23F24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254111, "uuid": "2683f977-a2b2-4085-a739-0c64295138ac", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254111, "uuid": "8e514ed3-8ef8-4a6e-8ef1-4b65a9545816", "value": "196608:91OMkoJj5Yb1KBWXCr0nU7T+1U7ZzrqnkDbRdcEXN:3OMP5YRKQXw8K6OPFXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254111, "uuid": "82babb4b-bb10-48fb-8200-029495f38801", "value": 7626964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254111, "uuid": "b32d6073-f9c2-44b2-9b1c-52730b1bc5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254111, "uuid": "df7e232e-54e6-4526-a431-f711b1c3664c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c962f36-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675262853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262853, "uuid": "f5ffaa6a-5cd6-4ce1-b205-aa7f8bb1a648", "comment": "Malware payload (AgentTesla)", "value": "afe94778e80cd81f41fc29da562ddede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262853, "uuid": "a0c2ba3a-b085-4c72-abda-8a29ef3baf31", "comment": "Malware payload (AgentTesla)", "value": "a75c3d13bb94cda4883dcaa4e25b0eea690b0a109e6dea29b58fffad8c13caba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262853, "uuid": "8da59395-9c20-4904-a357-8a3cfd008560", "comment": "Malware payload (AgentTesla)", "value": "ee9cdab593405eeda6cbb0d3368c97ea0222d7de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262853, "uuid": "abbad7ee-3b81-447a-9489-47be1c98087b", "comment": "Malware payload (AgentTesla)", "value": "b29e110bf364e0528cee1b88a62c9f1a388b418b606400813a7c190f43fd3e858554039acf2b10b7a942e29413d95fdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262853, "uuid": "ca03abf3-9e65-4f54-b9b9-98fc2170e727", "value": "T157A31E08A3EE5E23D96AD7785953F2722735CC6245A1D7071EC4ADA73F1BB822E100F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262853, "uuid": "475f57e8-0fa4-4eed-b615-1bcd323ce835", "value": "768:OiKXNV/CPYlPbGr1RXqx5NbcVfup+btYAJHa47:OlNGmGr11qcVfupotYyT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262853, "uuid": "04087b6f-ce55-440a-845a-4a1c42facd32", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262853, "uuid": "45526e2d-c40b-46df-b8b0-98ad613b9393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262853, "uuid": "055f2929-ab18-40e2-99a8-b7c6e34e0924", "value": "SecuriteInfo.com.W64.MSIL_Agent.EOZ.gen.Eldorado.13966.20516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61e24b5-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675268131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268131, "uuid": "a67d2045-2c90-45e8-b5e5-d70a64a3f3f1", "comment": "Malware payload (DCRat)", "value": "4d3227c49bb3db6940a04296e0c7ad1b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268131, "uuid": "22d5c0dc-0bcd-4318-a140-0269a91e3acb", "comment": "Malware payload (DCRat)", "value": "a7c4851eb45e364c5d00a0ac9604be177f5ce178525599f63995e3527ef4a93b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268131, "uuid": "bf908024-55fa-444c-8a5f-c35da7b1b2ca", "comment": "Malware payload (DCRat)", "value": "21a152feb2ef0ffba34587b63a832bf47c696be5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268131, "uuid": "dec50e4f-8dc4-4311-a340-1dda07553d6a", "comment": "Malware payload (DCRat)", "value": "e748337bce26466ea10d2aacc3b659a17f6eced69f0a11bd083143b4248b046742bb6b2edeef32d7427eb7e287ac9cb3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268131, "uuid": "25a83297-a933-45ee-ab24-1958e91d75cd", "value": "T1BF3508027E4ADD03C0299637C9EF452407E8AD497B66E71EBE9F735D6012BA70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268131, "uuid": "fd903520-f35f-49c2-be8c-7b83b1c1c13d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268131, "uuid": "e01d52b3-a695-4861-bed5-905b24b6873b", "value": "24576:tOX6SP7prgJDBT5HHcwsQMghdR/O483h4vAe+4:edeDBT5cbQhnbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268131, "uuid": "855f22f3-5de7-4a1b-93bb-fe556fa94f00", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268131, "uuid": "16f5716f-c4a6-4e4d-ae02-33cc833e6189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268131, "uuid": "69cd42b6-edef-4e16-a512-9f3236993a1e", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-a7c4851eb45e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee54c6c-a26e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282909, "uuid": "1c637caf-b1db-4f2e-aa3f-a51ab4bd2090", "comment": "Malware payload", "value": "e996453989403148156b5338127378bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282909, "uuid": "8a0360b6-3c13-4209-a476-2a1364d786c7", "comment": "Malware payload", "value": "a8768ba46615f3c5d186aa3302db10fed3e64b98bcc839416c99d798f0e88667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282909, "uuid": "b773241f-9515-465c-aec7-be4e240e0b5e", "comment": "Malware payload", "value": "8994a1facc471a606d3c465a79148d2549fde463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282909, "uuid": "0cce5d59-e8cd-4ed8-a0ec-a43f95d4373e", "comment": "Malware payload", "value": "fb1b6f9fc00fed66f62aaedc7d1c8fd0cb084be59310ece2f2b75ca891f14330a58b5ab1336c71afa990a6d2c770347e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282909, "uuid": "4160b823-340d-4903-880e-549084bd9d77", "value": "T155741286279FEFA7ECE2853081AFB6F747764E06C2411253A7557F4E383B1139B4A182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282909, "uuid": "7e019056-973f-464a-b422-6c61ec7d36af", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282909, "uuid": "3f5a39a4-5053-4a35-817d-b4271cbedced", "value": "6144:eY2LjrxzIfPOORNnbWNvW7ipwOYi+Oc3CnwolkqtXQjNX0lCalnU1:ajrxzIvbWdW7dki36wo2qtPlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282909, "uuid": "543f30a8-ff89-4878-8140-5a7e8a80dba9", "value": 355480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282909, "uuid": "6bd1c468-fc19-4b46-b33b-2bc0ffcfa07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282909, "uuid": "5cf73cd4-50cf-4c11-b093-fb8742305424", "value": "Wells_Fargo_Transfer_Receipt.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3ee5f6-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675262267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262267, "uuid": "a32d59fa-cf8e-47b0-9bdc-52d839994186", "comment": "Malware payload", "value": "415617f04e8695b804cbc092b8dc17bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262267, "uuid": "f62b526d-629f-4750-99b9-013533765e5a", "comment": "Malware payload", "value": "a93e5e46ea9844c1b2ea5f332af28b77dc90a6c6b2bfeb8600adb167531413e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262267, "uuid": "b05eb970-89ce-40e9-a903-c645770f90d9", "comment": "Malware payload", "value": "2bd02292e6ae29f9db2f42819f36fa694fde949d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262267, "uuid": "0242568d-a3d3-4720-acfb-43e70bfc05cd", "comment": "Malware payload", "value": "4cfe1d712529ce299b70c7e798f257b87696fbed69d482cbf47d0dfa38287b3fec48b6d0ed6b75b47663dfd0e21ecace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262267, "uuid": "2228a830-f56a-424a-bac0-17589d5e5ab1", "value": "T1228209A842EC9323FFAD1BBD94B562C35BB2B6336901F65C784CB0D928C634581A571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262267, "uuid": "53c1a0fc-35c8-4d1a-925e-d43df82a1012", "value": "384:b2YZbTF5Z4gxdX9j3oV4S3lAHok0NGHISSNzUdTQL/:iSgUdJ3sfpGddcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262267, "uuid": "3d1d7264-a042-4a38-95cb-d7723574200c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262267, "uuid": "3f40f2b5-96ae-46b9-a445-a6a004f86577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262267, "uuid": "068073b7-4aed-4176-8d25-0b6dfc3ace24", "value": "QUlLyNtJgh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41589914-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675266673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266673, "uuid": "6777b056-2221-40fe-9089-275569ea0173", "comment": "Malware payload (Formbook)", "value": "cbd51ff5d3feb548256a96e491d22100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266673, "uuid": "d51c24d4-3a27-4d0a-a17f-7227fc5f248b", "comment": "Malware payload (Formbook)", "value": "a97aa6604d2ad5146a8ef252e571d4b0c1e2ee8566964be8086532ef049b10d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266673, "uuid": "380da98a-7db2-4096-a618-19bfc21c4723", "comment": "Malware payload (Formbook)", "value": "af39615fbe91de2772dcd92ecec6cacfdf9c254e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266673, "uuid": "c49e1478-235a-4c23-8d7f-4ef66bea4ed4", "comment": "Malware payload (Formbook)", "value": "74073c4206e077361d9993287a65fcdc30a55d0b38542c62582da08f6ca7a610e7a823e8a16966573ceada053752cd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266673, "uuid": "c177e76a-e960-470b-9e20-95e58f043fd3", "value": "T11F0549813BB19872F1DB09B91128778C1F3C684767D6E2769BF679C092026F7F298D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266673, "uuid": "67af3b55-cb64-4736-b6e3-c63e15ee9fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266673, "uuid": "bed4fed4-4014-4761-938a-3c9011629a1d", "value": "24576:sXHig3UEtclUxmYUanPaCtr8zw6R5c4N34:sXHfEkFVRPaer8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266673, "uuid": "5dd81385-1deb-4ad0-b104-03c87264218e", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266673, "uuid": "ab4ebd4e-40ab-48c4-bf58-a6ac7f84998d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266673, "uuid": "d98dd78f-7207-44a9-bcad-12f825f61ec6", "value": "cbd51ff5d3feb548256a96e491d22100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca6f1c9-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675256116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256116, "uuid": "db98a761-2e4e-4eda-99b7-673b23583221", "comment": "Malware payload (Rhadamanthys)", "value": "41741bc698fdf1377f4be987b6d3e320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256116, "uuid": "1a26962d-c22a-4b3c-9f5c-28dede1e43d4", "comment": "Malware payload (Rhadamanthys)", "value": "a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256116, "uuid": "bbfc6c8c-b7e0-4903-9e83-f78bef3b743f", "comment": "Malware payload (Rhadamanthys)", "value": "aada55f0bee1fed44f811a27bf3a1c267e8b618f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256116, "uuid": "2b5c6f32-4896-4865-8e27-ef8871cd8d54", "comment": "Malware payload (Rhadamanthys)", "value": "4e0f19755f3634c16db9bdd0dcee8a61123a6dee10a733106c77d701425345ffa65e809a2b3d2a7a0bd7697ea8f87331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256116, "uuid": "205b085f-2608-4325-965e-b0625fb61510", "value": "T1DC54F13275B0C032C6B240B09924EB94ABFEB5311675A957B7A81A7E6F703D1733734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256116, "uuid": "074cbce0-f4cb-46c4-a73e-4316460eb855", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256116, "uuid": "e8f020cf-e385-4721-a789-b627faa08b2a", "value": "6144:gW8YUSl4LoLrtHJ86jbPdGsLFma9x5hO15Q:gWb/4cLrZJ86jblGKy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256116, "uuid": "ed35b195-452a-43d8-8ea6-e9f72896983b", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256116, "uuid": "a326f64d-7197-4b4e-8947-022e77f2b19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256116, "uuid": "ee7d9aeb-1d95-4222-934b-68930cbca1a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637975cd-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675263724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263724, "uuid": "8c04ef96-a152-4aed-847e-5bc34c90cb7a", "comment": "Malware payload (SnakeKeylogger)", "value": "e08cf4b188d5f8bf190189983b262ea7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263724, "uuid": "b59acf2b-4bd3-4333-ae78-d2b74db9871f", "comment": "Malware payload (SnakeKeylogger)", "value": "a9c45f9d9af92c5a6c64c679414488d0d60916b501768379f8ca5e15d8955bab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263724, "uuid": "8ec84149-20e7-4646-8e56-7bfe3579872b", "comment": "Malware payload (SnakeKeylogger)", "value": "f84bb8baa69ca833c271697dded917bdf710c4ba", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263724, "uuid": "37890f84-4ce1-4615-a85c-ea6988b6c4fd", "comment": "Malware payload (SnakeKeylogger)", "value": "11c3ecdd821da0aa88da0240f2e745b7feea36c593e53f44b2bb11caaaf5ce8d47bd078a1052b319908969e45dacf1e4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263724, "uuid": "2237016e-ba89-4bba-9444-8e9a278270d5", "value": "T1BCA4BF47BF008A97E45A0F3448F3ABA11A11FD445B164A073629B72CFDF2BE85E396D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263724, "uuid": "e64d2d30-880e-49aa-8d82-4c3e59c6feb5", "value": "6144:2PXZ+RwPONXoRjDhIcp0fDlavx+W26nA1V0Y5ObF0I5eMFRI5elF0I5exF0I5eC:W6GYmWIvjIcWImWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263724, "uuid": "5098f744-bc5c-4d31-902b-f71841eab625", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263724, "uuid": "769278e2-de2e-4f9f-bfab-339114ab9193", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263724, "uuid": "afe6e120-9139-4197-be1b-a1252cc08692", "value": "PO-8372929.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579a6103-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292910, "uuid": "03fa4d96-4ef3-4236-b997-3b5b8d489ac3", "comment": "Malware payload", "value": "7ee8acc54adcd708d6117dbbfe495c75", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292910, "uuid": "e41451c2-fc6a-428f-b35a-6f0298a805a1", "comment": "Malware payload", "value": "aa488f6ab271061c7f0a95a6a9c327e37553167941eff0f9469698f77df3d691", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292910, "uuid": "0964752b-6a15-4650-8847-23fb1b9e8f56", "comment": "Malware payload", "value": "41588ab56ab890bb271f09b62b5303109e0e2024", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292910, "uuid": "2429a6b3-fd54-4e2b-b7dc-b59c51378bc2", "comment": "Malware payload", "value": "2aadbe4781a2a0d571649c7c7889f51004ea02bf3a3939b3451df7a021e4376a8e144f1efed5a865775e076fcbca9136", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292910, "uuid": "ea12ff9a-17a2-41fc-85a6-0a10e4695970", "value": "T182363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292910, "uuid": "253bddc4-44ba-484c-ad67-37d0517ffa18", "value": "98304:Tv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXM:TvpvFa+g8RWLdPk/84tCEr0RtNiC5eSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292910, "uuid": "dc141d5a-2842-408a-8b93-2b2624cd7a96", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292910, "uuid": "7ab7bd77-6a22-4734-bffd-44f8ed4f4e13", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292910, "uuid": "da77f31b-acd9-4f26-8051-5e76bd812241", "value": "aa488f6ab271061c7f0a95a6a9c327e37553167941eff0f9469698f77df3d691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db47e8d-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675266640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266640, "uuid": "5df407d5-7ba2-44fc-a7ef-007cf938640d", "comment": "Malware payload (Rhadamanthys)", "value": "80fe50fa10ae942fa2ab852d998799f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266640, "uuid": "0a619b51-5983-4e76-893c-c399ed47d6da", "comment": "Malware payload (Rhadamanthys)", "value": "aa64d1ced4e8d63e410a37fae592af152e222ee8a10bce0a364545bae3cac365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266640, "uuid": "4c83a0fc-f215-4fee-8729-1765b5c9f6d2", "comment": "Malware payload (Rhadamanthys)", "value": "1b7868713c381e13ff7015e11bc4c4dc4a9b5387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266640, "uuid": "e84d721d-f9cf-459b-82f2-130f5bd3db0a", "comment": "Malware payload (Rhadamanthys)", "value": "dbea83b2cb546ef702351d4eab377476763e845a2db3fe982353f22881c4e3dd644567c049a454bbd9be26a2eb65c39f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266640, "uuid": "70e32f7f-fcc3-4a38-a7b1-26e8853270d0", "value": "T10154E1313580D032C6B611319830DB95BBBEA8322971A9577BD51BBD9F706C1AA3A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266640, "uuid": "2d54a665-0f9e-43fd-ac36-5c2c10fac7fe", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266640, "uuid": "16f0160e-749c-4629-aab9-e1925c90daef", "value": "6144:yWtikSNLW/SooFIZj9OB5ZZL9NBhIVbw9S9PVDpGnG96:yW8tN6/SooYk5ZZhNEaU9JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266640, "uuid": "a33d840d-a58f-4fea-bdc6-126038ea030b", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266640, "uuid": "0b45ce1d-9021-4bee-bbfd-50e5c012c171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266640, "uuid": "da8727a4-0e79-436d-bef6-ab1ab35d73bf", "value": "80fe50fa10ae942fa2ab852d998799f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9caf24-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675247418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247418, "uuid": "0ab118f6-c8e0-4b61-9f2f-42bf45e822b3", "comment": "Malware payload (Smoke Loader)", "value": "35b59455f922242f7eb712b8a59d09e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247418, "uuid": "2a912b49-1625-4b73-88ae-ddfe6c1d0378", "comment": "Malware payload (Smoke Loader)", "value": "aa88a3cbd097f5239d638589e66464ae5eb1d850147d5ae243e1edfc1dc6c071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247418, "uuid": "ea9c058b-2a7d-40ce-b31f-020d1802b9bd", "comment": "Malware payload (Smoke Loader)", "value": "56e0003a00e6f0d2f61a9624e5b21f517bae6c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247418, "uuid": "0ce679f0-1e85-4c99-8b82-0797f5b8aa1d", "comment": "Malware payload (Smoke Loader)", "value": "464c0818348476bb689f9069304cea2fbc68a2b8e145bf38196829fb1b0383eb682e51dfed52fbb2cd00682e96786e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247418, "uuid": "7d11d3df-d891-462c-a941-0735ff10dc5a", "value": "T1BD34E0223A90E073C56B51709C30DB947BBEB8316678984B7B980BAD5F702D16B3635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247418, "uuid": "38020571-5df2-4790-9bdf-a8858a932a1f", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247418, "uuid": "a39f960c-d3b3-478b-8b65-e7524c0de46a", "value": "6144:iSEGr6+LECeVRp0iMWkk21QyvnZf6J+D:iSdO+feVR6iMc21/vnZe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247418, "uuid": "7b4f5e14-8caf-4160-baf8-1ccebecd28b2", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247418, "uuid": "03824813-6d0d-4ea7-a259-76d344b78e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247418, "uuid": "33fc5d52-87c7-47d2-b793-6fcf5164417d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ee4409-a21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675247679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247679, "uuid": "820fec37-0f8a-4b25-9258-6cc7f89e2bdc", "comment": "Malware payload (RedLineStealer)", "value": "a33eb5e3450ae62c3683e24ddecec8ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247679, "uuid": "b1b27fe3-c6d9-496d-8036-6546c21ab1e3", "comment": "Malware payload (RedLineStealer)", "value": "abb24c34b8e61a100c6099b05e7544df3ca46e596bbc1a65ffa01ba6ae05d0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247679, "uuid": "182744f3-ab47-4cf4-b9ff-850068260a1d", "comment": "Malware payload (RedLineStealer)", "value": "7e86ea507d8134865e93a603d62921882d67874f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247679, "uuid": "196d75a2-39df-4dba-aa6d-49668c295046", "comment": "Malware payload (RedLineStealer)", "value": "a3ba8d9fab9224a9f39cbeabd50de127b6e84a0a4f3e58b48107d5751651211837cb1c33f5b07329994bb06895ae77d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247679, "uuid": "1cfb20e0-84b3-4a56-888a-ad24e655881b", "value": "T1EF36127B6A658044C4E58836CA37FEE072FB067A4741DCBB54DAB9C317262F49722783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247679, "uuid": "89d07ba2-bcc8-452f-afb5-8530b5feb4f7", "value": "3a61c09dd755bd1f9daed70fded66844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247679, "uuid": "f2352247-29fe-429c-bb6e-8482224f01f6", "value": "98304:m2J04iv1Pm2u+dsf5NPVmFdgVaIhWubfE9tO3tR0bmq3+:1iv1PVumiJmFaVfWcutE70Ce+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247679, "uuid": "fd83f2a3-20a4-4d61-822f-fbba83aabf27", "value": 4939264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247679, "uuid": "46b33ade-8059-480e-b120-800c582240fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247679, "uuid": "4f8b8a3c-6417-42d8-ac82-2a6b55215999", "value": "SecuriteInfo.com.Trojan.PWS.Steam.34557.12965.26344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5aa03-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292914, "uuid": "2509b816-4661-445e-ac84-0b94ae7c68b4", "comment": "Malware payload", "value": "c66c9ca52794f242589521970e9bd84f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292914, "uuid": "2f05b618-d908-4d44-9ed6-3d73c4381654", "comment": "Malware payload", "value": "abd9376a7a257d7359b836e2575c4239e2f73edbff7adc20c9ee8931bfeeef94", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292914, "uuid": "04cfe821-ceca-4828-a486-4b74443b6e08", "comment": "Malware payload", "value": "ab7b6c1abfe92ed279fb1ecdf272ecfb3024ee86", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292914, "uuid": "ce33661b-4d94-437f-abfe-5eeae9463aca", "comment": "Malware payload", "value": "a0f156d97418ba095440a6965013f7347c9892ca3997c3aec12db8266c1f9cfc5064cfc2549329850215f29b619bf226", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292914, "uuid": "2e45eb43-8307-4036-aa0d-98afe901551d", "value": "T12B363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292914, "uuid": "b001862b-ff65-472a-adeb-24e8e58f0771", "value": "98304:rv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXt:rvpvFa+g8RWLdPk/84tCEr0RtNiC5eS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292914, "uuid": "83582678-8436-4b2a-b3bc-40d0341d5c8b", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292914, "uuid": "f376ee68-d8b6-4cc7-bdb7-f96cb56cce2a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292914, "uuid": "a32b3547-ad8c-49db-884a-827a8b64a012", "value": "abd9376a7a257d7359b836e2575c4239e2f73edbff7adc20c9ee8931bfeeef94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e5ba25-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675263720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263720, "uuid": "3f114f06-6d3e-45f9-ac4d-bd98a091b375", "comment": "Malware payload (SnakeKeylogger)", "value": "af48f996012aa84711c7d65663e1515c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263720, "uuid": "598d6207-3bc2-4137-9f00-59bbf143f6c6", "comment": "Malware payload (SnakeKeylogger)", "value": "ac32a1e6ae4396b358a90a8c11686346cf1951c4e51eab84960dd8f307d20aa3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263720, "uuid": "a70ce20f-acad-4b11-bbcf-c3ef9ea42c1f", "comment": "Malware payload (SnakeKeylogger)", "value": "5698857cc572dcca43a21fd89ac2f68081f1597f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263720, "uuid": "2f3dab7e-d3c5-4c1c-bd47-e939649be2b2", "comment": "Malware payload (SnakeKeylogger)", "value": "8a45f12e65afffa31d16696bd6396cd123cc25b1f4472255d600bd4cf30887aa6bf00318cc5c20fe638f55f57282df16", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263720, "uuid": "e7735af7-65f5-4e6f-8b7a-0f92b0f84c88", "value": "T154033C5AE79F0264CF411277271A0E89AABDB33EB35154B2746C833533EDC2D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263720, "uuid": "8d13a4b6-1236-4e9c-b926-d4882b7b5464", "value": "768:bFx0XaIsnPRIa4fwJMiUT08fDW3Tg3LUq1QTyi5EjKsKTYs/qX:bf0Xvx3EMiJ0DWc3LUqmTyiEj3YriX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263720, "uuid": "20eb9d26-187b-4c27-9cb6-8d3927379cc7", "value": 37763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263720, "uuid": "c5abd83d-9e2a-4530-b1a8-22d026ddf465", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263720, "uuid": "9aed1b86-ebcd-42e3-b034-3d1d4fda919c", "value": "QUOTATION 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4dae67-a221-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675250106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250106, "uuid": "655100d4-ee71-4f12-85f4-0f7ddedb389b", "comment": "Malware payload (AgentTesla)", "value": "d52ade696ca2f9790614276cb0634e8d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250106, "uuid": "95d2afa8-accc-46d7-8a50-a2e6539aeb08", "comment": "Malware payload (AgentTesla)", "value": "ac7a77071b947ec60c4dfa4c32fe8c2d0e7c34a5ad0ea05f5095b7a237fc9e22", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250106, "uuid": "c696d0bc-c8be-448f-90a4-9a84cd6bb98e", "comment": "Malware payload (AgentTesla)", "value": "aca5835ed98f788289058538506a5c56b92798ac", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250106, "uuid": "bf529c0d-e0c9-4446-b72c-e022482cff6e", "comment": "Malware payload (AgentTesla)", "value": "dc612e1919c395c6137350fb8b865415f087ae6c1369f00aaf2572e91dc6d25d27e4cfd66495beb65277011537d7416e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250106, "uuid": "ac4126d5-2d77-478c-80e8-b662272ff319", "value": "T1B65423D7F9C95824E6C4BA9FACC6524C9334B683E89CDACFB4B90367242DF975D41600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250106, "uuid": "9bb019e8-6be7-43b6-a7fe-0dcd991fc248", "value": "6144:F81SaSL7ZwLokB2wg2JjgfslhxNpNtScUBoXx+zVJ5G7RXUzXE:F81A9wLoS2azhxfIBM+JJ52REzXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675250106, "uuid": "cf479a26-a40e-49c4-ba70-8d61e37ac11b", "value": 295735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675250106, "uuid": "5b71359d-8c53-4257-a782-c61479abdd73", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250106, "uuid": "9746c0bd-1ebe-40a0-bcb9-723ff3bdb2e0", "value": "Our Project Requirement of AU-600 (300,000PCS) drawings.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ead38b-a215-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675244716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244716, "uuid": "fb1e137c-22d7-40fc-835a-039cdf813ccd", "comment": "Malware payload (GCleaner)", "value": "15a76fe0f8ca700b338b50c0f12d75fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244716, "uuid": "54b80bcd-150e-4cf4-b743-9dc07b3bf991", "comment": "Malware payload (GCleaner)", "value": "ac838b76e4b254efb33da303b4a1994839894249cf097e1f8be39a74b89435da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244716, "uuid": "68aca93d-dd0a-428c-ae40-576dc74c19f9", "comment": "Malware payload (GCleaner)", "value": "bfbde66891480e53ea9fb39af6c0a09947edb529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675244716, "uuid": "674e3bcf-dfbb-4aee-a5c1-b2c3fafbf867", "comment": "Malware payload (GCleaner)", "value": "f2e577c60ca60c2078f46bd315236c6d9b90e79e91dec3facbdfc25bb90a1af93fa113e05ea4959867fba27e06ce2080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244716, "uuid": "f6776517-106a-4093-8664-c876d89b8d31", "value": "T10FA52335293EDD39D2C01EB85E62D06B7A76BE642539D60224E67D8F3F3C7920D0C646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244716, "uuid": "dce70cea-34b9-4c08-8e9a-51b14574ddc5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244716, "uuid": "adb6da0a-9366-4767-a447-64aff8e43486", "value": "49152:icPLnQciOIB2Vu7OPuxp7yClwJLD8pAcU8elUbn0kDI4WJUt8TtLCgv2MR:XPLnQcfmZRxp7YJLAAcpemT0kDI9OCxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675244716, "uuid": "26fe314c-13b4-4da2-a045-2819964044fc", "value": 2207761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675244716, "uuid": "88aac87f-4474-4175-a0ac-e6ba11302119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675244716, "uuid": "6d15e038-961f-4a52-87f6-eb6f9d79a089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70000c1f-a26d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282643, "uuid": "3d318e1e-e0e0-4c14-b0d1-9bb9e35f60fd", "comment": "Malware payload", "value": "66b490281dfc5da85789bcd4cc096d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282643, "uuid": "bc77d3f4-f982-4d82-b260-2b95c8bc41ef", "comment": "Malware payload", "value": "aca51fa144d5e48ba00c19b279b338f5cc6e2c0f86b8ad34fe7132b932090fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282643, "uuid": "5cf595c7-d233-4def-bac5-f6dda8b74ff9", "comment": "Malware payload", "value": "32a3d58f49c5f12e731964b819deccf93c147ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282643, "uuid": "f1aa6010-da7e-4795-ab3c-cbadf7afe4e5", "comment": "Malware payload", "value": "df0fe86551f04252588ba6ac9ea1541065e7ff7b643621b605e68a937ac6f2d222383b7ad5944562042aaa15760fe357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282643, "uuid": "5ef03bce-fafe-4b3c-b273-24ff1e16257e", "value": "T101A523286ABDDC36E161AAFC9E30DA377762AF91143D5A0470E93D1F367F2A27C48105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282643, "uuid": "34ced9a6-c496-474f-9311-a738d1c96fea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282643, "uuid": "4771fec1-fd33-4648-b3c2-557cc7a4b8d8", "value": "49152:icPLnQoLOl4yak37sYFq6RglaQD6BmTw6vUkomP9QSC0qpLCgv2MR:XPLnQoKlqkIYClmEpvho1S1qFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282643, "uuid": "249cc58f-5a67-483e-8863-ce014bc7a420", "value": 2185248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282643, "uuid": "4d253e15-b377-4d0a-bfe0-b33d16a931b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282643, "uuid": "6efb3c3c-cf29-4850-a59b-6e23444e462c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8451d90f-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292985, "uuid": "663e1870-30d9-4374-8cb0-85803a66fe5e", "comment": "Malware payload", "value": "4d1b9ce7c152030e9c1a61609cd97ffd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292985, "uuid": "4f64e0d2-807b-4214-92c2-6dae4d8d6f13", "comment": "Malware payload", "value": "ad555b959d64794ebebabd8848cdfe7308d3dd74841aa752e05b522d9a099bf6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292985, "uuid": "bdb37ca0-7a53-4fb1-880a-bfcbd9f48f44", "comment": "Malware payload", "value": "3afea46e343e58c7bae85913018478605368cab6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292985, "uuid": "88c83e83-2371-44f5-8461-4efb4b5d0f72", "comment": "Malware payload", "value": "09e0fd6903dda0e3e66581d8fc09d2c25e0259e318c863b017b129a1ed0f8d48dd2d346f0f35b73437c4884d56dd1f09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292985, "uuid": "80252fd0-61b5-4b76-aff2-9a1ed23dcd11", "value": "T14D94C75DB9F72161596370B94BAFA405B278C0130508CE907D8ED3A4AF9093897FBFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292985, "uuid": "037100ce-69cd-4b92-b3f5-98df3e6edf1a", "value": "3072:0G2gnr8mBDPC7reHnSvqeZVqJrnRUlgdlHWiHZHz1NEVK9qdcr1woeJED/LLx7vr:0KQKDpnSvqGURJD/1Np9Fp3+IWi64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292985, "uuid": "a5e3278a-d58c-456d-94b6-e4a6d08b880e", "value": 433714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292985, "uuid": "431ca3fd-a061-4bfb-9765-924b5cc487fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292985, "uuid": "95e83f80-a29c-4941-a1cf-43091a753941", "value": "vue.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12587fba-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675265306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265306, "uuid": "76aaffa3-b054-4b6a-b2bb-ece386c78964", "comment": "Malware payload", "value": "7ee34d291cbad9fce10867b281cc1898", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265306, "uuid": "48f3b338-8f2f-41b5-ba78-7425d9405073", "comment": "Malware payload", "value": "add0650d6359a46fb81cf752a4d9e2b13b13e80d38d24c7bd5cee1029f400966", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265306, "uuid": "3570893a-5719-4f92-9d36-132808b38dff", "comment": "Malware payload", "value": "291a74b069aae05490bedbfe61858600c4c75b0e", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265306, "uuid": "2f75dd69-67f0-44f7-863f-e1f9b8275434", "comment": "Malware payload", "value": "375b6d735c8c7a4fca244b04220412559a5331926400b0b9960c24c9d9444793809f9381519d3ca45f50edc6b6dab159", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265306, "uuid": "c9f9f76c-4d88-408b-bfc7-a1a7ae59cfd2", "value": "T16004E11266F545E5EFE07BB24DA3971DAA2BBE27E212035F4BB56A2D4D64300DC04B0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265306, "uuid": "2baf2a59-ae76-48bf-bbb8-3bd7249ed2e4", "value": "3072:haA0YRw9/WITtTWR7IbNzvL1aEHuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCCT:Ba9xytedL1jr4iERByb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265306, "uuid": "c086d57f-b730-4d40-aaf7-9411441b5900", "value": 181432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265306, "uuid": "93f33014-7762-4698-b3ac-a26436055bab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265306, "uuid": "4e118a6a-5a52-4eb6-b488-1f32c5b83f7b", "value": "ComplaintCopy_24946(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32444854-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675279962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279962, "uuid": "7788f91a-c914-4782-9377-d3f88f1366f8", "comment": "Malware payload (Loki)", "value": "49f0d6e43350d8fb69f5cd2072c6a5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279962, "uuid": "ec4a8963-36b1-42ff-bd16-4eddec8c3630", "comment": "Malware payload (Loki)", "value": "ae25e045665c1d44a4a01fb8b902a2f8c6eff324c16e08ebc35761ef378ded78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279962, "uuid": "2fe2889f-eb7b-4e31-b9fb-3d20223fd804", "comment": "Malware payload (Loki)", "value": "4b4ff4f0fb248c14a915a9bfa00e8ac25ec0603b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279962, "uuid": "61ce31ce-d580-4dad-b4c0-e1ff67f2e261", "comment": "Malware payload (Loki)", "value": "9e8bf6306519ad83767a87b4bb3f76787df84816a0fe860e95409daf51b48c49fdf958022ae090d77761e8b50ffb800e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279962, "uuid": "c70f95bc-7807-4aa5-97a8-b7853015552f", "value": "T1C5E47B8777F1A8B2F68B10A6142837CD2FE07103BE95E2579B7B79C097059FB7298241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279962, "uuid": "674005d3-4e97-4457-8879-5a4259b6b3c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279962, "uuid": "f337cf6e-2d05-4b58-a8e3-4f93a35d6f7e", "value": "12288:Qtz8L6guquZajfTIISp83HqvKiiAEMToaxMRSR5SOqG4yPa:ZLPwCTIlEHOipMkayRU5JqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279962, "uuid": "ffe0ad19-83d8-4ba8-b54b-48ce5edda201", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279962, "uuid": "aaec5b7f-632a-4295-ba6b-0b54a8b15ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279962, "uuid": "b8d729c8-6ff0-4463-a19b-1ace9bce046f", "value": "49f0d6e43350d8fb69f5cd2072c6a5c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4829d76c-a25d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675275704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275704, "uuid": "043bcc4a-9fd6-40bc-bc72-43e9a707c1fb", "comment": "Malware payload (Quakbot)", "value": "72567fdae716b61b5215bb1def0beeb4", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275704, "uuid": "38ee9a64-fead-44af-96a0-56fdb634001c", "comment": "Malware payload (Quakbot)", "value": "ae410563d80ff196501e910682a5d2be987eb6370a805c291871d049b75e4133", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275704, "uuid": "11810e96-4696-45dc-984c-2a7962cd91b9", "comment": "Malware payload (Quakbot)", "value": "7f8ac13bf6477edb00a2c551dea2af92f674a228", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675275704, "uuid": "aa0b687a-4034-4f6d-bb1e-21183c49400e", "comment": "Malware payload (Quakbot)", "value": "9a1833568bffdd17187097b4191f31554fcb83be0c5f9c26370445e5847ef266b25ae80a8a4e4c57ae49107d1c41cc39", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275704, "uuid": "c2105706-254b-4676-95d5-56a01139bc89", "value": "T1E304E11226F545E5DEE47BB24DE3971DAA2BBE27E212035F4BB66A1D8D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275704, "uuid": "9932dc2e-707f-4657-80a1-8c8f9315977f", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1aNbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCD:Ia9xytedL1oEw4iERBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675275704, "uuid": "1153c33b-e7a1-4306-bcfe-dc6898394c3c", "value": 176258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675275704, "uuid": "4a4717ba-8d3c-425a-8754-69d480fbcd73", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675275704, "uuid": "cb8e0c4c-5785-4efd-b905-e041bf16b432", "value": "ComplaintCopy_13958(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3effd2-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675268221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268221, "uuid": "fad1ed4d-4a79-4922-a055-6152f221a709", "comment": "Malware payload (Mirai)", "value": "9dfc7235c20787de7cd9b4ea5398908f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268221, "uuid": "59ec7246-51c9-47db-b59c-8c4f786fbc4b", "comment": "Malware payload (Mirai)", "value": "aeb685e1e925741315e76d457984061cf4cacba08dc8f9985db53fd834d3c5ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268221, "uuid": "594a45d8-de37-4c5c-afec-aa12b8c3e645", "comment": "Malware payload (Mirai)", "value": "f5b3c34cd3f5426ff43a1d9dcee89fbffa7d51e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268221, "uuid": "7dfb1b38-030e-440e-9112-a652f24579ad", "comment": "Malware payload (Mirai)", "value": "cb2ca529e9cf869d61181d5e81a4117b0227cb7540c8951971480381115e3893bd7f4b77c091ef73f5bc7ed0530f5733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268221, "uuid": "acd63bfd-be96-4ece-a829-9270ebabd1a4", "value": "T1F4332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268221, "uuid": "c4e53033-56b5-479a-92e5-ef88129d4eb0", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gLS:mL/4f8F1ef0YgFvimzpZi2UJJnHY8sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268221, "uuid": "2000e40c-3760-47ea-90f4-6393629f98e9", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268221, "uuid": "a31aebc2-fb93-42b2-9de8-bd517f4c85a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268221, "uuid": "2ce976f5-a19b-436a-a787-2ba866a725d0", "value": "9dfc7235c20787de7cd9b4ea5398908f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59a9ea5-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293094, "uuid": "11e7f568-f693-42fa-896d-bb53e7ef9829", "comment": "Malware payload", "value": "9af17609ac27044d1c1cd25916b855cc", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293094, "uuid": "ef89f88a-2c49-4a0e-aa59-ac4fb11ec415", "comment": "Malware payload", "value": "aee7021ddb18891a3af1226f0e4138e1374e405fc7956a8c2a8118c0c5a7398d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293094, "uuid": "e365c58c-91c7-438f-b5cc-63aef96ace41", "comment": "Malware payload", "value": "827e35ff6956a8b7b4e7f4f36844acad912da76d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293094, "uuid": "b8d6a0c3-7a43-430f-88f0-186930fe35fb", "comment": "Malware payload", "value": "dc7530ff1918532599089c5e8c97e578f7a03bd91ba68ff796a991dc65a4fb62f90836340eca9c7dd00d7e2ba8fb2891", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293094, "uuid": "82c5578e-eb75-4e99-ab83-f3a5982d74e5", "value": "T1EEF068426176AB11C3384732C3F68247E13878539D99F7089021931648E8A15C0FF608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293094, "uuid": "dcc9e04d-95ea-4c68-95f3-6227dfe12331", "value": "6:4xtQlkuC+TColjeljtjOdWNAWclQRnINcXWS0GV9BhulUP0WzrN+IqMs+IqMjl:8bT+TC4je5tMOXdVhulUP0IOcYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293094, "uuid": "caa17f1e-3ff3-4e80-a6a4-54272b7118ff", "value": 438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293094, "uuid": "e59b98d9-6446-4b15-b1b2-2be91f6abcbd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293094, "uuid": "19f7048e-5a2c-4b85-8198-a93a63552871", "value": "z___Desktop___.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae421f4-a1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675224759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224759, "uuid": "e069f000-5f41-4466-abdf-93db1a70af8e", "comment": "Malware payload (Mirai)", "value": "31c2143bc09d232ea899eb301a306702", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224759, "uuid": "02f1cb5b-2a6d-486c-be7c-90e70bce8117", "comment": "Malware payload (Mirai)", "value": "af4465baf16dbabce3ed8a4676054bf4d129b0ffa87da867cfb2f2bcc03e0687", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224759, "uuid": "c07c1f53-4701-4a61-bb56-1116b17c6e2e", "comment": "Malware payload (Mirai)", "value": "7d8cd9f54fb9736c8f409336eae8edd04c6860b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224759, "uuid": "74316957-683d-46e4-ae3c-d49af7aeb213", "comment": "Malware payload (Mirai)", "value": "afaddf48d3864264a413bf51c80d51081306a05b9304e1e8cf5fe6b1c8420fdd720c28dc730d64c4dfcd6cbe2d2ce297", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224759, "uuid": "37594131-e029-4da7-9927-4d364d13bdb9", "value": "T186B2E138C0A5C98DCB8A61FA665D64B668272802C74FB117E1814D4F739B1974F71C27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224759, "uuid": "d9625b10-a0dc-4a95-9438-35658f393e01", "value": "768:97eMUU/c9cgGl4OFnNe5DG/orKBktUh1ZG:97zUR9cxBFnswor1U9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224759, "uuid": "9a67fe74-1091-49d5-9db9-ece1090cc18b", "value": 25632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224759, "uuid": "a47f9a66-94d5-419b-b947-63e1e0492d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224759, "uuid": "d594c10b-4ca6-4d67-a30f-687b936f4878", "value": "31c2143bc09d232ea899eb301a306702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9827631f-a273-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675285287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285287, "uuid": "f9ef5e50-88ed-469d-aa59-4dc87350249b", "comment": "Malware payload", "value": "0eaad9d4b22af4749f355d047465a2f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285287, "uuid": "76435b4e-f2c8-487f-95c8-fb6ecf43340a", "comment": "Malware payload", "value": "af8ce80f0e3fcb35b12c51b4d63c62dc8ee4946496055b3de2bffc05d9503a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285287, "uuid": "df356a25-0cfe-4d6b-b941-142812641dd9", "comment": "Malware payload", "value": "96b048898d2aca27c39943d82c82463bfe308602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285287, "uuid": "4c15cc09-6b74-454f-a537-98447a21f9c3", "comment": "Malware payload", "value": "467f8566e01fbe3d786f34d1c7f2f4f1b5132675f236e2800d49e4021fcdf2f8e044aab6c9b66f0acdfad17292d33d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285287, "uuid": "57eb2709-71c0-40b6-b1ff-96e005b26e19", "value": "T1F2A52315BA7C8C73F2439EF81D11D136B622EE2525389A2135E93C5F363E7D2AC89583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285287, "uuid": "b6c9dd64-6bf1-42e9-b9c4-dc4a86fd00b7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285287, "uuid": "d4e111c6-cd50-480f-8473-08eb50fd2b2d", "value": "49152:icPLnQwkonFv5xg8dnoWk+J4bDoxbk5/m8HaLCgv2MR:XPLnQwkonFv5xg8poWxLxKexv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675285287, "uuid": "7a68e4a9-68a5-48ca-9add-e29d203c24c5", "value": 2206622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675285287, "uuid": "5a5dd70d-d4eb-41c7-97d3-f72a1847fad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285287, "uuid": "f383626a-b6b6-4796-90eb-991df0d44b67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a45a12-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675280100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280100, "uuid": "b59b064a-702f-4653-b3ea-e5346c72a0d3", "comment": "Malware payload", "value": "1ef6d59a95b70f1d2c6601f519423ada", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280100, "uuid": "6d9c83f4-ebc9-416a-9202-ffa82b1e617e", "comment": "Malware payload", "value": "b00862f3ee3a02c4dc82bfb1de4ae299a502b37639c745d7e0506e9a10e46baa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280100, "uuid": "35934d13-b78f-44d3-9413-59ac9c49e0e8", "comment": "Malware payload", "value": "bf3173084469b6135c2d4e31353db790dcf28280", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280100, "uuid": "0865504d-ed96-43c1-a4eb-87c7bd7d881f", "comment": "Malware payload", "value": "5be912373057c0d3de36d0d74077287b04794e451af32b081ef82290a7f2fea7e98608a76e94b15892b62ffeb99c2434", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280100, "uuid": "a3fbfc7e-d7ed-456f-95fa-715e9064e097", "value": "T18DB2C025D3A2161BC2214FBC0062225AF67A7D406813759D2EA5DFDC88267F41FA7ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280100, "uuid": "98c036e5-adfe-4e48-b673-ee1634f79c73", "value": "384:Ke6aWTvPq944dhpAPSZRMUNW9/9S5bB+Kc1eLUPmcszBU6HFuUUgR88WM:H6aWTXS44rmPqNW9l2IcQucsd5HFvUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280100, "uuid": "422ef8a3-0c13-4463-8609-2cf3643fe621", "value": 25601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280100, "uuid": "3ae1ed60-e2b7-4749-81ef-d6b74b3f67a2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280100, "uuid": "118b82ae-aa64-4a36-bf5a-b7e081a36355", "value": "\u8f6c\u81ea\uff1a2023\u4eba\u793e\u90e8\u7b2c\u4e00\u5b63\u5ea6\u767b\u7edf\u8ba1\u76f8\u5173\u8865\u5145\u6750\u6599\u30022.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d0eb78-a23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675260928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260928, "uuid": "c46b4828-f3f7-4d9b-90a0-ac69673811e7", "comment": "Malware payload (GCleaner)", "value": "4141e2c18308b806b8233ff0096d130f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260928, "uuid": "58e92ee4-ffa5-4124-ae15-030a01c06513", "comment": "Malware payload (GCleaner)", "value": "b110e73423fc70f4d04355894be343a03af8ed49914c5b1226c0bd31957cbafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260928, "uuid": "79d6301c-7771-47ac-9a34-bb3772da961a", "comment": "Malware payload (GCleaner)", "value": "420013df98c3f914c621dcebf3b09b2ef232d84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260928, "uuid": "c2f63401-bb54-4447-ab1e-032953354aff", "comment": "Malware payload (GCleaner)", "value": "f50fda8cc69779c718d2e988579cfced33f99c6bd5f3ee61fb2befa12315f2acf24bb6823e0d83d97abc6f32a52c9c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260928, "uuid": "cc3055aa-ad96-4ee9-993e-2270d3d446fd", "value": "T1B3A533257978CC3AD292ABBD2E23D5628FB9BE61443C4613B0DE3D57363F2C21D58252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260928, "uuid": "29c357f4-1dd8-42ce-b998-62ad73f1a963", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260928, "uuid": "3b9f368b-6c45-4250-b02a-84b7531145e9", "value": "49152:icPLnQ5dSbqcUfr2SZlXs0I+O99EfnNF48VCyGuy3g7jsw/1ZYMKoLCgv2MR:XPLnQ5onVSfXqD9WfNF48Vr9fsw/nYMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260928, "uuid": "72c6e8ca-dc85-4adc-a855-a1065702c6d7", "value": 2219170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260928, "uuid": "7b915451-a356-40aa-b387-3cb7ffb7c4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260928, "uuid": "b25325a8-fb03-48cb-87e1-0a8e88810c08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e05c51-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264100, "uuid": "86cff5cd-1d18-47a7-8ad5-0279c3b45ee8", "comment": "Malware payload", "value": "4dc206376309a1f3012a28c03e9fb436", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264100, "uuid": "c12e8ccf-5c1f-431e-adf4-6de3d252ef4d", "comment": "Malware payload", "value": "b1161dcdc714b276a85f713eef8f75ddbcc36dbbee6cf89da36249f860ff99f7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264100, "uuid": "e14d9c7d-6146-4eb3-9ca9-38df06a574d7", "comment": "Malware payload", "value": "c3a20fc994f07550ad31e70f4427ca8462c98d89", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264100, "uuid": "03bb6aa0-79db-4301-89bd-c2e3253fc1cc", "comment": "Malware payload", "value": "c0f628de27358143f768846165b4b01a3b9434e5588c42918bc61a78ea77b8b34a648d30c8d4d493c0eda8d827e0bacf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264100, "uuid": "8607f36e-ed63-4016-b559-1018ea96af56", "value": "T1CEB58C2275C5C632EA6F4330652ADB7B61F97EE0377340DB63D8962E0E719C04276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264100, "uuid": "27c7d435-1356-4bd7-92c0-408e1f4c2c82", "value": "49152:19JYUMV3eVougTzAFPsJ6ma8zotlmfwrgxMy+y29IAan6Dr24vLNgmUESIEjPMNI:9YUMV399AlAfwrtyF4veHjPMNaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264100, "uuid": "dda22eaa-1dbf-4f5e-86ce-c7c1eb76ec68", "value": 2429440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264100, "uuid": "9f7c62f2-dcec-47c0-9018-a623c078ad90", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264100, "uuid": "cc333d9a-aa06-4516-9fcd-caa34fab6d4f", "value": "4dc206376309a1f3012a28c03e9fb436.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8c0c64-a1d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675215156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215156, "uuid": "11909daf-5beb-46bb-ae73-e35cf57e5942", "comment": "Malware payload (Smoke Loader)", "value": "76de3dfbd302a3ee0aa382233c19ffa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215156, "uuid": "58330a8c-a710-4a83-9141-29bdbcc938f6", "comment": "Malware payload (Smoke Loader)", "value": "b14909504d2bd6de17ce36520814b64ddeb074d6192985fa8eb04929edc7a9a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215156, "uuid": "b2beb334-d57e-4f41-a877-ebdf2df9f8c4", "comment": "Malware payload (Smoke Loader)", "value": "1d089bab53e6397fab62fa0b77777691ab104be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215156, "uuid": "3e03881b-39d1-4072-bb16-9cf118a2b9b1", "comment": "Malware payload (Smoke Loader)", "value": "64e65511176d940a800f3b66792a235467815f95aa8006ddd9ebafb1d60001d2ea448038fb2b21da7a42337c940d5db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215156, "uuid": "12935253-d248-40f5-aa02-b89b0a49f5f9", "value": "T10B549FC272F27C62E9628AB19E1EC6F4751EF5535E08BB66121B9BDF35B01E1C1A3301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215156, "uuid": "a25fde85-fb79-41c0-8079-ea1f3363f40f", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215156, "uuid": "a311ae38-4895-4c67-9985-598642fb5924", "value": "3072:zZBzk8L2tRcQRFa5IIiCAhYXpNjULRj0TmqPUx6WfQz86b2GDR3MM5:/k8L2QQRFGDiRaX70p0TmqMoI1GDR8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675215156, "uuid": "117b02b6-1d0a-43ee-894b-a512a0e35a95", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675215156, "uuid": "84b410a3-f2c4-44d6-a31d-e7d6bf765d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215156, "uuid": "945a0bc1-4c7b-4dee-aaa8-e0d9a450eb60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793d292f-a1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675209644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209644, "uuid": "50eeb987-a548-4a5f-b8fa-7ce89c0dd3df", "comment": "Malware payload (RedLineStealer)", "value": "5e738a1b3f21da96b62e3812b614e0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209644, "uuid": "3349b62b-34ae-4f4e-a9c2-35209f2a84e7", "comment": "Malware payload (RedLineStealer)", "value": "b278840d94cfe1ddad67a23f2445f64564505def1c88842290b94c73db7481d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209644, "uuid": "98566690-ced2-4f11-87a7-7ea30ea0da89", "comment": "Malware payload (RedLineStealer)", "value": "beb2513f868e45bd88d50ef0a09491aadb60e7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209644, "uuid": "12156580-98ea-4d93-bfe0-89f0311d04dc", "comment": "Malware payload (RedLineStealer)", "value": "6f28c01a463868221669b3982cb0d942ac88a06af1c6a9f4dcb2dec0d57432fb62b1a8863ad7b49c223207322d521f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209644, "uuid": "44c22fdb-b5d6-47d7-b491-26ea854f3d0c", "value": "T15984BFC272F2BC62E8628A729E1EC6F4B51EB5524E097366121B6FDF19B11E1C1E3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209644, "uuid": "bf57421a-54a2-411a-af6d-3da8d00ba456", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209644, "uuid": "ccc58844-fc8e-4391-be73-115039fbbe0e", "value": "6144:x6BLXmxIkgEzXeTDEhVoBywNosVpSuIV73QmqMoI4K8M5:xgbMao0DmVKyuCugqMdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675209644, "uuid": "925a1cc2-a256-469a-ba2e-1072c7f04ada", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675209644, "uuid": "1f435e3a-620f-4be0-b15e-0abd1a552ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209644, "uuid": "dbd1eadc-8507-4fd0-a7bb-83ff40a2a191", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7425c0-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675278770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278770, "uuid": "1bb66906-46c6-4ec5-87eb-24d822fff436", "comment": "Malware payload", "value": "54b184637b4808caa589a2f4ffa65757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278770, "uuid": "3d883555-8495-46db-963b-802a5d17dfa4", "comment": "Malware payload", "value": "b2baa98687976b501340744ff2a3031f904cae6f1cacfa8684ec0d474900d831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278770, "uuid": "b41d08ec-27e3-4892-9b93-4ae0b1bd5a27", "comment": "Malware payload", "value": "965cd42391b99ca7ecfc8fce93e67cb0d2564e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278770, "uuid": "bed64930-d7e0-4f61-9ab7-feaf47a4c86a", "comment": "Malware payload", "value": "df77a1fc5d6ebacff3f80f0e557ca743d9d0dd6cf3e77cc47b2a15483b926116877337f8cb6bf3bbffb03cae47850677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278770, "uuid": "d155a543-58f9-4d61-83b3-fb4760b0482c", "value": "T1A57633293EF895FAC542ED329448BF80E2E5C0B857B688A3075D4D6C99BC019CF75A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278770, "uuid": "5858faa3-8c83-4843-9986-9032f2873715", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278770, "uuid": "adf89fb2-99eb-404f-919e-1a3f26ab176f", "value": "196608:91OC2qbN8GhP+Mx5eQMcZce5dwFa+9yA3euml8Ts:3OC1bN5NfZceoFa+oUeumos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278770, "uuid": "75a8a62a-1c88-43c4-b721-f01ffe141507", "value": 7620763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278770, "uuid": "50097e4f-6da3-4530-a13e-95c54536d673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278770, "uuid": "4e9a666e-a5e0-499a-a8d0-778c02b541c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c333093c-a1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (NoCry)", "timestamp": 1675233390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233390, "uuid": "6173362e-46b4-44a6-bae9-e541b4bddeb9", "comment": "Malware payload (NoCry)", "value": "f9369d1c7fe1d2797d23f20ca19059a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoCry", "colour": "#BAEDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233390, "uuid": "7a6c835d-559e-4e99-9664-105b95382ab7", "comment": "Malware payload (NoCry)", "value": "b30ef4dbcc89cd4bf0da3e7787f43e42023ddc2b5f0bb4f24937538e10e17533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoCry", "colour": "#BAEDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233390, "uuid": "9edeb32d-e5a7-4109-b183-2d21e7be5044", "comment": "Malware payload (NoCry)", "value": "16e378519bbd97467f751064b17276f2408441d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoCry", "colour": "#BAEDB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233390, "uuid": "da6eac65-87ee-4459-9b85-c158a20c4625", "comment": "Malware payload (NoCry)", "value": "0dae36721b3514380f253bfc435c5ae04fe2a5845e859a8b93dad115294340ba1af6568a904950e5686dee179b7b3e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NoCry", "colour": "#BAEDB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233390, "uuid": "b16dd61f-7539-40f8-883e-014ddd7e48c3", "value": "T19EE42513DD04CB83D12883FC2A534F7C2AAE7F4A9542ABEB15715E9A3E312510D8F56E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233390, "uuid": "cbd4e4a9-1034-45c8-b673-f00aae628086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233390, "uuid": "0a15e617-fb98-4713-bfa9-34681bcff0d8", "value": "12288:mWVEtVuZqCUAgmh0kM9Vipj1cXWWTBz01W0ZJ9WE3QqH3cAb:9kk4A/6kWVipjMK333cAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233390, "uuid": "5c126229-ea39-4cb2-ac52-7150c524d6c3", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233390, "uuid": "f0144567-377e-4236-8e7c-13c7e1d1d994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233390, "uuid": "f0989678-6c48-4e27-bc4d-57b20ec7425e", "value": "b30ef4dbcc89cd4bf0da3e7787f43e42023ddc2b5f0bb4f24937538e10e17533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5525ef37-a26f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675283457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283457, "uuid": "0be30e85-7e31-4891-a99c-d3964148c7be", "comment": "Malware payload", "value": "0d75b2e53df60b5e986a14bc0a86e4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283457, "uuid": "52870be8-1468-43f1-bccc-ef58cc674467", "comment": "Malware payload", "value": "b44e0444c43bf8fc84091b78a3e0dbfc48a0e8aba0022322cc28d1f9f0f90598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283457, "uuid": "ab40eb16-218c-4b2f-a930-d2e4e0987077", "comment": "Malware payload", "value": "92b065b66b6de558bc76119a634f6610469c9af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283457, "uuid": "6af7aa76-52cc-49b4-b7fe-609e61929b68", "comment": "Malware payload", "value": "a4ef7df913fdd5e7de33c2ee520a3eb14a222b3a17ea9c3cda808e6b7dd55f0e70c3beeaa2ecbcfd6af4f8908033d409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283457, "uuid": "36eface8-5016-46c5-aa54-44e9c6b377e3", "value": "T1C8A53305A61D8936F29174F8BB25C232AF73AE051974572361E63D0F3BBEAD3394D211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283457, "uuid": "da2e994a-afdc-4263-b272-88f2452637d8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283457, "uuid": "01d08b2e-48a1-4361-b3c2-fb579c943a35", "value": "49152:icPLnQKmgAWTAOcC4WurCGqQ1we8OwkIaOrtNq1/lYAu496LCgv2MR:XPLnQK9HTA7AYtlwNOwkbOXYu4Yv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675283457, "uuid": "c684b62f-84d8-42dd-a044-e4a7d92f7907", "value": 2225032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675283457, "uuid": "a83d7ffe-0a64-4081-bc2b-30d6d06e5a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283457, "uuid": "c9aefaa9-975f-4101-8d33-91b50f47aaa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9a3699-a234-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675258206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258206, "uuid": "dc8ae5f2-20d4-4451-ae75-142b1430ab02", "comment": "Malware payload", "value": "bdb0a1544118a9071e7dae15bd8478a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258206, "uuid": "c5accbd1-a387-4372-bbe0-b972ec34032e", "comment": "Malware payload", "value": "b5abc9ceea36dd7e1dbdd3e0b65c99c2b1f88cb58bac9bff38d4067ef7ed25e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258206, "uuid": "1aed6694-7918-44c5-a94a-95ec10e5448b", "comment": "Malware payload", "value": "291cdf5fb830cdb241683f2de4d82bce6550531f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258206, "uuid": "45f45eba-f16a-4310-89a2-55a8d8a1e6b7", "comment": "Malware payload", "value": "237312c40a84f6d094c1c921a791e13ee4fe15b962b22ba9e77dd108e0ced298fcdb42e30886598e5ca5cbd3c2b6ce54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258206, "uuid": "487242c2-d011-4ec1-8d29-ca62752ffbc4", "value": "T18F14CF323BC0D072C5BB51705C20EAA57BAEB9315838B84B7F941A7E9F716E02636357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258206, "uuid": "8502a113-495c-4fad-a374-afdfd342315a", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258206, "uuid": "05fdb485-5fcd-4161-b677-6bd03c9e57e5", "value": "3072:Q6wGbrLcGvF4RgL5jJJWx0u5676HvIIhT3vIPOUbw51ePa8Y0:Q6w5mFxLFJJfPigQTFUcuPa8Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675258206, "uuid": "dbdad1b0-3e23-4e7a-9222-50757fd2a651", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675258206, "uuid": "ae0c2a59-618c-4625-846e-7ffff288a3c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258206, "uuid": "020d0531-6926-4d47-aeb2-f2b9d5c12f27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4f41b7-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675280011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280011, "uuid": "14c742d9-d97f-4c73-8a43-ba595bbdb1fb", "comment": "Malware payload", "value": "330b6da7adcae1cd2d6cbd0c46238630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280011, "uuid": "d1652b5f-459c-483f-a0cb-010eec58aba0", "comment": "Malware payload", "value": "b698d8d059eca17a310182cd6d73a93f812d0a879cf1da9956e28506421e8474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280011, "uuid": "113917b1-3cbb-4aa3-97bf-5961f245e88d", "comment": "Malware payload", "value": "c0827059130082745aed2ece96cc53ab85887133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280011, "uuid": "4002c380-f490-47de-86f9-da2caf337b9d", "comment": "Malware payload", "value": "7bef3b66c87e2c7c3c2e05d2db00b55ee135f3cf01d9502520fa61d00f22cd61e907e96d7f669d5f4783c4b47cdc83d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280011, "uuid": "9cdf4177-4fd4-4a3c-af97-4ad8ddb6ef55", "value": "T1B695333BB580E433C06348768A0072A2377D75301659F467BA3A5F9E9FB16F0B362796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280011, "uuid": "f35f942e-6815-4523-b71e-95edd41358b5", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280011, "uuid": "156f3aba-5dda-42ff-b2c8-6e530b45cecb", "value": "49152:Ml5nGImR+G37tmSw3FdnlXkidiCq6Z2zjz:4F/Y3p/clXk47Ojz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280011, "uuid": "51310676-8deb-4e3f-a437-2a2e422121c9", "value": 1899520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280011, "uuid": "c7e96b9b-8923-45ce-926c-e84a4aba3a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280011, "uuid": "628b61bb-f658-46cc-8acc-d44d0ef8c9a1", "value": "330b6da7adcae1cd2d6cbd0c46238630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf75ea-a1da-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675219364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219364, "uuid": "cec85db4-e96f-402f-be4d-bbedbb1ce18e", "comment": "Malware payload", "value": "cbe60582c0378c5aeedadfabbd0e1701", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219364, "uuid": "21c1e81e-f8d5-41a3-b768-6a1554f231d4", "comment": "Malware payload", "value": "b726b0baaf24ba3f784b3651e51982d7f87c3a9003ee967d04d8497da390cee7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219364, "uuid": "4ac45a53-bac9-47bb-8171-2a1c1f1afabc", "comment": "Malware payload", "value": "acd340da44bf773114a0352bb270a22616d9968f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219364, "uuid": "0dde1004-7350-43cc-b279-fd7908e43001", "comment": "Malware payload", "value": "1a6f2948bec5080cb53647f4689124ae7b9d0acd8eff30bc44e551999449c4234e9157375bffe877fa875e25b020e404", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219364, "uuid": "e26ae9a5-3802-412c-8d3a-2ea34fc2c149", "value": "T1CE2733A3180A9CDAD032B435457F23456875CA2E3EB37B6210549F77C6F39A689CDEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219364, "uuid": "59a9624c-bbca-43c0-a6eb-3e0372aadd31", "value": "393216:jzEsJA35z7A79L+AQX1mbgafiubcLZjbRT9i/zVN2I+TXOtiKpPbNiRSKcs6J8:XLJA35z7c5ClmbBffcVj7i/zVN2Ik+UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675219364, "uuid": "830dda68-1c1b-4ba5-a8e0-a6943a10d0c5", "value": 21502817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675219364, "uuid": "6fddf1cc-0b10-4d08-b2ba-eb75de3a0f32", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219364, "uuid": "fc881344-bf18-42cf-82e5-0a7f4e36025a", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a1b26f-a1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1675218684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218684, "uuid": "f8dc3dec-9f7c-4f56-b74d-291b3f628789", "comment": "Malware payload (ManusCrypt)", "value": "43511593782300ee52c2342ee7736aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218684, "uuid": "31d65c52-3bde-4285-9f86-970092cfa8ac", "comment": "Malware payload (ManusCrypt)", "value": "b7383e2dfc343f2384e76f06770082add0209b189314287dc4aa8eb966be6a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218684, "uuid": "d79af731-8629-4985-8a92-fb0a6528dfe4", "comment": "Malware payload (ManusCrypt)", "value": "afb4de45f31aa8c2af29944c8857bc3531b93226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675218684, "uuid": "efea8ab6-8a08-4a3d-9b96-ea49f84bbff1", "comment": "Malware payload (ManusCrypt)", "value": "65a19c5e6a60751eb6f37080d3226a784baaf26e30d3f2284dbe4b750167e12adbf67dca587a423e5dcba496d84296c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218684, "uuid": "09158a7f-e1c3-492d-b22a-737c3905b5c8", "value": "T19F548EC266B2BC62E9328E31AE1EC7F4751EF5524E087766121F9BDF25B41E1C9A3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218684, "uuid": "2d23801f-4afb-4529-8cec-2466682c793c", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218684, "uuid": "39ab084b-585f-4735-a846-23bb08dae1c5", "value": "3072:KKBV4KLy3RcCeh4GzMY901S8W+8JXt01c4/PRuJ4RumqPUx6WfQz86IGAQp3MM5:94KLy6wyh61Ik1v/Ju6kmqMoI4AQp8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675218684, "uuid": "2ccb0939-56ab-4c88-aa74-96f1c1a459d8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675218684, "uuid": "a81f68d1-cbc6-4396-a24b-f0fab0bd44bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675218684, "uuid": "9877e851-69e6-470d-ac3a-317a9ba69ba3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1b9bb5-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675259118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259118, "uuid": "c3cf799e-27b7-4b4f-be96-6c226563a1cc", "comment": "Malware payload (Mirai)", "value": "634551682c0ba7a782b47919e78818cf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259118, "uuid": "3fc4393f-56d5-44aa-b507-a22b16b13ed6", "comment": "Malware payload (Mirai)", "value": "b75079d2461440a03bfeb53e9e44ba59230962a9d6f34c8749b6c8ea35a8c3de", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259118, "uuid": "3819766a-355e-44a1-90b3-9be0e9d22e05", "comment": "Malware payload (Mirai)", "value": "12f0b8b414c38e3b2bd31f818765ad75c134dc88", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259118, "uuid": "998da52b-2df0-46e4-8af9-9a4b07d49639", "comment": "Malware payload (Mirai)", "value": "f38dc1dd143c7c312b27178df1f6065078c2882ee28d93c515ed955fd9c19de7cc34b3a6cc7b1f751f8a2f96bd32411b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259118, "uuid": "a5c3d45d-7f91-40e5-a958-31e9eee37809", "value": "T128530847B44180FDC149D03447AB6A76C8237EBD1B3AF39637D8EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259118, "uuid": "ada4d0f0-77bd-4525-8c96-c4853b07f61a", "value": "1536:anF9U0FferGtOW4/RWo4Jz8kkRqw/hJOlQ5M7WR:0FK0UrUO3JWvgRqw/Olr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259118, "uuid": "13e9e698-9508-441e-846c-949981bc97f2", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259118, "uuid": "9dc8fe3b-a8ea-47c0-b05b-ced99b3b2091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259118, "uuid": "05abf4ec-00fd-4577-a1a8-92d1f24434b4", "value": "634551682c0ba7a782b47919e78818cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25b0d64-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293089, "uuid": "16eb9153-2541-4304-8910-e30caa0a1e53", "comment": "Malware payload", "value": "483e3e0b1dceb4a5a13de65d3556c3fe", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293089, "uuid": "66566552-978d-4510-9a29-858ea266d6d8", "comment": "Malware payload", "value": "b7533ae3057764c8734ebdea13e766eaa92ad38f7ab41bb267b9b44a550e1507", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293089, "uuid": "44348209-d1a0-45d9-8730-fd2d86881019", "comment": "Malware payload", "value": "e8b0785e58fd864c16fe4a58ee734d0fc93702e5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293089, "uuid": "cadd2690-920d-4565-b15a-6db8c138b5b8", "comment": "Malware payload", "value": "379ffda6df6509e765757875a76ab018eb851c1095f2b75704409ed9214268fd562f706c110e1150b8b45004cdaa29c6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293089, "uuid": "354d930e-6a82-4a3e-80f1-7dd8de537fab", "value": "T13701270C1E8A1B22C375CD3754DFA316C9393D86FEA28F2A40E05BC96429100B5A6C2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293089, "uuid": "69f90e58-bb24-499c-8ab4-ee88ce59c382", "value": "12:8AlX6m/VnEXzzeMDGR22efeDJLgc4iN37+lbYqlTRUAN1r8:8Abtn46pefe5g6rab/nUAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293089, "uuid": "7578e14d-70a6-44db-8483-09315b5c5610", "value": 720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293089, "uuid": "efe5b5c1-df50-4343-8987-c255aac09534", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293089, "uuid": "afd0e45e-d7db-486e-bc67-19ab51499547", "value": "MSAssist.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0e8a36-a274-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675285641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285641, "uuid": "db35970e-aa6f-43e0-8914-b989af00a9f9", "comment": "Malware payload", "value": "8e81d940f0c8c72157f2eae314456aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285641, "uuid": "ec050e33-f151-4798-8036-434c929b4a09", "comment": "Malware payload", "value": "b7b0b7eeec44ec80f82a9bf0a99fe471898e0106a2541ba5eb5a48d7ce3a48be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285641, "uuid": "5b7d2c0c-9466-46bf-9ee2-ad79b9b3ee7e", "comment": "Malware payload", "value": "22fd1dc258d8592cbc6246d1872289079756cc59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285641, "uuid": "bc6af900-2b88-4bd7-bc25-529c029622a8", "comment": "Malware payload", "value": "ecdf6cc6821ee133ab610bdc705369eaf3f4dc5227a2f2934b5b73c786065b91de585c955aee78ce2d08f8facd2d38bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285641, "uuid": "90e94fdf-023b-4bac-9c91-be3654a8f4f8", "value": "T151E208067BE94215D6BC5AF88CB313214772E3838532EB6F9CDC88CA4B676D00655EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285641, "uuid": "47e6e834-a842-44d8-ad34-5269885187a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285641, "uuid": "6aac80da-a1ab-4a88-977c-15005b8a1b3c", "value": "384:B0bUe5XB4e0X7Od/w0Q0mS03bWTetTUFQqzFwObbI:aT9BuCi55DubI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675285641, "uuid": "0f804963-ab5e-40f8-9a27-cab61d5b1044", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675285641, "uuid": "4fc2dd76-bd48-40b0-975f-09a2fee8df4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285641, "uuid": "5add42a3-61ce-4048-b395-2336e3105ab2", "value": "bJu9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4937a470-a218-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675246070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246070, "uuid": "accd29cd-c2a5-4114-8772-1c65de9cd9d7", "comment": "Malware payload (GuLoader)", "value": "83e1df5c2686120c9f912bc1bb78d17a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246070, "uuid": "32479adf-494d-4f8f-a797-e5942d4c5676", "comment": "Malware payload (GuLoader)", "value": "b7cca3a1b9ae02bcc9f1b15803d8765227c85cd0fc75b6b030f48a9aa3ade38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246070, "uuid": "003dca0d-1642-472b-b1dd-6525608630e8", "comment": "Malware payload (GuLoader)", "value": "9ed08995f400f849d9ce7b700d6c2db028b8c8a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246070, "uuid": "741d8fb0-a17c-4b37-82b5-5cb56ee3b04f", "comment": "Malware payload (GuLoader)", "value": "0a7bf42a5e13b0d8e04ba223570b6f588b29a82964417e638d9c88fed14c949f9cc0515ffc209b31386b29e4735eca9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246070, "uuid": "59e8beff-6526-4922-8cce-5119e8443e8a", "value": "T1D38412C4B6D0D82AC4D677318C334AE2AF686D236D64AE13B7D0B79E7431391682F395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246070, "uuid": "0eec0e1f-276d-465b-9ce5-57cf2c4fc37f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246070, "uuid": "a3a8e6d3-0b45-4d82-8a14-32d07f385cbd", "value": "6144:2wq3NpeNwUfpYzojEq7Mk+n2GHapRxyZxjBc4l3yfgMKLB3cAUC7hneCUJ62Kh6Z:2z6yiEqDkBc4l3yfCLrUQ4CUY2KhAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675246070, "uuid": "00916fe2-880a-4a3a-84b3-4a330866cfd2", "value": 400287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675246070, "uuid": "840a5d1f-675f-49e8-9d77-4ecf59439cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246070, "uuid": "af44c093-4e8c-493a-8998-8f628065c814", "value": "Wyciag_26_08102045800000190201217926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f0ba5a-a203-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675236972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236972, "uuid": "c5f8273b-02d3-4e9d-a867-5ca8c6d913c3", "comment": "Malware payload (RedLineStealer)", "value": "a746db0666bd903ca4f7f4307eef001f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236972, "uuid": "f8ff7d02-9d4d-4bab-ae9b-046733dacc54", "comment": "Malware payload (RedLineStealer)", "value": "b7faa830bc27b78d800f502287390de670583aede841d9b6579b3aa311718d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236972, "uuid": "33d16089-1465-4c60-b2a3-15ee0a83a5a2", "comment": "Malware payload (RedLineStealer)", "value": "4e91316e4e0a56715a5c490e6aa6caa884be7e9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675236972, "uuid": "c668c906-ad79-4881-8322-af1195acabc1", "comment": "Malware payload (RedLineStealer)", "value": "894c11d846d7aa9a79443acdb27d010e3ac02079b3ea29afc16fa8d6ecb06baaaa530f66cebdb4ad02eba4833e00411e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236972, "uuid": "ac3cf2df-ac90-4910-b7c6-bd114996a629", "value": "T19784CF1292B0B9D0E722C771AE5ADEE4763EF4747E05EE57320BA61F18B52A1C523313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236972, "uuid": "144e532a-3c36-4b31-bb0c-b4a3634cd0f2", "value": "2c380dcd822439dca6dd27a0d1073060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236972, "uuid": "cdb680ee-e598-4c00-91ff-f82181612792", "value": "6144:aZLzCvNWEqqymJLQV5ARBYs+Ti94S+Elea2s1tGCGFTPJwIqA7KQu55u:qnQNkgJkkcT22+tGxZKd57/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675236972, "uuid": "d8f9dd71-fdbf-46bc-8ef9-4eb8553ec8ec", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675236972, "uuid": "68f6349d-4be2-4e71-8536-de92396a840a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675236972, "uuid": "ae40ff05-79c8-48c4-81f9-4a058c5339f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66955f68-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675263729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263729, "uuid": "24cd4bcb-5f32-42e5-bfe2-8d70d0904db8", "comment": "Malware payload (SnakeKeylogger)", "value": "03ea4b4b0950a33412a15b9b86003e10", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263729, "uuid": "c8d744c0-97f2-4e2d-874e-db55987f1d9f", "comment": "Malware payload (SnakeKeylogger)", "value": "b81e9131290cfb8839d62a4c6d83e048d329c0659df12c962c9f9904c534ab1d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263729, "uuid": "d2ff7cdf-2b5f-479e-9845-2cae6471a7e0", "comment": "Malware payload (SnakeKeylogger)", "value": "bb2e5cf955ec24d03166482a2b7b013a26294037", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263729, "uuid": "e656c44d-8f27-4aca-8343-7b4cf9903ca4", "comment": "Malware payload (SnakeKeylogger)", "value": "69ebcc286d6c414d7777844e4637896fa79c8d254e48d0339d7a6f5f768fd859e133a23f5af2b4240ec6b802c631e368", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263729, "uuid": "821ed84c-2ffc-4b85-a84d-f0ab75b66581", "value": "T165A4BE633502EE73DA508774AFB3D9A02367AE027D056A972292731E6FF338064D5E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263729, "uuid": "b8088b7f-9250-43a6-af75-6e11052ae25b", "value": "12288:oaFiKXKnSlVgokqEBER3elRQ+oKYdEcsOJH:tLKSl29q28elCrKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263729, "uuid": "5f39cf29-a0bc-4b47-91e2-8f0874ec7a5b", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263729, "uuid": "f94f1a92-3a6d-4995-924a-750dee54cc56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263729, "uuid": "e39195f0-e4e4-43c7-b27e-d16954602412", "value": "Product List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c049647f-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293085, "uuid": "9eef89a9-1b39-4c95-a7f4-b9901694d51d", "comment": "Malware payload", "value": "b0166f01c48a7a117019d1ebdb77e8a2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293085, "uuid": "6c262f19-c704-414b-a90c-1c7d603ad4fb", "comment": "Malware payload", "value": "b968bc92e3f0f62037ab6f29c13ba6895b6b2d78ea04f32eb1aceca9b509208a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293085, "uuid": "fb250ba7-2785-4907-b31d-831d04b8198a", "comment": "Malware payload", "value": "2091cc337e6a69bf6bc5126c0e66afd12fad2514", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293085, "uuid": "0374d583-c9ed-4da8-9eed-2c99db599cdb", "comment": "Malware payload", "value": "5a8f25d53c79eaface336d4d4c5ca820ac3ccad6e20f9760ecda180cd8d2992ff0dc6b2ef6e64826fc44fee9051917c6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293085, "uuid": "ba6f1b5f-29d6-4de8-8478-31516e5e1e6b", "value": "T11B21DF246EEB6B21EBE2D6B22071A3A54E773852F951C3CC0104AA8D203760479B9F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293085, "uuid": "d0941c02-ed7b-4636-abff-bb54f86320ab", "value": "6:4xt/98el//t5zC7lkcFw1IxcFwR+SkEMl47J6jclRaQmZAMl47tKHkWBdW:8X8K/takCwiCwEIMm9lDm1XHLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293085, "uuid": "a2cb814a-04a0-4469-abac-364d098ea7cd", "value": 1228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293085, "uuid": "d9df0b03-d457-4674-b1ba-4a70bf50f314", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293085, "uuid": "e45fbf65-26ea-42d4-a7a0-34d3969de889", "value": "Files.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02306785-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675267426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267426, "uuid": "30db93cb-64c4-40b4-9942-0173203cde81", "comment": "Malware payload (Loki)", "value": "06f61b2e8dcaeb8e8a1e80611d53baa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267426, "uuid": "09b4abff-06dc-4025-a79e-08b7c819c806", "comment": "Malware payload (Loki)", "value": "b9ff83bfec02bbaba2e8966e3923e08238e295dc9e66b139df4ba1c3f024a8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267426, "uuid": "03e5412f-fbc9-49fd-897c-00c136f2e872", "comment": "Malware payload (Loki)", "value": "e97262db5f421274929d9d190d9f45734737f201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267426, "uuid": "98f4d55c-1dd5-4caf-aa22-a36e10430008", "comment": "Malware payload (Loki)", "value": "a7fe8d3823c50bf2cc8f1681de1d174325de85dbf68f630f559a0e5d7240347b138c6e8dc64229272be5d800304660ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267426, "uuid": "daff6cc4-122a-46cd-9e40-8f59359398b9", "value": "T1A2E46B8777F19872FACB10A5142837CD2FE0A103BE95E257AB7B7AC097058FB7698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267426, "uuid": "2e063892-2502-45e9-a725-678297388df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267426, "uuid": "3b550aa3-33fe-441e-8da5-6bbcb2b2ef7c", "value": "12288:ttz8L6guub02iDBd0ER+pVj4pmLoU25nntk6PUi+9xMRSR5SWqG4yPa:wLz0LDwIij4cLNItvX4yRU5JqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267426, "uuid": "c4c8dff7-a1ce-48f7-8de3-f84ad3cff809", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267426, "uuid": "52ca8efe-58c2-4188-a74a-675e19ffad1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267426, "uuid": "dfef7ff1-4d32-4142-b921-e971bc8151db", "value": "06f61b2e8dcaeb8e8a1e80611d53baa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb45144-a211-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675242989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242989, "uuid": "3a459890-1ae7-4188-805f-d9a507d04264", "comment": "Malware payload (GCleaner)", "value": "efd8f3606c18f3cf472f71db3031e056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242989, "uuid": "4e64a0cf-5287-4477-b4a6-7e3531e1e65d", "comment": "Malware payload (GCleaner)", "value": "ba0cab8b01a57b776c623622b6e30688309a7e709b090cddbf2067d3f669d4b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242989, "uuid": "558ab9b7-d367-45d2-82c9-11031527f75d", "comment": "Malware payload (GCleaner)", "value": "cf0e81efb3577e41e571602d731ad1cec4733def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242989, "uuid": "44677fd8-6f78-4504-87d3-f5a7722ae674", "comment": "Malware payload (GCleaner)", "value": "2250381cb8ab87b6e96b5207d729df48bb023f3553e386a26d6540d7146cd123faa9016f21017e62cef8544fc697047d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242989, "uuid": "41f4664f-3e01-4d95-8ae7-aef74dbd2745", "value": "T18DA53339153C997BD043F9F84B21E2258152AED73CAC950125ECBD5B7B7FA829C0DE82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242989, "uuid": "3d2a90d2-8f66-4da2-b9c0-b0b54a1263db", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242989, "uuid": "0fec7341-aba7-46f0-865f-c82b1d3476f6", "value": "49152:icPLnQboQ4LDcpxazctDkmmkhGD/NMPJ1kHBlgPm9G8sOAJLCgv2MR:XPLnQbV4LYyCS/GB+HBlgO9fJ+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675242989, "uuid": "0eda0d13-3763-459e-898d-c9ca3d6c3b3d", "value": 2248688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675242989, "uuid": "f39f9bb8-c47f-4c0f-bdf8-e52ad5053d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242989, "uuid": "370405fc-818b-4890-a7c2-113b2f978ef6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02486e85-a217-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675245522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245522, "uuid": "d12ba76f-96cf-461d-ba85-c1224b824da7", "comment": "Malware payload", "value": "1c2b76fd9d7a1ef24c8841292e00749a", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245522, "uuid": "9f7b6391-b137-4c5c-a9a4-9016f3cfde3f", "comment": "Malware payload", "value": "ba87f80b98d8990a0925b1cf6848b67de3e586830fed2a68ca79a2162eb1cadf", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245522, "uuid": "b8c517e4-58b1-4076-9e57-99ab2dcf4944", "comment": "Malware payload", "value": "22ae98824aaca51ff4a22073fab61e16819221f2", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245522, "uuid": "5fc614e5-424a-4d45-b770-6ddf19dfc8a8", "comment": "Malware payload", "value": "c84ed1555d00a0d3d42ee461381a968a5f8155e5364112d2d192f40f2eab718328658164085b906af34cbd5d137735f1", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245522, "uuid": "fb5763ff-0820-46a2-9128-576dd48bef9f", "value": "T1A902C0582728921ECA04709F538A62D9F4730264DCDB8E42EC5EFC1094132F78464F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245522, "uuid": "0d71da7a-56cb-4edc-b837-43dc55c20b22", "value": "192:lD5VY1Rm7oGS031pTAs9OYAEuissJOhk24A0QxKi+t1LjfA5Z:PIcSsZAs9OYAEuYOp0QxKi+7LMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675245522, "uuid": "0e8f4eba-0fe0-4fc3-89ed-ff0a17d98f40", "value": 8822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675245522, "uuid": "d1b192ac-1618-4e9a-bbb6-168db8ac0b5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245522, "uuid": "e8f49990-721a-4ec8-932f-615d56cb0267", "value": "SHIPPING BILL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4592fc4-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675257390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257390, "uuid": "430e085f-1e4d-4e05-8b9b-62575b09c996", "comment": "Malware payload (Quakbot)", "value": "71411be0504f3101dc85bfc25bdb8210", "object_relation": "md5", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257390, "uuid": "0b340713-9c7f-4abe-aa25-52f7c6a8ad78", "comment": "Malware payload (Quakbot)", "value": "bbc994d3a91480e58678eea6c15baf8ceb136b8ad1493d38715e9d8a24921a43", "object_relation": "sha256", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257390, "uuid": "bfceff0d-f6e9-4f37-bb22-7fd36c7ce3f8", "comment": "Malware payload (Quakbot)", "value": "80c58e172981922665022dcf97801e0cbd06c5ac", "object_relation": "sha1", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257390, "uuid": "a3f418e6-01f5-4bb1-9bce-606880f630a7", "comment": "Malware payload (Quakbot)", "value": "c3a89078c785009e558422f5f0d6375bbbd3e61389d66e0882df7ace2f521540a5fb96205ed691e6a0a738ddffeb3ed7", "object_relation": "sha3-384", "Tag": [ { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257390, "uuid": "de200c03-3c3f-4733-b5e9-d27375123096", "value": "T11304D00126F64AE5DBE47BB25DE3971DAA27BE37A262035F4BB5662D4D60310CC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257390, "uuid": "0c26ed4e-d109-4481-b085-b125e3273a59", "value": "3072:jaA0YRw9/WITtTWR7IbNzvL1auFayuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCC+:Ta9xytedL13wg4iERBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257390, "uuid": "a75912c2-16f2-41cc-b6fb-e2bfe2f50d3b", "value": 179832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257390, "uuid": "ee4ccdff-b4b6-4240-9114-9ac38de13db3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257390, "uuid": "b2ca1fcf-5fc8-4e4a-a695-97bbb2480f83", "value": "ComplaintCopy_88193(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e953e8c-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292787, "uuid": "e5c9c893-584a-4927-a71b-0601672ac6ad", "comment": "Malware payload", "value": "e974bb813319a27e4dd8da964053e3e4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292787, "uuid": "1a6c690c-41e6-4343-b136-6320d10bb249", "comment": "Malware payload", "value": "bcab55594bade3a2e6b3caa80292b6da9f1b7bb11c2ae23a64501269f005345b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292787, "uuid": "eda65386-ab5a-4465-8ee7-52bf6172a71d", "comment": "Malware payload", "value": "e8ea4fa32e8dcdabdd6dd672ec28c888656bbecd", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292787, "uuid": "33424b4c-3891-4b09-b1b4-c5cddaf6573c", "comment": "Malware payload", "value": "8d75bd498b69863dfe72a83d0b1a42dd7f5354525e1e33be43c31ccc5d7c56d5589b6f7d8e5e38abeb0ac004edc33102", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292787, "uuid": "ca8c8500-6309-4ab4-a76e-59949add8041", "value": "T116363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292787, "uuid": "0c1b83d8-c7a0-43d7-ae3f-0791f117c156", "value": "98304:3v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXa:3vpvFa+g8RWLdPk/84tCEr0RtNiC5eSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292787, "uuid": "c3ffec45-e9b1-4552-809f-785a74e1427c", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292787, "uuid": "38ded31c-3787-408c-8974-a77363f4a740", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292787, "uuid": "baacf791-29e0-4efd-a5d5-9e5ac0d25e5b", "value": "bcab55594bade3a2e6b3caa80292b6da9f1b7bb11c2ae23a64501269f005345b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e20cac1-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675263312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263312, "uuid": "c3bcf08a-99c2-40ba-8770-209221ada721", "comment": "Malware payload (LaplasClipper)", "value": "eb5a9fc34310c8322a9f802e459ba41b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263312, "uuid": "42893038-1db6-47e5-b8c8-84336295595e", "comment": "Malware payload (LaplasClipper)", "value": "bcb6bcc89d544f584c97fa7f7477fa0824955716ef7e9e1fed1e143404ef0cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263312, "uuid": "f46e2d1f-1afb-4a7c-9c06-7cd09d45ce40", "comment": "Malware payload (LaplasClipper)", "value": "34543154bc9ff2f19ff089bb3a763a84c33e1565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263312, "uuid": "c176d6d2-bd1d-4b6f-ad09-ed98b87a914b", "comment": "Malware payload (LaplasClipper)", "value": "03348b0817f75bc65a718af529f9df575da0d9c9bfc942e8510d0a43c32ef321ce3bb8481eff354b20530668696ceeba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263312, "uuid": "26ba5e64-7c5e-483a-8914-24f56137f261", "value": "T1E0853325B1B1947DEE0515789030D805CD9A24333AF6C5137FE6ABBF0AA74E72B1B722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263312, "uuid": "21b32fa5-6e2a-45ba-8862-945ac2d785b2", "value": "2e8b3dc3bab93b5d4f978cd02983172a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263312, "uuid": "e6515ea1-22a6-4df5-9ccb-467fbfe4d80d", "value": "24576:uaErTY+jpAIfxM6xEhrhnohPW9vvEbUD3g3jCvU/28qQA7Gb9kyAw0ncUEgjoqxa:ua6TY4NPQ9noFW5dgT9qDq+ih1L5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263312, "uuid": "4ee175b0-0d42-4652-8bcc-eeeacedcfe0e", "value": 1841152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263312, "uuid": "ec887384-2e26-479a-82fc-c78bdf7a840c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263312, "uuid": "89bcfcb4-2466-476e-8b90-db07a2d707f3", "value": "eb5a9fc34310c8322a9f802e459ba41b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d000e99d-a223-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675251021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251021, "uuid": "fddc911b-ceda-4038-bee5-5d40020d7e19", "comment": "Malware payload (RedLineStealer)", "value": "fff03242a682e8116f9833a5ad2d85cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251021, "uuid": "40c582ec-ce76-4b68-b26e-8498b1081bf2", "comment": "Malware payload (RedLineStealer)", "value": "bdadd5a7fe2dc1cedc9a218ea29f979cb834e163cd144055c3351a9a9996be07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251021, "uuid": "bdded3fb-2870-4eff-8162-8bcb9bcb7252", "comment": "Malware payload (RedLineStealer)", "value": "caefa678af8f46351e1d2e9f4419b28cc8e77b83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675251021, "uuid": "1889d611-b35d-46c6-9bf7-68a480a1a7d3", "comment": "Malware payload (RedLineStealer)", "value": "a6a71a8722d825a70b598ff0c790f6343a69fbca7dabac8d69c62cbf059160b5b46758817639d1c53ab232c27f438420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251021, "uuid": "c5db4731-04cc-49a2-9c0d-3fc5afe87223", "value": "T15874013271C0DC33C46755B4AC24EAA9EBFEA032447969133B58166E9FB02D1A73634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251021, "uuid": "57a8c2f7-1a7e-4a69-b239-1c2d6be61b9a", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251021, "uuid": "0681c7a6-3940-4d9e-b26b-434e63cde447", "value": "6144:8Wo8ZOTLwdS6aF5/MJdDskJdXePSxUGRAh5oxjxv8utX:8W/gTQS6w0JqkJdOPSS55oxFv/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675251021, "uuid": "4ebcd098-39b7-409f-b4cf-56b13d815812", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675251021, "uuid": "41bf458a-289a-4fb1-9a2d-dcfa280ad99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675251021, "uuid": "6f51d226-ddeb-4120-9aea-adefbc0bceae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0c5c8c-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675267386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267386, "uuid": "fa5cb5b3-4654-4585-b211-b45a2438ed5b", "comment": "Malware payload (NanoCore)", "value": "cffcaceccd0c05762dc335f58a2f0932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267386, "uuid": "a2d625a4-9392-44c0-accb-4a71d0ae495f", "comment": "Malware payload (NanoCore)", "value": "bdfc24d604f256170914e2f360d8b6ed30182fe8682fc11aa136dec7a5fb1876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267386, "uuid": "b945d92c-491e-4ac5-b4ec-6558411912e5", "comment": "Malware payload (NanoCore)", "value": "45fbb9ddf062f8b64ba3b8ace48767991517fa50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267386, "uuid": "c16fcb99-ef53-4fdf-b0df-95414f912973", "comment": "Malware payload (NanoCore)", "value": "59528b26f80893b0b589754d06a812352a266a7425eadb644ebc4b2d7c73199a0cdc94576e0cadc841eb3e892d215066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267386, "uuid": "6b2dfe2c-7dba-4b4c-8d8d-99a923992510", "value": "T148058C8777F1A872F6CB10A1142837CD2FE0B103BE55A2579B7B7AC0A7059FB7698241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267386, "uuid": "45b2df07-ffad-4a39-9bf5-6367ce0b2a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267386, "uuid": "dc5c1919-f985-4986-a10b-210aa2b926d8", "value": "24576:yLzyRU5BVftZtPOYkNc9/vgumFRXjVDaqG4yPa:SzyRU/VfbtGpU/vgum7Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267386, "uuid": "57fee19f-851b-4bce-a916-548797289415", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267386, "uuid": "c1e97cf2-0cfa-4ebb-b514-489ca0ec7ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267386, "uuid": "baef78f6-f9eb-4194-9f55-40a980359aa1", "value": "cffcaceccd0c05762dc335f58a2f0932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1437525c-a228-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675252853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252853, "uuid": "cb0c8649-f968-42e5-a801-9f13402bb642", "comment": "Malware payload (GCleaner)", "value": "44a9b23b7a8d07004110aa7f7e20f9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252853, "uuid": "d109802a-59e5-4894-a664-d2361772239d", "comment": "Malware payload (GCleaner)", "value": "be25bd85a465e934763cb0d6e9d01bb857445ab43c7aa68cd9f40711e0986e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252853, "uuid": "167c9251-6dbd-4730-aa38-defb786fa7c8", "comment": "Malware payload (GCleaner)", "value": "e9ca53e394e8a34e09eff9c33d08308735bd1f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675252853, "uuid": "44e5d3ce-2290-4bd3-979e-c700b2b43fb6", "comment": "Malware payload (GCleaner)", "value": "a79148570680b056081ebc2b44ebfefc9bbd4455eb007e9113f14dcd1aba6e9d21bc41f407efb968c6eb597e2b9c554f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252853, "uuid": "7156c254-922b-4ee6-9e2d-6b040722a558", "value": "T19CA52302BA7AC833C241A5FCAD11D231E7B57F253834A62161F97E5F7A3D993190CA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252853, "uuid": "fc0fc632-70f9-4e33-95cc-2a129ac2d91d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252853, "uuid": "a6df93f7-afb2-49c6-8daf-316e6bced1eb", "value": "49152:icPLnQU3nZDc/aF1/kJKSf3IL7Fz0Nr1ZYPRDqCrqXkVUpJAFvpCrLCgv2MR:XPLnQUZ0utSf3LNroPRDq8qUGPAxsfvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675252853, "uuid": "6754140c-6cab-4cd3-879f-bce308f847cf", "value": 2253413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675252853, "uuid": "9a61eefd-0423-4094-9e3a-db56771d0094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675252853, "uuid": "7e855ee2-7d2a-4fe4-b763-484eb8e8198f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47f8283-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267269, "uuid": "1231fdb5-0466-46f0-8fca-e9c03f43882f", "comment": "Malware payload", "value": "c70cf6c09fc8819b33f5bdf5f506a981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267269, "uuid": "0ae893a8-b020-4e5c-aa86-575560015c40", "comment": "Malware payload", "value": "bf13eb2026e85f67cbe27ba0ba349a615776976ae8c47ae979335a7d556e04bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267269, "uuid": "2f56a03b-0db6-4bcd-a197-20980eddc208", "comment": "Malware payload", "value": "e5f63aeb42caf2b1bec9987df8c16fad89d69525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267269, "uuid": "40b2d172-efd1-4742-8608-114dc62a139f", "comment": "Malware payload", "value": "7d8fbd69c76ca3ed62da09212b06de05427bdb7684fa6a37bac348a9d5203626be301b24115fd8015be03cbb8803ec7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267269, "uuid": "ca6bbb31-8064-4171-b119-131bdeec8277", "value": "T146669D217686C437D56A01B1692CDAAF5228BF720BB254D773CC3E7F1AB45C21632E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267269, "uuid": "4949b217-30c2-4aa1-bbdc-107176972c58", "value": "8708d1fe1b5ff509570e29ce51663405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267269, "uuid": "79bf8d55-c115-45b9-a084-2bbcb8020679", "value": "98304:yw5gk9MwZAN5CWj5QrOZAzzZhUo6HE3Yt19yRCLEld4o13qaWT/v:d5gk9KH9qVm914RCgso1dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267269, "uuid": "9d209981-d3db-42ea-84b2-081e20ea436b", "value": 7019351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267269, "uuid": "4be74316-0760-498a-abd6-7476ecc8a95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267269, "uuid": "463b0805-2e47-4bfb-a1a2-e41903660ad5", "value": "c70cf6c09fc8819b33f5bdf5f506a981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1067ba1-a1f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675229494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229494, "uuid": "84a0553f-709f-461c-ba12-8fb5265e66f3", "comment": "Malware payload (Rhadamanthys)", "value": "5ac925dd0ed8f683443c4873fd48a37b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229494, "uuid": "85fb7a50-9d37-4c61-b6b7-a4875cf89f40", "comment": "Malware payload (Rhadamanthys)", "value": "bf1f9e9d544255b5a21da4922f447b01098a312b4b56e4cd37a950adfe71263b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229494, "uuid": "0e236c39-5a40-428d-bd78-4aa391976192", "comment": "Malware payload (Rhadamanthys)", "value": "97ddc705341f4825fe41c738cab0373851c52132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675229494, "uuid": "37872aef-5100-43ca-84d2-b64eb3899d6a", "comment": "Malware payload (Rhadamanthys)", "value": "01539ffc44bb5ad5207e2fdfec0c15e9cda79ac146ffd99afca237475ecd6754ff17080f9f14529d2eec186812463cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229494, "uuid": "8712465c-1e59-494f-9f6e-e9256cd0e2c6", "value": "T1D3548EC2B6F2BC62E9228A319E1EC6F5751EB5524E147766131BDBDF35B01E1C2A3B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229494, "uuid": "81622e00-ce79-4b3d-ba2f-736c228dd5d2", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229494, "uuid": "beb41053-08cf-4842-beaa-63ee6be3b56c", "value": "3072:WWBXQpL9nRcoqxr3eagOW7t0fl4m5e/2GG60TxfmqPUx6WfQz86bA+6RnG3MM6:fQpL9KoIW7tI5aiTxfmqMoIvG8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675229494, "uuid": "217938b8-9801-4820-bb0d-0ddd569d3af6", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675229494, "uuid": "6c4bdb26-f74e-48a9-82a5-65f78e4abe28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675229494, "uuid": "818077b7-b65e-475b-ba28-41d3bc009cc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c6c824-a1f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675230791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230791, "uuid": "5f13787e-cd6a-4992-ae94-d4b55d428a05", "comment": "Malware payload (AgentTesla)", "value": "e328c546ac1bfdf26cb54b5ac52e66cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230791, "uuid": "72356b3d-096e-4d3e-8524-7aba6823faf9", "comment": "Malware payload (AgentTesla)", "value": "bf384784d29b4c2f3e8f3d92c4c189bed09331d3092165da8984a1f3dc0c0635", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230791, "uuid": "b88f0b40-8d43-401e-bae5-9434ab57be94", "comment": "Malware payload (AgentTesla)", "value": "dca6f88c39b770ebca745176f2fcba4e407141c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230791, "uuid": "4befd546-6919-493e-9bb2-f12d4c35d108", "comment": "Malware payload (AgentTesla)", "value": "9aee4f8c897944f81a5f170e2ec161ec09fe1a997aa13f6e5c4782d134c295aa858a6e6b0066f1abc16c6230730170dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230791, "uuid": "ccfc2a63-0f8d-412c-a9da-9b8965a31552", "value": "T129F4273D287797F2C534F97296D1A4A0FA9F8093B36BC999D9D61BC04F012822DCE51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230791, "uuid": "bd50e7b1-680e-4be3-8c3b-7d2d679a4491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230791, "uuid": "0290232f-9bc4-4022-b18c-a12fe0862acc", "value": "12288:0f9X1yOeq+pXp8irmdjXHNOrAe/IuxmBDCeG3cURbCKc7+e6wNiRHTkgwrqhMqDC:3T8irmdjXHNOrAe/IuxmBDCe8Tdhc7o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675230791, "uuid": "5d7c3f5e-a3ec-4785-b00c-19643c0fc335", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675230791, "uuid": "d454f621-7e35-48e3-a178-22806816c57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230791, "uuid": "0125dc3b-7cbf-4bfc-8249-95685b0e0029", "value": "contract inv..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05881c3a-a27c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675288907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288907, "uuid": "03cece29-9f3d-4f76-97c1-1c9d2388ad26", "comment": "Malware payload", "value": "aaed6d674c4ca6a036f254fdb6b3cd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288907, "uuid": "3b817eea-7d40-46ef-95b7-d6acc50ced6b", "comment": "Malware payload", "value": "bf7150eb92d86841e33dce27c7935a1d1733763d94b5f2425919866c129c1a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288907, "uuid": "ca229eac-06b3-4978-97e2-b729d134cc66", "comment": "Malware payload", "value": "adce22fdb7816d9b8584d3bcd81a5a920b1b570e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675288907, "uuid": "825088b3-782a-4e87-aead-e76a70a8a4cb", "comment": "Malware payload", "value": "eef91d02af2265cc2574fac0bb1cea8854acc17f367c71ccdf2b41b0580f236e701ce6ce3380edb7f67f155c01db6c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288907, "uuid": "1c62f196-e0d8-46a8-9489-7e2138743f4e", "value": "T1CBA52312377D8C36C2A39BFC2A51DA32AB76BE552868855171E9BD0F7F3E6477C08201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288907, "uuid": "802684fa-c20f-49bc-86ff-c87be83edc15", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288907, "uuid": "eee802c7-3f3e-4c33-8367-c45b130dc6ce", "value": "49152:icPLnQxxlz6G5Z3iDyt4rSue6WUs9iBKBXl84tbLCgv2MR:XPLnQZ6u9FuewtU5l84Vv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675288907, "uuid": "3482a63f-eecc-4188-aa0a-2528e6e6d0b9", "value": 2202119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675288907, "uuid": "b63374fc-0683-4edb-85bd-4c94736f94fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675288907, "uuid": "8f337db0-9342-4ff2-aa65-7bf30f0b6c81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f42d3f-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267164, "uuid": "5db79898-0038-45ee-96b6-cc8d491342a6", "comment": "Malware payload", "value": "fea013218944957fc9af744b5d833604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267164, "uuid": "ae80ca8e-c6dd-47f6-acea-60c06ef726d9", "comment": "Malware payload", "value": "bfb525f063e2332edf29c33912de7619ac58916e9935c11bf568b534ef1a46b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267164, "uuid": "e2cd2932-bfc0-442c-a7d9-88b9157c3a7d", "comment": "Malware payload", "value": "402b3a6a1284d8cf2b0e11525b53f60d2fa602fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267164, "uuid": "bdf01f47-7a47-4589-904b-324f3e012f89", "comment": "Malware payload", "value": "9cc10d64934bea846e55ebb22afd8b4f36dcc1aaf580fb2b1a566223672687f64084cb52fb6e57e3877ddc3431dc4c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267164, "uuid": "c561aae2-cc21-464b-bc93-7bb339cb1651", "value": "T16BC1EA115BEE50DAF22707306BE7B3BB0666E8B1492E71BC71844A585F30BD08822FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267164, "uuid": "eb460047-3cd8-478f-8014-dbc89a3343a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267164, "uuid": "c85d679d-ccde-44bb-bbe1-fa64eef6fdac", "value": "96:kc791WL1bhycQm+nUfbUq15cAYtshwvk+ZJYYKd3ojlrl:kq91WL1bhycbDUq1PYWwvkW5Kde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267164, "uuid": "d57479de-a869-45ae-96c7-358f7b7c9f22", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267164, "uuid": "f00a389e-ea97-4f49-aa08-c2af296d0ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267164, "uuid": "23a4421a-d54f-4d7e-814e-09b688d86cc9", "value": "fea013218944957fc9af744b5d833604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b282e455-a221-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675250113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250113, "uuid": "38546b45-b002-48be-87ce-1503fc84cd10", "comment": "Malware payload (AgentTesla)", "value": "680563051110750ae57899012b93488e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250113, "uuid": "a743fac1-5f57-4b58-abc7-c61ed8dd0943", "comment": "Malware payload (AgentTesla)", "value": "bfb963f003ea24be47ad11eddee613145bb6a470df3cee4579a50921d0a40797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250113, "uuid": "bf9dafde-67ff-431e-9ac2-63cd00215a71", "comment": "Malware payload (AgentTesla)", "value": "cf7c8a41de4833d801876e6e67dc14106abd64d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250113, "uuid": "c9a22019-0bba-4f4f-9973-5cccf5ed3627", "comment": "Malware payload (AgentTesla)", "value": "52d5de438fff0ecca3b700d4a5eb8e830060cb3ad6121e0c5aca969d15d5ed5a9fa797975bbfcebe28160bed5f8b508e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250113, "uuid": "9213f633-36d6-4621-9676-f27f407021e1", "value": "T106641258F6D4D42BD9911B722DF5524DABA8F60268FCDB8FA36003B73839A829D0D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250113, "uuid": "6763cce1-9e81-4aca-be36-dbd9d5915933", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250113, "uuid": "3e1e060b-80e6-49d9-99ac-3d0cccbf8d11", "value": "6144:PYa6tMlPQ0KB2w02JXCfslAoNpstSTBBpYx+l/2x27RXUEZ2:PYPMJxM2mhAoiCBw+F2xmREEZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675250113, "uuid": "268a041c-e553-4b8a-8eff-c324a3910b12", "value": 312765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675250113, "uuid": "7fd43eb6-575a-47c9-b575-6a98d9e3df30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250113, "uuid": "d278ab01-9c09-478a-b291-cc3f107d88c8", "value": "Our Project Requirement of AU-600 (300,000PCS) drawings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313dbbc8-a1fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675234863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234863, "uuid": "c4ca71da-4ed1-4a2e-98ee-ea9111a378f5", "comment": "Malware payload (GCleaner)", "value": "b3feaf8ae2db4dc896419464811b8538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234863, "uuid": "fda1c4d6-0657-4717-be0f-431a515f0323", "comment": "Malware payload (GCleaner)", "value": "bfe87b12e5c3c979c2f498d7da22216b1077cedd72463af8183f8c4369995715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234863, "uuid": "62bb270c-d532-4ca9-a72a-5864eba7e70e", "comment": "Malware payload (GCleaner)", "value": "c847e4fe1efe2b4cd6fea78135121df6679c5909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234863, "uuid": "aa707797-53f5-432e-8f5e-efe5f93d218f", "comment": "Malware payload (GCleaner)", "value": "280b5ddb624df91de3a863b1bd45baef86dfbaec459762ece895b17f492ea432e3b7fda23176ffd1d703c438fa042fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234863, "uuid": "9e02ac14-2af5-4b76-a687-8e8ac3d4d5c4", "value": "T1AEA52322573D8C31E2A19AB0A911C371A773CE62142D61163AF67D6F7BBF3836C59306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234863, "uuid": "412a6787-83f5-4049-b020-710065d9cae6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234863, "uuid": "21455b1c-f8a3-4bd7-b02c-0f0bb75b3c50", "value": "49152:icPLnQKMEhGK9grMFjrU8g8TPk0esejTCe5Y9O2T+7SLCgv2MR:XPLnQKtErUJDTPkVMT+Ov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234863, "uuid": "a7264ca3-9f37-44f3-8b87-6a1ce0bef061", "value": 2217136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234863, "uuid": "762d9daa-17b4-4b03-82e1-5b8099275d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234863, "uuid": "d6306b91-78db-4132-a83b-6acff42ba913", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318be687-a239-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675260204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260204, "uuid": "991ba32a-c7a5-4e76-9837-a875a47afb66", "comment": "Malware payload (Formbook)", "value": "2869de9da0beee58b78e78cd413b34e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260204, "uuid": "e02d9fcf-fe3d-4a54-845f-81f29307fa43", "comment": "Malware payload (Formbook)", "value": "c0384c55ee30f83644024cd305a8e538ed0a3b989e2e10371de67e765f7cc0d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260204, "uuid": "9671bbaa-19f9-4ffd-9454-835a04e55938", "comment": "Malware payload (Formbook)", "value": "1cee4624d44e4a34d41de15269b93a46be3647a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260204, "uuid": "f5e59fe7-ca2f-47d8-87ff-9af4145095b7", "comment": "Malware payload (Formbook)", "value": "18223fd81e90966f8c6501ace6c090718f1e9b560a528defd5db49f726f556d2986aff28408fb3f785b25efb1d6e1352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260204, "uuid": "727cb174-35b4-4916-8ee8-30f180047739", "value": "T1A1A31F0893EE5E23D96AD7781953F2722735CC6645A1C7071EC4ADA73F5BB822E100F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260204, "uuid": "ab6ad8df-c73d-4042-8232-5487116d8b5a", "value": "768:Q++rNNDpPFFj7zNya5NbcVfup+btYAJHa4H:QBN1Fj75ncVfupotYyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260204, "uuid": "f42859d7-6af2-4e47-bb49-c3b5938f1fe3", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260204, "uuid": "770c6bc0-46b0-488f-9f04-d4405006b601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260204, "uuid": "56cdc9f8-3d00-4af2-a456-e2d51b792919", "value": "Pagamento_212023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7340643c-a1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675232397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232397, "uuid": "ad11437c-d8b1-4792-9ec3-48c97573cdf0", "comment": "Malware payload (Guildma)", "value": "8ac6125bb8f79c470e91f808418e4dd3", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232397, "uuid": "0f23837e-4adc-42ba-870c-cb42de4f4d18", "comment": "Malware payload (Guildma)", "value": "c0481d2565154b7e743381b5fcbfdd38bf2b0b11d4014ff1b9001d99cf05fabb", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232397, "uuid": "0cb4a0ac-c355-477a-b99d-b43b6fb977a5", "comment": "Malware payload (Guildma)", "value": "ff34e8df151713501ac02f9dd6471051a6a02178", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232397, "uuid": "12396614-db10-4497-885f-eb782f10961f", "comment": "Malware payload (Guildma)", "value": "4a984e6cbc087f05f29c3a1423eb8cb5412f6a5605f765b70d7001ffdb7506e598744ffbe4a8795dd9645a590813990a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232397, "uuid": "8f2934df-019e-4f1a-9e43-903ec5f7020f", "value": "T11222E144750E4149D5FE6663EF3E0808D93EBEB5435A8E60B5E6418A0A349CCD6FCFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232397, "uuid": "359c5850-cc74-49fc-9b8b-08cac65202b8", "value": "192:Ia6VCRqubg8Lu5fP+dZY4nr2yuI9L8r6PB2oR85We/LyYodFSgv6cjHxJWPuusDN:IatquLu0T7r3uyQrukWMJzHsIK71YPup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232397, "uuid": "478fb15b-fc6a-434e-9140-4ae13256a903", "value": 10388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232397, "uuid": "009c1784-abaa-449e-a0d4-82a56bf51664", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232397, "uuid": "41e2f62e-a305-4cdd-89a2-878c37a09ae1", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1366df85-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675257147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257147, "uuid": "2e3709d3-6414-4f4d-8fa1-49d130889aee", "comment": "Malware payload", "value": "008fe03cbe1da5d1c39706d34fc8a85f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257147, "uuid": "0f04b271-8223-4bac-9155-3e3589dc14cc", "comment": "Malware payload", "value": "c057c61e1871252c98d4482fcd4a55713db2427d92dabf2d0e006bf948d0569f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257147, "uuid": "59a911d8-900c-483f-895c-c75358feba89", "comment": "Malware payload", "value": "87a8a21802c2cabcfe0bfad3f28eca6ac7a3f09c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257147, "uuid": "326cc7f7-d645-42ee-99a0-5da79d4ee78a", "comment": "Malware payload", "value": "c707c3eb2426064bacaebead07520fb06c26df27acad23a8b6421b2f2ac17b212822a912d9f07f531530eb6419ac49a6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257147, "uuid": "fa6141ca-5767-4ab7-8ddf-700e987e5eea", "value": "T12B134A4677C80321D6BF497AF8B091894C77F92B4413DF991C8591AE28BBBD40924FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257147, "uuid": "b1856f41-51b7-4da3-888a-6555b76ebec8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257147, "uuid": "8430b498-3dd7-431d-bf12-abaeef8d799b", "value": "768:aNTjuakP4LpHPvt3j+ahgZs/5wLEyCQ7G8Axuzdp2wT2+IyP6jsl6r2r5n:ad7kP4LpHXPSZ7LEFQ7G8Axuzj2wT2+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257147, "uuid": "16a26fa9-e33f-42f3-bc89-93dcd8515830", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257147, "uuid": "f72219cd-bb51-444c-9018-d573dcec1341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257147, "uuid": "d8422ad2-da19-4a79-95f8-fd6ef95d7d7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4bea10-a217-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675245621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245621, "uuid": "003ee271-d9bc-4b41-a102-6d01183d9e37", "comment": "Malware payload (GCleaner)", "value": "aa0d78f125869e085c18e0a6c11fc3d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245621, "uuid": "72652add-3a1c-46e4-92a0-7154a69b663b", "comment": "Malware payload (GCleaner)", "value": "c0daff7a78caddab6145635eb995a71eff59096adb986a2ad236df43620fa5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245621, "uuid": "41fa568a-27cc-40dc-90a1-e28bf64c6d3d", "comment": "Malware payload (GCleaner)", "value": "1880f694c55675005196a7f639663d51860d7655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675245621, "uuid": "f90003e8-7f98-4f8a-83c9-e4c531c90a4e", "comment": "Malware payload (GCleaner)", "value": "7f8c1abd809ffefa624189a513ccf8b30815bb6e59cd0096c4986d5209da6753e5a3bda7f6599f7ba0d5c5a8f1e479fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245621, "uuid": "a287da76-3b0e-4aa7-9a10-fb92ff46ab04", "value": "T128A5331636BDD976C2522AF4BD12D276E7A68D49247C2703B0EEBC673A3F3436809152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245621, "uuid": "9ce69c5b-c1a9-493e-afe3-195e4ed647d0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245621, "uuid": "d4edf79d-6af8-4896-9835-aff58f8a7d5c", "value": "49152:icPLnQEGrlQYqy7QPg1HrSXW2yiZkaMEDaOWu3vfwNLCgv2MR:XPLnQEGrBQPaL8W2yiKaMnOWFRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675245621, "uuid": "593d017c-e3c1-4c11-ab16-6c6401d1183e", "value": 2178223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675245621, "uuid": "8f1f761f-fbc4-4f9e-ac24-bcbb1b29c213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675245621, "uuid": "37b3756f-268e-4d65-bcbe-b7f55300973e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e2287b-a1e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675224941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224941, "uuid": "67fea557-ff46-4b2f-9da8-042a7fbff5e3", "comment": "Malware payload (GCleaner)", "value": "8c01e76b6bd9052a2467179c941583b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224941, "uuid": "2860943f-9dac-45be-901a-3f95c06e1250", "comment": "Malware payload (GCleaner)", "value": "c127463980d7a0ab237d3f208159ef2d71939a69a3281f277b4d7550e4af28cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224941, "uuid": "50ccd47e-cba1-4fab-8b68-c6c58a1ef6fb", "comment": "Malware payload (GCleaner)", "value": "79a2d7d47fcaff9e699720fba122daf65cb1b4b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675224941, "uuid": "1e40e337-0814-4faf-b90a-bd65040e822e", "comment": "Malware payload (GCleaner)", "value": "8992133f09f6e7dd44a305a6ec786cef3718b4f94d1d9d998a56f49051538885ddc55e4e2cab4d4eade12af01cb44105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224941, "uuid": "d3e2e0c5-93e7-4b80-bcf3-f0cbf40d1da0", "value": "T1AAA53344BE798873D29263B88761C6A18FB1FD76743CB35631E9390A397AB835C0E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224941, "uuid": "6224463a-6791-4e08-9eed-f5c2e0490286", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224941, "uuid": "5be9eba9-44b6-4092-a7e3-109ff08f1bf5", "value": "49152:icPLnQrl+Jag4LFJKJeW2wP7556SIUb7Ia3NXTIK/5Hxo4qYeZLCgv2MR:XPLnQEagSEv2wP75kSIU7ISIK/Jx+v2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675224941, "uuid": "e51e5cfd-a548-4d33-bf48-0e8bc3c6ead3", "value": 2199089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675224941, "uuid": "fc9aeb87-bed6-4ffc-99f4-e2eee41a14fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675224941, "uuid": "5a40a23a-da77-4c73-8be2-087b1aa2910c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ca9653-a239-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675260183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260183, "uuid": "587ae9a7-428b-402a-bfaf-351c327788fb", "comment": "Malware payload (Formbook)", "value": "bf76149ff50df8285270b872c02fa295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260183, "uuid": "aaeac252-f343-4593-a7b4-2195e68c1720", "comment": "Malware payload (Formbook)", "value": "c18ffd59ba4e78061980e650dc6a2b6062f2829781ff7c061ba27f96cad60b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260183, "uuid": "36a9196f-c9da-4a1b-9ccc-97dc88dbdfbb", "comment": "Malware payload (Formbook)", "value": "96286eb64d5a491e730e213b06e9175b04fdb228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260183, "uuid": "349f6b8b-bedf-479d-8ded-ccb20843bdba", "comment": "Malware payload (Formbook)", "value": "b52252a6f5dd5b04824f7db356323596adb4111c9dcb7c81c3760626807c2edf90bb41d33a9b4b67bb422526a655df61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260183, "uuid": "c17f7823-ed1a-4d8c-869b-4a637b1dfdc1", "value": "T11E3412DC72C404E1CD6E7B3205A7847646B4AE8FB593BF05B8CD321D0D623E9A8BD945", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260183, "uuid": "6fef7896-4477-40b7-9b6a-c87c8b4e81df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260183, "uuid": "501cbc56-b8eb-422f-85fc-432d6754bfbf", "value": "6144:CLiaO6+NpA4X8KYPuU/xl9fXVyXN6uNOA896a5ICY9Ru4O:6i/G4MKYHZf9EKICK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260183, "uuid": "076bf5e4-45c1-4f02-8473-ff4a0706f243", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260183, "uuid": "c8095f6c-6913-41db-a7ff-ed132f8ccad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260183, "uuid": "dcd2a2b4-1766-46fb-b4a9-65a35ef34ecd", "value": "CargoNO-20AM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8151a21-a247-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675266523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266523, "uuid": "a8cd1df9-bd6b-42ee-bee0-8db709c2f7f1", "comment": "Malware payload (Quakbot)", "value": "709e40b50b437aacf69db196d5af8976", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266523, "uuid": "7c4ed38c-ff5b-4bd3-aaad-073c962d9908", "comment": "Malware payload (Quakbot)", "value": "c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266523, "uuid": "366385e6-a65f-483d-9530-5bbd349dc2d4", "comment": "Malware payload (Quakbot)", "value": "613527c762679bfab85301dad692a5b79a317979", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266523, "uuid": "aebb84c0-41b1-431a-bc74-385898226bb5", "comment": "Malware payload (Quakbot)", "value": "e69f6afcbb658ed4e898393725bd134972c486ccf593a76409b48bbd2851d71d4f3834680b9c350747565f9e947e757c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266523, "uuid": "64c4d7db-d6f1-46b8-a3dc-5406afffb8df", "value": "T127D48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2C29DD139D1B64970A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266523, "uuid": "9bc2a68a-d841-417c-9fa1-88aeb43145db", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266523, "uuid": "7828e77e-447b-4b36-a4de-9aa8bc5acbc8", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTm3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1tCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266523, "uuid": "be51c350-0cca-4284-890a-9c8c3f01e410", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266523, "uuid": "43525831-70d7-4212-b417-096d4cfc1e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266523, "uuid": "220f0064-d1ed-499b-8b14-c995a4f01e31", "value": "84675.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f6c3c-a21e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675248599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248599, "uuid": "c11b16bf-33a2-4626-b121-4688c1e5bcf9", "comment": "Malware payload", "value": "0d5c1fd361c950b76c7e4954f253d119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248599, "uuid": "fd2de77f-e17f-47fe-ac88-1cb6cde00f7e", "comment": "Malware payload", "value": "c2a660f241bb21cd2250f452a8348406d38b8892531fbcebf59363be419fc1d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248599, "uuid": "caaafc4e-8a57-422b-a648-41a2c7d6d45b", "comment": "Malware payload", "value": "6e663102873664b3e39a77f3a10a9ee77d4b642c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248599, "uuid": "c4aee2df-de6d-490f-8ea3-4d9a756a28ed", "comment": "Malware payload", "value": "545109e1ffffb64a418206d54760f618ddd355c5808c72e29b10598a87d75e99608be38f3698c76b432c8e8aca5d7dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248599, "uuid": "89b06776-3d06-4372-aaf0-db54046d0008", "value": "T1E705063D697757D6C334F93186E18420B6EEA1823713E96ADDE61AC14F022C2BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248599, "uuid": "fece16bf-4c43-45fc-a04f-5911222cb2a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248599, "uuid": "044e1178-127a-474d-93b3-d45acf680f5e", "value": "24576:8uUjseHKNTn7tunA+/kSOYMfmBm8yhBG531paMD98et:8u3OoGp1k098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248599, "uuid": "61d8e765-c511-4277-807c-3eb33a65e0a7", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248599, "uuid": "2c19980d-cc89-4893-97ec-79df58367df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248599, "uuid": "d3059855-74ce-413f-9f22-757eac651ea5", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb5e0a0-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675265404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265404, "uuid": "9ef86718-3798-483d-b98b-656130e7e5ca", "comment": "Malware payload (Amadey)", "value": "8c5b3a2beac24f9a4878c50ce26c4623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265404, "uuid": "5192fa35-c27a-4215-9321-80fdcbabf596", "comment": "Malware payload (Amadey)", "value": "c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265404, "uuid": "ed4282cc-5606-4533-94ad-fa3148ef4627", "comment": "Malware payload (Amadey)", "value": "e223a25b65a685c5be974ab1865e03497f64bda0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265404, "uuid": "adf10381-4007-450f-b8ea-32b2d6468e93", "comment": "Malware payload (Amadey)", "value": "f712c2193ed64ce338833a081fffc714631b74a16495531c7b4257a2f1110d91825b99751421fa72aba123d693cfd9a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265404, "uuid": "ba03e6db-d8f0-41e6-8c62-beb3cbc75d1c", "value": "T1C1936B1030D2C071D97E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265404, "uuid": "9caf35ae-9042-4d19-ae83-67a84f2d65f6", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265404, "uuid": "4f4fdea5-e6c7-49b6-a1ef-afb912532afe", "value": "1536:ro4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU3jaB89p:roUCWbBNpplToUs1uNhj25LJUzaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265404, "uuid": "2cc82b36-9980-4a47-b832-bba7aa66cac2", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265404, "uuid": "dfedebc1-39f9-4100-adfb-bcbef419bd75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265404, "uuid": "9d39c09c-d5fb-4c7d-af9d-9cc6b28152ea", "value": "8c5b3a2beac24f9a4878c50ce26c4623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d482f9-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675267291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267291, "uuid": "755b355e-804e-4c70-ad23-b41d1a8fe4eb", "comment": "Malware payload (AveMariaRAT)", "value": "0e3fe39e0bef0f7800fea86dcfa82801", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267291, "uuid": "75d23af5-2ddc-4576-b8e8-d1f449f4a681", "comment": "Malware payload (AveMariaRAT)", "value": "c3b932e937cb10416d0fb1488b557078762320dea9cf3d0576f0096cac03926e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267291, "uuid": "1a50b0b0-a60c-47eb-8eb4-bb9f110322dc", "comment": "Malware payload (AveMariaRAT)", "value": "91204f3f6836952969d81a1dad3691317d530925", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267291, "uuid": "895c0163-e7f2-4a6f-a322-109581c9863c", "comment": "Malware payload (AveMariaRAT)", "value": "ae9cf1e30170c95d40ab9c013feac63b505bf123b51a8bb78321572ef5e4fe5573e8d85f9742a035b1c7b71a37c4a6df", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267291, "uuid": "a72256d4-200a-422c-ba87-ddcaab1515e9", "value": "T1A1C4F14B99D226F5C4A48874E3F914A817F5635F2129FBEB1CD802F8CB9179EB4022D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267291, "uuid": "035a2b24-fde6-4b44-a21b-31871dfc1b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267291, "uuid": "5c84e901-1217-49f2-8c1b-948b7458fec7", "value": "12288:jeMgr8gZ8UsovrjQmNUvXnbHjBKI3+F5IBRKYWTHM:XKvHAvXXBLRus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267291, "uuid": "31325bfb-a59c-4347-8511-7db1f94c6ee2", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267291, "uuid": "e8cb6d7f-f055-43db-9c6c-8dd1780d8d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267291, "uuid": "4a80a045-24b0-419e-ac71-cce4b9c1f961", "value": "0e3fe39e0bef0f7800fea86dcfa82801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24669f6a-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675267484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267484, "uuid": "5907fffe-6780-43c0-9ec1-99ae53ab8328", "comment": "Malware payload (Formbook)", "value": "72c4e84cd5e822846c61a021fa3e844a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267484, "uuid": "51882a42-63a3-43af-a9fc-9043f49a4bd8", "comment": "Malware payload (Formbook)", "value": "c3e63fb19596315605cf56504eff7eef01596f3ef814e8c2938e3f7830093664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267484, "uuid": "1656c48c-2475-4eab-bfee-a210e5854c97", "comment": "Malware payload (Formbook)", "value": "da43a7d4b7e31f3934d165079fdfb10e0d0a5ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267484, "uuid": "fb1d2832-e3a5-428d-9300-3df79d4f7ad9", "comment": "Malware payload (Formbook)", "value": "86108d4d48864141d745856523a4c3c0aae1117d103b289daf12bb19c6f2bc191cfffe1a450971bbcbffa32cd541807c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267484, "uuid": "2a786a29-7973-4edf-a2dc-a8523d137470", "value": "T1B074DFC6FA00D5A0EC2A47322A3BCD725953BC7E94742A0D2ACF3E7B3E7B4528419553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267484, "uuid": "8def2398-37a1-4a38-94b5-8f05fc59de34", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267484, "uuid": "f2a058db-2ed4-439e-a65f-076d678ace38", "value": "6144:TYa6SIvPPiON/lpJ0e0BI9qiBFpLoxCHc3v3PovtSAflZ:TYVvSONdpwI0iBHoEHWvPctSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267484, "uuid": "e3864f95-03d1-4b70-bbe0-cc04e1970630", "value": 356961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267484, "uuid": "ecaeae3c-75de-492c-a3dd-6421ed6d5f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267484, "uuid": "6452f67f-1d4f-4ce2-a0fa-17bef1b5a8c9", "value": "72c4e84cd5e822846c61a021fa3e844a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb07afb6-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261831, "uuid": "9eb7c5b5-ac2a-4b87-beb6-58e47966b7a7", "comment": "Malware payload (SnakeKeylogger)", "value": "0014c57bfd62d2929bbad91d67b77c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261831, "uuid": "be0e76dd-b6f1-4603-8661-e24855920561", "comment": "Malware payload (SnakeKeylogger)", "value": "c406f839b93838e2a8a4d1b0fd0b2b498576bc947ea71f0786d6f16a6b98b945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261831, "uuid": "c39f4adc-6a4c-4e94-962c-9a3fda058e9e", "comment": "Malware payload (SnakeKeylogger)", "value": "769f34b854bdd2a4eeb7d09f9bbe9177beae0ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261831, "uuid": "c7fc7c9c-f0c1-4662-9f45-d84b2fa4d1f4", "comment": "Malware payload (SnakeKeylogger)", "value": "6e07299e21e01f2b867aad8822664460f75381f107ae3f4ab933a09cd701bb4619d72eb7db1069cc677738a154a4b74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261831, "uuid": "72e40583-ea59-49ed-aa7f-97320d554ce4", "value": "T17CE31A1D2BF89800F5FF497305B16112C776BC52192ACE1D4AD2F55A2A7CA90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261831, "uuid": "c847f62b-d428-40fd-948e-455d84e63a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261831, "uuid": "cefa7560-9091-4294-9539-a9dab8eeab9d", "value": "1536:SAgzEJRCRjTZ13uJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFq9eQbb/UUcGSiL:SAgAEzoHj/LDdJwb8UcGSQwBj2iFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261831, "uuid": "90eb6702-3231-4f3b-b8bf-24c5547e63fc", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261831, "uuid": "b1bcee02-b906-4996-b533-ccf3ad9a747c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261831, "uuid": "bf90d125-885d-4aea-aa2e-9c0ea70ad2f1", "value": "0014c57bfd62d2929bbad91d67b77c3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b609c77-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675211741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211741, "uuid": "c61f4acb-bb45-4241-b95e-9d4e911ce6b8", "comment": "Malware payload", "value": "ecad138645d6e9bb23777c2871786211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211741, "uuid": "5559d6d1-fc17-4596-aa0e-cc7f19d07c08", "comment": "Malware payload", "value": "c4878022138a1fdbf5c1ba0fb8fe739810ec31b9e83fd334ba4c2f96e675610d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211741, "uuid": "742f171d-6565-4f66-b2b1-6da57d027856", "comment": "Malware payload", "value": "7c194ebd4c5f629669a8b22cba2f448b859d7e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211741, "uuid": "2d207c08-70b2-45e3-bb9b-d3074771d36e", "comment": "Malware payload", "value": "62636cc0ac21cdee9a9052627c073ce65662fd91577b9bb570de4d3dda8a94321c224e6140a3da9dd13031fea12753ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211741, "uuid": "3412ddf0-48f8-45dc-859e-8be6c21e603d", "value": "T156734B23DDA4B8A2EE468A721C40516845434D359915BE0BBF0D3F2CAEB66C3DDF532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211741, "uuid": "7f5ff153-3d10-42ec-86e8-e080b2b24097", "value": "5770ff113a3e44536505c9eb45bc8281", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211741, "uuid": "9ccbe0cf-b2d3-41bc-99d3-25659c46fff6", "value": "768:xMWsiW/asd0ZA/YuOeaSuSRZOnh6MmW/asdDOeaSuSBkFNVHrQQnsWMLS92GddJp:xMWU/AA/YucSRYh6Mp/RcSWQ8sI7UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211741, "uuid": "9297a9ec-92b5-4bd2-b6ae-5e86b0d33a1b", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211741, "uuid": "f7321e3f-f39c-405d-b9f4-abf264a64fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211741, "uuid": "38e67ca5-4f61-4b6e-9687-c1d3b4d44c15", "value": "SecuriteInfo.com.Variant.Symmi.94861.7356.1827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da5a2fa-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675267096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267096, "uuid": "07856423-c8e4-4f87-ab87-1d2e3fa4b4c2", "comment": "Malware payload (Formbook)", "value": "bce42d58125e6db119b1890d916ce0c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267096, "uuid": "39dba308-b277-4a5a-9612-e3a172a94184", "comment": "Malware payload (Formbook)", "value": "c56a221640c5c2bdc86b73762659626cee2ecbbbdf2a48489966aedc7c3f4e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267096, "uuid": "cb193034-1941-4bd5-8809-d8ec7dbfbab5", "comment": "Malware payload (Formbook)", "value": "9a4f8490052764b134339a9133e2d7c1d393d552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267096, "uuid": "6e4a9684-a41d-4579-b80a-27620264faab", "comment": "Malware payload (Formbook)", "value": "f95dfcf61df99b6bd1f8007a541ea6e4e631ae33b2a7a11ee601534770d4ef83c967b79bd1052de586d3cd8150a57ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267096, "uuid": "56d013ae-aa50-438a-a1bc-4a696d3f4566", "value": "T1C1C4231112F89BBCDB3D06FE40B7A96043B06A27790BE6CC1FE658D5650370A5B706EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267096, "uuid": "6b976dd2-d4bb-4fb8-ad74-7a0093627ae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267096, "uuid": "3d381dbe-264b-4181-b7f4-c00234ee3d31", "value": "12288:/Y4rbVlv1RSOzUPgV9q2DoV/O4CvLHmnq3r8z9i7+pvfCWtO:hhpdKyq2oAzHmq3r8zw6RKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267096, "uuid": "778b74d3-b6b0-427b-9365-18df8b43c0ba", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267096, "uuid": "47611e6b-bfa9-4a83-befe-066c0a07ae5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267096, "uuid": "c1ec8604-0358-4a84-aba2-fa23f4439c2d", "value": "bce42d58125e6db119b1890d916ce0c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26eea60a-a264-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675278655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278655, "uuid": "3a61aa01-9e5b-40ea-9e45-8111bc651fb5", "comment": "Malware payload (AgentTesla)", "value": "e03efd4633d9b7b24640fbcc34afe476", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278655, "uuid": "5ef2ab51-708f-46b1-8d71-65ab70e93b42", "comment": "Malware payload (AgentTesla)", "value": "c5829d070f0fa79cb51629a7fa89d3b7d2fe02ad4ab770e6eda5fec449e67745", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278655, "uuid": "0dea4b5b-c2dc-409e-900f-476ebc7674c1", "comment": "Malware payload (AgentTesla)", "value": "cc653044611209764193d30039bf5c3301dfd997", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675278655, "uuid": "8f50b389-f97c-4a8b-be18-5e2914113f45", "comment": "Malware payload (AgentTesla)", "value": "ee7741879553f0fff60e92d651b53d8ac885862c18c34c8afeb34f60e0790e13e9232e93252eb4717e415f54ca7f41b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278655, "uuid": "992b0408-f5b2-4187-ae9d-cb42ec35023e", "value": "T1D8058D8777B19872F6CB10A6142837CD2FE0B103BE95E257AB7B79C097058FB7698241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278655, "uuid": "d0763976-aff0-4107-804a-e8cb04a2aa11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278655, "uuid": "5e47694d-20c0-4953-8ad3-18e9fb2852ac", "value": "12288:Ztz8L6guiYpPIRPrK3oxUfJqQ48wGrbRJAMVZy153TA8HYxMRSR5SwqG4yPa:kLxWUoMAdrbHl8RA84yRU5JqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675278655, "uuid": "6586f3f8-bfca-4def-85ff-b283855259bb", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675278655, "uuid": "affcf873-e29d-4b28-af70-efe6a6a537dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675278655, "uuid": "4bc42ced-8f4f-452c-9ee1-824c2eeba02b", "value": "FDK00001392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fc0c71-a222-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675250464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250464, "uuid": "4660e8a7-04c3-421b-b91c-f52f3f86df42", "comment": "Malware payload (AgentTesla)", "value": "5b1124e43853364b49031a46925421ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250464, "uuid": "065c72d2-8d4a-4e90-985f-6f9313efddfc", "comment": "Malware payload (AgentTesla)", "value": "c5998fe4f7015745ff808980f3c004ac4dc715bb1f7ac2ec9f1bfdef0bfba219", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250464, "uuid": "73cfa372-2589-4c26-be97-09955dc13b38", "comment": "Malware payload (AgentTesla)", "value": "9125308711212a2ec233aa1d7480ad038517a133", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675250464, "uuid": "810044ab-d3c7-4903-83b4-62327db24339", "comment": "Malware payload (AgentTesla)", "value": "6e76200efe7a4cdd9021c8989c0b3ea1a9eb606a0f20ebfb254d15d9baa6b67a0bef2b1d04c0e2e9466537ceedf80d56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250464, "uuid": "4340ada8-5034-4259-8971-aeeaedce87cb", "value": "T159029E79A21D790A796DE72D34AEC0F8F40E0C4D575883AA3400887A4E627605AB7FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250464, "uuid": "75283b3e-3849-443f-bc9c-03253492855a", "value": "192:QegNo5vx002wtJk9E3BHINo74NlKPfNGfXRJMxkf:0NWZ003JkiBHI44NlyfKJyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675250464, "uuid": "b4e9e2c4-80a8-4f25-8792-df97bb45c73f", "value": 8413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675250464, "uuid": "08af53f7-9770-48ee-94b4-eff2018562d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675250464, "uuid": "0d1a8381-3903-4a07-b742-103d27c31a9c", "value": "P O.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa12e5e-a1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675209673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209673, "uuid": "e1fdfbde-5689-415f-8d6f-94d3cad3e396", "comment": "Malware payload (Smoke Loader)", "value": "9e7169332dde974d96545319ff1dc9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209673, "uuid": "9bc5b593-b90b-4f38-a42f-c09ac51df23f", "comment": "Malware payload (Smoke Loader)", "value": "c5dd670651781f5ed11077645cf56f0ab871c79e0655f8ad1bb27d0e565ea986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209673, "uuid": "72bd641f-e807-4dcc-9add-46d1e2b75630", "comment": "Malware payload (Smoke Loader)", "value": "09b6647f6fe3f2388bf234cb0416e0933769093e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209673, "uuid": "5877e132-bea2-4e9b-9ecb-12ad94a938dd", "comment": "Malware payload (Smoke Loader)", "value": "c77061840fc59e5bceeabc660dc94b79f08bd9c18796addb2482f2e9598ef439259a2717782e4a7f095d0066513907bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209673, "uuid": "c0e203ac-e2c7-49fa-ab4e-502a78875d37", "value": "T167548EC272F27C62F8628A729E1EC6F4351FB9534E186356121B9B9F35B11E1C1AF342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209673, "uuid": "688c37df-d63a-458e-9ab4-b083431e7ef0", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209673, "uuid": "beb97b77-41cc-4de7-853f-627b2d30a5eb", "value": "6144:kzsLZPTNS82a9syusau+32AAUmqMoIcf8M:kYFPNVhJbqMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675209673, "uuid": "01c35335-6b23-440c-967b-3d888f3d422b", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675209673, "uuid": "989ae44f-88b1-4a82-9852-c172a669c248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209673, "uuid": "3da15c30-0438-4ced-8b6e-be1896cd75d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2156abb1-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675239991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239991, "uuid": "926105d6-8ee4-4c1d-80cc-f306275cd87c", "comment": "Malware payload (GuLoader)", "value": "b1b4116585f8ad91d96392d0b931f317", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239991, "uuid": "959b7052-1d4e-459a-ac62-85ccff1d1c04", "comment": "Malware payload (GuLoader)", "value": "c5fdd2b1883246a188a2410bb276961732718a76e5d380ef8fe1db8e05f72915", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239991, "uuid": "f9770f60-84d9-4894-8318-cba2adeaf657", "comment": "Malware payload (GuLoader)", "value": "74c7f75227bac7df1cd2098f30727ddd21cd5b77", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239991, "uuid": "352cc181-5e40-48ce-b492-be9ec0990722", "comment": "Malware payload (GuLoader)", "value": "386c935a797a14516d4eea38bb39993097a6b74061a6696c7444c997ecf0a437de49703c0e324743c9794f75663cc018", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239991, "uuid": "a733f88e-f4ef-40b4-a0f6-dc27cd64799f", "value": "T181536B60AF5D16144D5E0F56AC823FC95479402773263C6B6CAF328A36F3F38B76A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239991, "uuid": "7d157f5f-bdea-4d95-a553-0cd665fd7822", "value": "1536:F3EyvLpylJpwwY9qdH7W78MUOp/dWvEVWE/d:F/v1ylJWwyqdH7W7HUgdAE4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239991, "uuid": "2c34707a-8e31-49a5-af8a-29f22ee3f7e0", "value": 64183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239991, "uuid": "2d669d64-db5c-4a73-a0bd-54c03207d7c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239991, "uuid": "0b22d67c-cab6-49c6-b3c0-81a5ebb13fb0", "value": "SKMBT_8812202816310TD01_20230128_17355 XLS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee0ca0e-a21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675248147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248147, "uuid": "90b4fee6-961d-45bf-bda7-93d54267eb72", "comment": "Malware payload (Formbook)", "value": "c456cf29dc8d2f6e5373f6a801739ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248147, "uuid": "1db49e72-6311-453d-9714-147bef97bb34", "comment": "Malware payload (Formbook)", "value": "c68eeec669470f147bf9507222236740f428f2a385c6cdea0a80a7ede4124c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248147, "uuid": "0d92c2e4-e2a5-4039-9bfc-537865674eab", "comment": "Malware payload (Formbook)", "value": "73981f9da43928d6e3c03bae56b3cbaa622ae9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248147, "uuid": "3925c9bc-1d03-40b9-868d-3c0238acc719", "comment": "Malware payload (Formbook)", "value": "adee09884e9e4b228ecf38fca66efe658cc4f58643e62355c90dab5eee80c9c773667609bd26d1f793538714478878e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248147, "uuid": "96c485d9-6405-4996-8e11-9b04252aea3d", "value": "T1985412582BE8D5EBEBB207715D30EB257EBA441128704A6F33200B2DBA25793D51B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248147, "uuid": "283b88b8-105d-42d2-91e4-03ff57e04317", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248147, "uuid": "649efb8f-148b-44a6-8344-406b6b8a04d2", "value": "6144:/Ya6gO4LNVn+G2iju5z6XDTau/3D62QHLAWrk24Q:/Y2TVnDaoG061rrk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248147, "uuid": "a3208a49-4b8a-4c4e-a9f9-fbc961b484b0", "value": 281214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248147, "uuid": "c25a388f-91e5-4556-870f-9b596b46bf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248147, "uuid": "76d91c25-2c53-41d7-838b-1a557d26f92e", "value": "Yeni sipari\u253c\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9822a790-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675267248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267248, "uuid": "306eb5fb-b302-48a0-afb1-99c956f791fa", "comment": "Malware payload (Rhadamanthys)", "value": "e95ef576ac1ad8a5ecaa2d8698152cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267248, "uuid": "335c40b4-830f-4af7-8023-d928759b4147", "comment": "Malware payload (Rhadamanthys)", "value": "c6ae0ee31c4c3a75db5f96840a335a01164f1e27750024d8ca8af455bf970788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267248, "uuid": "b14f05fa-f189-47ab-b154-105d3a9c380d", "comment": "Malware payload (Rhadamanthys)", "value": "1c1b4894b859420bf8033a9d9f4faf03d1dfc8bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267248, "uuid": "da7e8050-fd56-40c8-b3ea-744dac44720d", "comment": "Malware payload (Rhadamanthys)", "value": "c18a1dc563f36c9a653f5c398ccca4e6ab40cd354e3e6a573a92bd77a65992d295a40aa329de50a0daece26269ee23d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267248, "uuid": "4a7cffb5-1278-40d8-8b7d-061ef2e4feef", "value": "T1AA24F1207590D137C01340B64C24D2E5A93D7E31FF76AA477F591B6E4FA22C26A2E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267248, "uuid": "69dd1dfa-c0b3-4a2e-ac2b-236673c37860", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267248, "uuid": "ee423903-96d8-4f74-bbc4-e47e693027f9", "value": "3072:5jxGkbL6sYwP536/DjGxat2pNYdR+0A9V8KDJUD53Zu7yQawdpitYw:5L5Ywp+DjsY2pNKOHJUD53fQawW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267248, "uuid": "6f1a5889-7c93-4c3f-a01d-2fd00377dd91", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267248, "uuid": "8a1988e2-f6fe-49c8-8f48-6fa8b8e47bd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267248, "uuid": "249554cf-aa13-4837-b5ba-c0b10619883e", "value": "e95ef576ac1ad8a5ecaa2d8698152cc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac747f77-a232-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675257404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257404, "uuid": "eca62934-0c65-4fe7-98e5-b57db1c6b959", "comment": "Malware payload (Quakbot)", "value": "1dc905d6b0284a97ab7003046631b397", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257404, "uuid": "75e12334-1b6b-4ba1-b471-e0a8e14ce370", "comment": "Malware payload (Quakbot)", "value": "c6d6a6df28e2f818b0a20c48849cb47f10d21dbe5b870bf9a7c251ebf4ad9ec4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257404, "uuid": "a565d444-d256-45aa-b4ea-a03333a3be6a", "comment": "Malware payload (Quakbot)", "value": "c5a4350d5b455b9cae8ce425d3f2902fa9f7254a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257404, "uuid": "a5566323-dc6d-4459-a1a1-2c69768478aa", "comment": "Malware payload (Quakbot)", "value": "5925fea6e335f2e40c20fca8fb3ea7edb334a2d0429f25c09c6cda279db131128eb0ee38af281f163d6da61b9c20b2c1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obama235", "colour": "#456A9D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257404, "uuid": "abe59a3c-c121-415e-beec-6c1aca5f7503", "value": "T1F3416894ADB7EC2487C8B6CAED619404431E4BB3E047921FEA847F911A923E4FFD4155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257404, "uuid": "2ec86e3c-52d9-4de3-892b-7a819729ef25", "value": "24:iZOuxmCiuR9jDypCeBYPC2dQOpQ//BYPeHe83+7zVhiBuMRR2biRRPVMzYQgIM9V:5C9/KCeWPfdZ4WPe+G+7RQ5NCNKJxayl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257404, "uuid": "e83676b7-1d3b-4fd0-94ab-13850d4d9d94", "value": 2254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257404, "uuid": "42d46b19-4aed-4c3e-b5e1-0f0914bf016c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257404, "uuid": "b50758f5-3f2a-44c7-942e-e4442b6d0800", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb2f6c5-a205-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675238157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238157, "uuid": "7b3475a7-d92a-44e0-b184-ee44ee6242ab", "comment": "Malware payload (Smoke Loader)", "value": "c6c69df978675967122a2a5e9a980151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238157, "uuid": "3c000162-d1b3-4223-a276-a2f6683e73b2", "comment": "Malware payload (Smoke Loader)", "value": "c742390f441df393028d21a20cb74db75dd0af008fbf9529a5fcf16c4949a629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238157, "uuid": "0ce061ac-f5ef-4f75-a76d-a330822edeb2", "comment": "Malware payload (Smoke Loader)", "value": "52dda0ae4fc00777445b946ed280f88c8b6bd1b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238157, "uuid": "ab149ee6-8a67-42ff-aaea-3f824e7aa4e2", "comment": "Malware payload (Smoke Loader)", "value": "796d4c59483846f9539c9d1d13a7244a04526a41d4bc8d2665ab6e74a05b7effa2d2630da1b2b563be44c930181547ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238157, "uuid": "2c54b37e-2de1-4c73-b79b-8f862f9afa64", "value": "T14234DFB23990D073C4AB54307C30EB947BAEB5311A39595F7BA817AE5FA02D0673634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238157, "uuid": "e0a75dc7-807a-491f-9a91-8131e27978b9", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238157, "uuid": "2db821bf-4395-4c06-8b53-b513191c7b6f", "value": "3072:BSEG0OtxHbVP/Lq1eWCD5hlBQRioXEwvg9BFbJnv+UQdBd:BSEE7VXLq1ebjQdXEmKjJnv+UQdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238157, "uuid": "e3e906a8-6257-40dd-9f38-d90abc5cb1eb", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238157, "uuid": "b5478174-612c-48e2-8939-786c9e8e585b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238157, "uuid": "6487bb39-3e23-4e88-90ef-19b5aaaacc36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40478e3d-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675279127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279127, "uuid": "4e69d605-50f5-4c73-bc76-c11b33243245", "comment": "Malware payload (Mirai)", "value": "8e70f19cb26ab12cc61b99e32fb71a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279127, "uuid": "430bec95-7aad-46fc-99a0-fcdbd58d1fdc", "comment": "Malware payload (Mirai)", "value": "c7c26d75521235eccbbcf461cf6262225785a1e5d1375b22c97e2f3644c55416", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279127, "uuid": "253795f2-6666-4d8c-aefc-c6aae92ab80f", "comment": "Malware payload (Mirai)", "value": "274332372fdf21b944b624e0349d7945d52436dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279127, "uuid": "c398e449-9d61-46cd-a432-804bcf53c3fb", "comment": "Malware payload (Mirai)", "value": "a166da6cfa909da049c9ce830dedaaa0b91435597bb42eb782db4a411745106d665b26b6b16b3bfdf5637be80d396c98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279127, "uuid": "0c88230f-41e4-474d-9549-92c23e93d55e", "value": "T1AC73C61E2E219FADF76D873647F38E619348239626E1C681E56CD9001EB034D642FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279127, "uuid": "93f8541d-518b-43c3-b804-6f88c93bcf97", "value": "1536:kBlpioyKvJvVoQ6DyXVBzho6iXoyvUmSsRlWgrBm7/6OKCcGMGRjw:kBlpioyKvJvf6DiVBzOzvo0D47CbYMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279127, "uuid": "284e0b76-8513-4799-ace8-f3f0379c7be2", "value": 77016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279127, "uuid": "f34cd2d1-385c-4abe-912a-4512bd222de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279127, "uuid": "54034315-0eb4-4fbb-b67d-1e7df03a536d", "value": "8e70f19cb26ab12cc61b99e32fb71a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a35fd3-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267157, "uuid": "83e088d3-68bd-4c1a-8a37-fed0a5f0ff98", "comment": "Malware payload", "value": "771d211ebe7494a139f2b76fbe7c3704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267157, "uuid": "6ad03024-cace-41a8-847f-13627e7f21b4", "comment": "Malware payload", "value": "c7dd78efea30251ec8a5dc9d5ff5ba92dae3771fb4c9cfb0f44a23bdabcaad52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267157, "uuid": "74257cc9-282a-4bb7-9622-840a408a87fe", "comment": "Malware payload", "value": "ce312d13a9962bc458d7dbd226ec30c002b1eaba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267157, "uuid": "81c2312b-6649-40e6-9a6c-d3cb65bc3181", "comment": "Malware payload", "value": "4996a17989198524bba8126bd07a38fc7b4c16731eed93dbc457c028e6f5620f9e8279c75ef70317f98aa883bef11da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267157, "uuid": "f0526a09-f66f-4d73-8995-b5d83a99312b", "value": "T158C1EE015EEB10DBF2370B3057E6B3B716A6F5B1452EA2B874448A995F30BC0CC62EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267157, "uuid": "2e09075b-ad64-40ac-85d2-35cb357d4b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267157, "uuid": "62d06667-c194-4191-a8e2-d480dd57aa07", "value": "96:tw79nOCF/dd7tBfvk+F6AYxsOvk+FUnUvfd3ojqrl:tW9ndFld77vkAYdvkzMfdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267157, "uuid": "9e866bcd-ff57-4080-b190-d08d91bc83bf", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267157, "uuid": "76c3c849-be9c-4dfc-ad3a-f416f7568425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267157, "uuid": "936613ae-236b-495b-9636-e5966597fcf2", "value": "771d211ebe7494a139f2b76fbe7c3704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d639ffa8-a1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675226121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226121, "uuid": "6dafe61b-2f5a-4d3d-bb62-38b879e72020", "comment": "Malware payload (RecordBreaker)", "value": "b2ea787779b3a69119917db1862fdd50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226121, "uuid": "44231636-d4dc-416a-97e1-1d5a733fc441", "comment": "Malware payload (RecordBreaker)", "value": "c7ebf50e12215ee97c015ce0f96f656d1274f07c36b672219f9d18bde8072362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226121, "uuid": "8dae895a-d21f-4969-86a1-4f953403e1db", "comment": "Malware payload (RecordBreaker)", "value": "13cfa137064233181d1715cb631185aef1414520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675226121, "uuid": "9f6ae0e8-81ce-4ef5-9e26-3313a4bb1ed0", "comment": "Malware payload (RecordBreaker)", "value": "7cea495b036bc74f87fa75336f163d172648cad14d5dd1357b1f4b799e3e78dd099505c9b8f17185cbf9177cb6cc3e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226121, "uuid": "7e2cef48-79d9-491c-8b42-3233f3333f20", "value": "T106A518B63B5E65DFC8B205BC56FEB903A75813E78221AA1384FE34B1BD86C510E8F514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226121, "uuid": "c518d085-4205-4279-8e2b-6ca1e99294ad", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226121, "uuid": "60e92173-80c2-4b08-bb01-d0fea2fbe682", "value": "24576:VJYp7t2/0TXJCg8/IN1b4F7cBzwq3EXR3xympR3JA6yaRGTWA4qAfCpm6neAnb0c:VJYeicg8/INu6lvA/aT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675226121, "uuid": "bdc21b9b-749e-40c3-a836-62c7650917fc", "value": 2201616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675226121, "uuid": "8d504a72-dc91-4fc2-a4c1-d30586ea2c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675226121, "uuid": "1b255909-898e-400d-8201-a9416df6d322", "value": "b2ea787779b3a69119917db1862fdd50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d607daca-a266-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675279807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279807, "uuid": "91f927bc-0547-4121-826b-318fc22b1b6a", "comment": "Malware payload (Rhadamanthys)", "value": "7929c1d2591a1ca8cca13fffbce895d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279807, "uuid": "ea51ca50-0f5c-435a-a229-d54f116ecb16", "comment": "Malware payload (Rhadamanthys)", "value": "c992562284eafd147ee1f72c29dba9c01e892b5dd147fc5d7c6700f15a2a70fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279807, "uuid": "5affb8cb-2c8e-4238-b720-eca8c1de17f5", "comment": "Malware payload (Rhadamanthys)", "value": "bf9b751bbe35665fa553abdd040441ee3bdd5ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279807, "uuid": "b583c268-faf2-4589-90bb-a5525e693eb6", "comment": "Malware payload (Rhadamanthys)", "value": "470ed16356c4969a618bd42f73b6efc56e276f3b98fd60d0ec0f7674f4484ce795f8883dfb45204ff2e437840a47e69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279807, "uuid": "6debfae2-ef1d-4bc5-ae30-2280ec7e3f2d", "value": "T15D54E07175D0C072C2B35138EC20EA866B7E74F195B8984B7B941A5E5FF06D22B3738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279807, "uuid": "92be762f-2946-4cf0-bada-941a4b84bffb", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279807, "uuid": "42c38c00-b43a-4238-b49f-f98ec8dcbd0e", "value": "6144:ojxEpLP2SXy5f+m6LYy+8CNV+PJgTrZTNBq0aQu:ojxkT2Suf6sy+8CP+PJgTfExj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279807, "uuid": "d3a775a5-b550-4b73-9c1f-aff613341ca7", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279807, "uuid": "b6169e0f-8e8f-42a9-ae4c-aaae470451bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279807, "uuid": "d7efc152-d89e-4299-afc2-cafc4462f4f5", "value": "7929c1d2591a1ca8cca13fffbce895d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c366e3f-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292917, "uuid": "8284f415-8e42-4afd-8601-5e683bfbadbc", "comment": "Malware payload", "value": "5684e72ea4350941468709135bc775e0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292917, "uuid": "f1ec59c0-2010-417a-bf0d-16149d933689", "comment": "Malware payload", "value": "c9ae9e6bed2bf50de1a90e3590e53926bd7618c4b120eb389df3e7b6ffa752eb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292917, "uuid": "a412b864-207d-45a5-99d9-865efd55b113", "comment": "Malware payload", "value": "c8249904e5081a3b80a5a3723c7015ecb8d7500f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292917, "uuid": "8755c06f-938a-4b65-ad2e-bb61d148b17c", "comment": "Malware payload", "value": "1a7fc47b2eb81f3faa1f949c43d958596d84d716be17eab3f317e9ed93f594426b6d9987feadfd53da52747534726f6d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292917, "uuid": "91d32b2d-eb9c-4964-acc2-3f10cb7348d9", "value": "T1D7363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292917, "uuid": "1cdd571c-82c9-4ff6-97f2-8241d5e90fb3", "value": "98304:Tv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX/:TvpvFa+g8RWLdPk/84tCEr0RtNiC5eSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292917, "uuid": "5a6f4a98-7d76-4094-8046-1ee9acd8f8ad", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292917, "uuid": "45e7f83a-fc0c-460e-8911-b26cdf383f41", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292917, "uuid": "0ef62e6a-5cb0-435a-b57a-fcf187351eb0", "value": "c9ae9e6bed2bf50de1a90e3590e53926bd7618c4b120eb389df3e7b6ffa752eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4ee8e6-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675239987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239987, "uuid": "4ebe07c4-bc0d-4c5c-9daa-cc1ceabbf281", "comment": "Malware payload (QuasarRAT)", "value": "72de5e62f28c84e425274b91422eeb42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239987, "uuid": "6b1fe727-01ce-49cf-b8b5-be7df25454b2", "comment": "Malware payload (QuasarRAT)", "value": "c9dac6cd36781a54842910fd785651b3a9f1a96c88c2f005dda29ac9ebcdb4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239987, "uuid": "c9adc7d0-71f1-4e17-8124-9fac351190c3", "comment": "Malware payload (QuasarRAT)", "value": "50037bc992521b075ae016585613af52375c73ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239987, "uuid": "d2e056c9-fd38-418e-bbef-ddab04bea6ba", "comment": "Malware payload (QuasarRAT)", "value": "95978de3ca878d55e41e7a706328eb323f373631629faa4aeca21e670dc8b0aa6323cfc2b60f9428533d24842c5fc62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239987, "uuid": "f93a2a07-bdec-4e9b-a146-4690f1002176", "value": "T17F65E1827282817AFF63047851E5BE21701B7D5E1E3D916BF3A6895FC6272C18FAF142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239987, "uuid": "71e6040d-451f-4033-9279-89983599c581", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239987, "uuid": "37e1db05-7b24-443e-b207-929641b94494", "value": "24576:kNA3R5drXZqFLto7/blAc97BTSKedvpN35ZeU4IvNtMSR/6Ont8yEXyIZHsVoHu8:F5ZqFLtoz6g7BOdRNqIvNmSF6OSyEXyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239987, "uuid": "a298da03-6ec1-4a13-840b-f5c8c39f3a21", "value": 1475667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239987, "uuid": "8cf9aa1c-bf94-4c45-94a8-32ceef352557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239987, "uuid": "9ebd699b-dade-44ac-ae00-c685081d9a52", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8ca79c-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282320, "uuid": "d49df94a-7ebf-4a4c-baa0-b30606808a1a", "comment": "Malware payload", "value": "f9cfffe4e66c71e633794da64b8180a4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282320, "uuid": "c386c68d-1912-44cc-9484-2c3f7ae9d02f", "comment": "Malware payload", "value": "ca6fb5cb02345b8f8cc81417cbed9d01dfb3c1beec877ede56c6287b2d058780", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282320, "uuid": "1a772f43-3ebf-4b1d-bc44-24bf25be5d25", "comment": "Malware payload", "value": "fd2a9ef10b12e1895969e2c67c7957f68802b8f5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282320, "uuid": "a096bb7f-5883-4945-af2d-df1cc6329ea3", "comment": "Malware payload", "value": "544bddb37e788e7e914bba631a4382746192fc78312367c8950e16c1c27c5538b907ca034c25f24d898f5e0f32f18255", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282320, "uuid": "b83f427b-1c97-40a3-8b56-44a9d0a8ad13", "value": "T12D44B01472D0C076E19B223406A5CBB70A37FD654B205BEB6F95263E5FB82C0CBB6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282320, "uuid": "ddd2eb66-7719-45a4-bd4d-03e2f4dc8f01", "value": "56544831523e9e8f64e42a4d6aeb1ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282320, "uuid": "d4bf0434-0682-406f-801a-20fa3068f939", "value": "3072:myR64m3uiNEib+3NlcpX0XEtnvJzfQcHa8fiLtPy0AV5ODgnVqTLA4OmsWF:FH6Gh3vK0XEtJDHhfyylODgnMo4nsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282320, "uuid": "17faf033-52a0-44ee-b065-d677625c9944", "value": 261128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282320, "uuid": "162811da-3080-4e7d-98c8-1c5bc079918d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282320, "uuid": "ee49b659-ea7c-471e-8ca5-ff629b797734", "value": "zarchive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0ab750-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675263683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263683, "uuid": "f8d35b59-fa68-4fc9-af89-0f28ac3f2dd2", "comment": "Malware payload (RedLineStealer)", "value": "700c400a0fcb148eafe327b539bab0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263683, "uuid": "0d0a9b1a-1825-4833-ba99-929d35d79079", "comment": "Malware payload (RedLineStealer)", "value": "cabed532948e3e8662b256fb709b01db796e06fe704667b33bc712d57add46ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263683, "uuid": "183dc895-fe07-4a5b-a2bd-be036498e855", "comment": "Malware payload (RedLineStealer)", "value": "85d14338e6565a62c3b0deea58f321944751902e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263683, "uuid": "7b336970-d809-43c8-bb7b-4d08038de00b", "comment": "Malware payload (RedLineStealer)", "value": "22c482af04f4f20d82b8ad22e5aeee29d125ef76c07936ebd9027391718165e9d715a18168c2b99e02f48657a4ba92fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263683, "uuid": "75068591-d384-454c-aa28-f259d6acfb24", "value": "T1B434D0323690C072D57E007C9D20F6947BAEA5321975998B7B9817BE9F302D1663B38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263683, "uuid": "8c0882da-6adc-466f-b061-bbf5450dee5f", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263683, "uuid": "2103ed79-a15d-4eeb-b2ae-d1143be11540", "value": "3072:emKG6/oDp8TSL3ZWxCF5bicKkHP+f330VDJ0HrwqYZirt5FC:emKu2GL3ZoCDpKkH801JGAirtnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263683, "uuid": "c1ccb6cb-7e46-4b07-a8df-a6576943c43b", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263683, "uuid": "a9cd7da4-fe54-4c34-86f7-690efb97f408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263683, "uuid": "3e505fc8-3f1d-48db-8856-91843a01cf72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d6b6f2-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261770, "uuid": "dba1b1c9-8ff8-4a2b-9395-547b05f53605", "comment": "Malware payload (SnakeKeylogger)", "value": "0a8801d1cf3ebae4a8f9663f6a86e93a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261770, "uuid": "30440f31-ffde-4558-abe8-4a64b2d08c5f", "comment": "Malware payload (SnakeKeylogger)", "value": "caf38468bb4c88ceeb6d81e15d5f14a10d1717d0aaa94078d464d5b20c3d8df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261770, "uuid": "ef95cc65-059b-4b29-954a-3fff0ae5ba2d", "comment": "Malware payload (SnakeKeylogger)", "value": "890c4b39873c17594b47918ae9c370bb65cf6984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261770, "uuid": "2874b1d9-9a3e-4858-a386-da487f912f3f", "comment": "Malware payload (SnakeKeylogger)", "value": "34a2be93c342e83cb31700472dd84e5d8153db7a84ede1da2ba18ac473b34650b96144e64a961f8325c338204efa8e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261770, "uuid": "d17ab550-70a6-4eb4-9d5b-ea22827f58f5", "value": "T14454120277A1E147E8E20670B92992331DE6EC794454474F37807EBF7F23B92A61D3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261770, "uuid": "eb4a0ac2-41ae-4b03-ab96-49a998d526c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261770, "uuid": "aa5d50d0-be69-46da-b4e7-0ea57d46d9a9", "value": "6144:eYa6p6Tw2MxZ6o9RviCyOlgJv8zTNoac5rJiRmwnFjbtB7PGgNKTKKXcg:eYD6yDvVHdcSRmSFd1OgCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261770, "uuid": "d07fec88-30eb-491a-b732-45b907f8f32d", "value": 292926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261770, "uuid": "194debc6-787c-4a84-93c4-ddbc68b1645f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261770, "uuid": "95d33282-90aa-4598-bb1c-247a6d0a1487", "value": "SWIFT 2023013109939001993001100.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb0ecc5-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261837, "uuid": "cb1bc6ce-5ad4-4b06-b2e9-81a08ad665fd", "comment": "Malware payload (SnakeKeylogger)", "value": "53401317bbbfae9d7c18dc743aaafd0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261837, "uuid": "1455fe17-bd38-4baf-9653-d120d9073533", "comment": "Malware payload (SnakeKeylogger)", "value": "cafb19a810ff02abdfabdd1b02a1c01b1b8dc6dc97e509f3f8faad314ce69c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261837, "uuid": "7698808b-65dd-4b02-99ae-d5b90c855741", "comment": "Malware payload (SnakeKeylogger)", "value": "b6aa3f578eee28e1393ed2fe1d3ecfa83089eaf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261837, "uuid": "b9526f75-78eb-43dd-907f-e67846839665", "comment": "Malware payload (SnakeKeylogger)", "value": "9b7d568a3b1868d5dab7b3bb1455db351013f3b5d4525ad3c9500cd5ecb997e0b49361a107426bde9d6635e4d551d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261837, "uuid": "d8b54073-63db-4ac4-9cf3-e4d25f792694", "value": "T115E4BF432978D59AEF6902FBE10A505437F5CCBB851CFA185BAD3382D9E1B510C6BA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261837, "uuid": "e7747959-b6fc-4c81-b997-e1fd54f2ba9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261837, "uuid": "19b0c641-fb28-4f69-8d5f-3de6f605bffe", "value": "12288:33bUCubKl/g136avlKLwzyyn24maBBLLUfo5v6nnjqKoe:7UCubKlo136avcLwzyynrmILLUO6nnjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261837, "uuid": "bcd0792f-a5d4-4f9a-bc50-d9fe5a0e8af1", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261837, "uuid": "ea7ef49b-8d81-4206-9f4b-8eb97ca6de4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261837, "uuid": "3fde56ca-d8f1-405c-8e8d-9db3aee00820", "value": "Projekt 41-17-082 BR192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e67e43-a21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675246974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246974, "uuid": "698af322-8d90-4795-9b5b-4c7c1a023856", "comment": "Malware payload (AgentTesla)", "value": "06ef3e0eab21a98fca55056fe73bbfd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246974, "uuid": "0e8afb55-7f7b-444f-9fce-cc498c363cdc", "comment": "Malware payload (AgentTesla)", "value": "cb0cc00127f40549832f423400571af4b1ab3500d5336e4da6bae019bcbceab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246974, "uuid": "c04e0c33-729c-4b30-a5d7-982a0387c528", "comment": "Malware payload (AgentTesla)", "value": "b65bb3b6bd57659e0ce605e17d61248687250b10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246974, "uuid": "85c49bb2-2cb9-4e3a-98e5-d836763c67eb", "comment": "Malware payload (AgentTesla)", "value": "d41bbff309ad26194cd12e25327054517c62f8f7b59c3c55bfcd0fac952b3f302700993a5235b5ff47530b7c1a719c9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246974, "uuid": "698e1a4c-c577-43a3-8e16-3db5926e30ef", "value": "T1BD02C04E8CA1C79AE543C97A599B280BB24D77098ED37F5B4D0120CA3D595260D78D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246974, "uuid": "1c741717-4e2e-475b-b8b7-33c42842e006", "value": "192:UC+q83lAfxDcrdoNEOg3d9kWGueg+FzOWw79cFHk0MQQI:w+VKAWGueg+ORGjMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675246974, "uuid": "0afaf11e-726f-4427-83de-814345d753b8", "value": 8834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675246974, "uuid": "b86f7fd2-3564-448e-b7e0-1e061bb370e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246974, "uuid": "1b4bcea0-127f-4b6a-8838-49212040119b", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821a20b5-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675247454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247454, "uuid": "038cbad6-f1b8-4403-9bc0-b210c67c78f3", "comment": "Malware payload (GCleaner)", "value": "7d6b0473c0a2fb5d16a8fba067d5d4d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247454, "uuid": "2c8ee27e-905d-43d5-9376-de8358dc16d6", "comment": "Malware payload (GCleaner)", "value": "cb4d2a50fd4fcbed58fd035305f7c03a2d8b2561ee1b89973efd1e6a5c5fe4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247454, "uuid": "e50d4b5a-11b1-47e9-a6fb-4a640084e732", "comment": "Malware payload (GCleaner)", "value": "eb7b751be1b368bccd6307026cde8ad0e2d36ea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247454, "uuid": "5f30a5ab-4655-41f3-aecf-de8ef199a554", "comment": "Malware payload (GCleaner)", "value": "9957177b9e91a98dc923fccbdff2f6a071cd8a12cf4462e341e33e4ab94a7786fbbf46fa215854e47a8f272fa8bf54b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247454, "uuid": "f70f43bc-618f-4b7c-a905-491ed261b260", "value": "T101A5332A6E79D677D0D131B8EE62C0222BA67DA175358A1166FD3C0F7B7D7C2680D203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247454, "uuid": "5d34468b-f66c-485b-a79b-25649b3cce61", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247454, "uuid": "2b1e3854-61f3-4050-99ee-9425d5517a76", "value": "49152:icPLnQ/JfBmtKVwOAZX4Sip+vf+QdULUVUDfJevJ3/U4UsS51IqCFLCgv2MR:XPLnQ/JfQsmOHSiEvjULUVUIB84UsEIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247454, "uuid": "6ecf0cc1-8af7-4305-9141-3672f88d700c", "value": 2252691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247454, "uuid": "f89925f1-7e98-4011-9f46-99aa2ab4671f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247454, "uuid": "f90843c9-c8a7-4655-ba95-b00915f5dba6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1801c15-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261734, "uuid": "c0f799dd-ddc2-4948-8d42-4e8df616d536", "comment": "Malware payload (SnakeKeylogger)", "value": "a52dc7a8ddc1913b1092c42c6ff449c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261734, "uuid": "e3506423-9061-4ff4-89be-2174ce958a28", "comment": "Malware payload (SnakeKeylogger)", "value": "cb616ec3010e853807b75276376a40b297fac6865303aab71f2adf9427dcebd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261734, "uuid": "979ba2f4-46ca-41e1-b042-c390446934c6", "comment": "Malware payload (SnakeKeylogger)", "value": "674933869d94de49524e79cc8f3115e6f27fba83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261734, "uuid": "0fbcad0a-e23e-4d88-b1d2-d48d6a38e263", "comment": "Malware payload (SnakeKeylogger)", "value": "f4646aabf0fecafe1669429307bc55470bc61077a889f3124b1978762ecdd9e5e5f616b4582002e49732a1252015991f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261734, "uuid": "24a434bd-4f68-42f3-94c6-0239cb7f09cc", "value": "T11AC4125099069783DBC2DD70D1E319BC7F7E39A197824AA7D28262363D073C1A77868B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261734, "uuid": "1aad3dbd-763c-44d0-8538-15c862400503", "value": "db3ba5a38c467c1467d8cab70dfeeb13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261734, "uuid": "4261ed1e-8878-49ea-86df-0fb68a086028", "value": "12288:lCjuH1KTxj0YvURk9DVz+v4AnhoYWGxBXxcVGrj4W:l4uH1AI1Rk9pzq4uasnXEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261734, "uuid": "6bbb9720-e769-4808-abda-42348bae2ecb", "value": 551634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261734, "uuid": "af119ce3-877e-45eb-bea0-6fd9a98e1423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261734, "uuid": "2a8d0e3b-67b0-4158-bf1e-a2d8e7dd19a1", "value": "a52dc7a8ddc1913b1092c42c6ff449c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706e9114-a25a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675274483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274483, "uuid": "2d20e237-1d1f-4158-8f53-b0ddeff05a6f", "comment": "Malware payload (RedLineStealer)", "value": "37216d449e5ad9ecbb1aed6ea7dda507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274483, "uuid": "47c46c11-4a63-4b84-92f0-ad945953b30e", "comment": "Malware payload (RedLineStealer)", "value": "ccb420da141c63c90ff8e06f206748fe3ee28e9b22c0164222a811ad4848070e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274483, "uuid": "fa1a9936-a8bb-4a58-b07e-4061c4d7e095", "comment": "Malware payload (RedLineStealer)", "value": "965f701a5604454770737b9ff674c14f2be681af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274483, "uuid": "6d6e776e-cc94-4ae6-b8cc-1e0c4f7c593b", "comment": "Malware payload (RedLineStealer)", "value": "2e2c427f1bca8f86322296062842a0fe3a761dc45aec23186649dbbe7744bd4441c3ccfa7fb18ba829bce3e3160d93a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274483, "uuid": "1b30f7e2-9437-42f9-9b6e-b706f6dc1f15", "value": "T13C74F12278C1C073C06F40759D20DAA4BF6EA9311579593B7B6816ED9F602E0AF3A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274483, "uuid": "b27f7dc5-a02a-451a-b80d-7079e67f7502", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274483, "uuid": "4c695b74-33cf-458c-8c08-e365d2b6c5bb", "value": "6144:VHVYUH2LszKWUviakGQJg2FriL/xEXD+4XKrJ9V:VHDWozKWQiakNuYrKxEz+F3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675274483, "uuid": "d1151424-c77b-4c2a-8765-cc8bbbdcf837", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675274483, "uuid": "0f41eabf-8955-4209-9b44-8c1dc45f2361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274483, "uuid": "adaaf9cc-0a63-4f4a-944d-6af957149c9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e028fe-a251-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675270806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270806, "uuid": "42096462-31bf-4067-b8a5-3aaeb317e6b8", "comment": "Malware payload", "value": "567f730f3498208d19ded38867276243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270806, "uuid": "16e7e64b-b01c-4ce4-b8af-f00015e7b29f", "comment": "Malware payload", "value": "cd5e25ca8d7af07a27e275541a5accf8aeb0d6b1a5a5558d967d59fdc7481fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270806, "uuid": "f6863e40-a65a-4bea-b14d-283bc18cc844", "comment": "Malware payload", "value": "d88d81785c367253718001a2e1d2e445dbbb93e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270806, "uuid": "ec87c887-e24e-45ae-b713-28a365b9f8a7", "comment": "Malware payload", "value": "9b63d0bff1fef64b98f68c56c88f852399b4ec2c249178ebda6c8c2f5c33bb7f75f507573647abdf290f22678410b571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270806, "uuid": "6ca47d39-f98d-4a82-a38a-900831a6450b", "value": "T19DD3CF3239C0C073C16B50705C34E6997FBDA5304975989B7BA91BBEAF306D1237A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270806, "uuid": "e87d62f4-bfa1-40a0-ad64-da9ddf4e546b", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270806, "uuid": "04d27820-b77a-43b1-9497-6880ba74af06", "value": "1536:2mjGP/0Ady+OHUaOi4fLKV2aV2W4b8kiEG1kQtzr5O4idPFDngwSTq/RXr4rf:2mjGP/0NKaxkLukOWIzr5yF8wyYpr4rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270806, "uuid": "304b7b92-369d-4830-9519-c79aa08bfbef", "value": 137560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270806, "uuid": "eee23169-81f4-40e1-90bb-3673100faf22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270806, "uuid": "e201e93f-1802-4e3a-9bf9-fd73b8d9c718", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baaf717-a26b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675281615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281615, "uuid": "029a8df7-ab61-4e1e-bf3f-1b6f983292f8", "comment": "Malware payload", "value": "7c04add1396e063b621c65edf62a70b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281615, "uuid": "0117e33f-6c62-4d56-b86d-e3e924a3b63f", "comment": "Malware payload", "value": "cd696e74d227b860465c0e30cd88140851a505aa91056c8a235faca2605d9494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281615, "uuid": "9b232a82-71e2-4a56-be82-cdfb575ed7a1", "comment": "Malware payload", "value": "27cc9bbb0736bc73ffa2bdf4a95f3c279f715685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281615, "uuid": "51e84420-c7e7-4df1-b39a-e2e1a1e1f073", "comment": "Malware payload", "value": "fdc0d2e2c411b04fee17b14a9a1bbc8604efabbe3decf20cfbfc503d696a51f1e4eea0c6ed1ef3b9f37d702e8af09546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281615, "uuid": "6d1778c9-1a0c-4113-b6e4-3a6fb003e886", "value": "T1C874F112B6D0C073C4A685709F24EA867BBEB4310A7997577B5812AE9F703C0B73A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281615, "uuid": "fd6a5e71-3bb3-4ba2-9092-85f6bbc027e6", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281615, "uuid": "dcff3aee-62a6-4bac-a802-92fb5ecbf794", "value": "6144:1vR0NQLWBWBjXnKOU/a8BHpGDgpwduYnF4XKdC3gjwtphnv2:1vRIQCWBjUy8NpbiBGXObwJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675281615, "uuid": "48044c72-9576-4398-b8c3-410168caf68b", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675281615, "uuid": "4b97f6c9-b9c5-43bf-903b-c8f2a14d7b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281615, "uuid": "29801588-bc2f-4279-b52a-869eb1cee773", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1988b5-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675266852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266852, "uuid": "738377b9-c742-4a6c-8e88-0e2d1eec81b8", "comment": "Malware payload (SnakeKeylogger)", "value": "e1cf59372694c7d46d84d0139b40d41b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266852, "uuid": "77f1994f-bace-474d-9937-57e0af01d299", "comment": "Malware payload (SnakeKeylogger)", "value": "cd8be35dfd9e75a60f5f1aa9b9504823b887533f220617e65244eb9d8a0f8acf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266852, "uuid": "66b49837-66ca-4b1f-8a77-f3c5418e8682", "comment": "Malware payload (SnakeKeylogger)", "value": "d98fe7072196e71d5cb8388a7f6d62344ab382d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266852, "uuid": "283d1fb8-2c68-48f5-9756-1df59388781a", "comment": "Malware payload (SnakeKeylogger)", "value": "89667489249b84c87593f825914763fc385a5ae1f4e26cc73e5d9d5b97ecede9da32b79660f5e4ff0e1d381b64a06e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266852, "uuid": "bb39b266-cafe-4edc-bb8d-30408381bb3b", "value": "T17715DF593F248E91EA5602B621B40C3837312D2D608ED7091BC5B7DB4AFF3BD7D1299A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266852, "uuid": "cc147ed1-8034-4192-9282-50c65aa170e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266852, "uuid": "5ad906f1-5e19-4809-9b49-d73be2d5a165", "value": "12288:GWcoiHoylpLYR7aV0Hp615ExN0nmjkYIZsiSbHRry5rWeh3ih9HeA6RYcJbezuyc:GNoizkO0Hp5JyZAbHReBYTf6RBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266852, "uuid": "13cf545e-485f-4c6e-ad34-0537c003fc28", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266852, "uuid": "83467789-846f-4c3d-a01c-c7314a22fd7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266852, "uuid": "f6f9605e-5639-4635-a284-65fc92b6130e", "value": "e1cf59372694c7d46d84d0139b40d41b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35df90e8-a24e-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675269231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269231, "uuid": "7c68ba2c-73ee-4c75-a9a0-5f70fdfd42c6", "comment": "Malware payload (PureCrypter)", "value": "f1361a0c6bd51f1c50adf55e0c939099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269231, "uuid": "0dcb8b56-4c32-45ad-b11e-09b654112da4", "comment": "Malware payload (PureCrypter)", "value": "cda5ced44ec0c2e58d0f38f9fa63a87364cf9cebcd2d0e1a11626a8bb694703a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269231, "uuid": "d9a92e6b-fa50-4104-8dfa-3d559086971a", "comment": "Malware payload (PureCrypter)", "value": "45c22c0676a0ee4aa48c3361c28775e652049dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675269231, "uuid": "71720a8c-87c1-4242-9eda-9b361160e56f", "comment": "Malware payload (PureCrypter)", "value": "a1e56598049de811fe869184619098034317f19b19df97be7ab4fa36383bdd2454945ff6b9a4bff458ee0f1bd98ea093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269231, "uuid": "12f65957-6bf6-40c9-84b3-836ff7106553", "value": "T1F91418C16D62AE07C7871C3A0631B71C77BD1FFE2B77E825DB20E669A8339CA5605411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269231, "uuid": "351ef06f-264a-4556-97e1-5e7efbd20a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269231, "uuid": "18f13efa-8573-4616-8443-c5e55ea6a0f4", "value": "3072:FuYiMNRWiAn3tldPzBBzP/YXYtZ6w99auW:CbiAdldLPzHpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675269231, "uuid": "51415a61-54de-4392-87d5-b28b152dfe1f", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675269231, "uuid": "d897d304-e38f-465e-a285-d43e3a00b448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675269231, "uuid": "61f370a1-cd7e-4b48-9b4f-dd2424955b97", "value": "MT-06752033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b69c407-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675280085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280085, "uuid": "e7399675-ad53-44df-a059-f793240a3ffd", "comment": "Malware payload (GCleaner)", "value": "37c36d4e71cf61d869daad06d729db21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280085, "uuid": "c64c42a3-067c-41e6-9ed2-7fea915ef14a", "comment": "Malware payload (GCleaner)", "value": "cdb88cddfd3e81c0f435aec27a8433729a3df4bb309d82ddec2d020a6f447ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280085, "uuid": "2552e2e7-218e-4cc4-910e-c9841429c4a7", "comment": "Malware payload (GCleaner)", "value": "38d0cbeeedefbb62443c4bcf5466662cd50ce977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280085, "uuid": "c47c2133-7309-4a5d-b981-df25d72defe1", "comment": "Malware payload (GCleaner)", "value": "a801ddc415d2081e6a82b05ce168735d954cc103d15b625cf55726629dbbbc55989ea72fef3e148fe4b4389201d38318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280085, "uuid": "afb3abc6-e8f5-48b4-8f7d-7201ac40dd22", "value": "T1FD64F1327980C073C56BA0745920DBA57BFFA03016B9994737A81A7E9F71BD0663B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280085, "uuid": "ae721910-b556-409e-a017-9589edc6c49f", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280085, "uuid": "32aca25f-0079-46b2-80bd-e2864577bf79", "value": "6144:lqruESq1LwuD60Kt+j+Ie53OZWFqGjrzT5Uqa:lqCo1kuDXK0j3c3OZIbT5Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280085, "uuid": "87e9a77f-8131-446b-ae50-da6a60be9c96", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280085, "uuid": "b5d2194c-27c2-4375-941f-4152b575be18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280085, "uuid": "4b987d57-252e-4ad3-8e20-52cb9ad98150", "value": "37c36d4e71cf61d869daad06d729db21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497b557e-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675239199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239199, "uuid": "baed38cb-b138-400d-824f-fbe3d54353a9", "comment": "Malware payload", "value": "c01ad41467b1b2bc674790a992744b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239199, "uuid": "386fa4ce-d132-46ed-b7c6-04126b944e61", "comment": "Malware payload", "value": "cdca2a473f1413de0d0cf30bb70c24611efeb0b648fa50bc86cb98bf7d539172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239199, "uuid": "6196b2ba-0f14-4b4f-9c57-654674442465", "comment": "Malware payload", "value": "fff1f956049d7a9e3c1607aa14d3ba8d14d01814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239199, "uuid": "c1516a2a-952d-4c00-af6d-c1b4c034b4c0", "comment": "Malware payload", "value": "7a999c7148beedc2f214f818dfc5f8e3bbb562af635e9a762dc59f6f6b17d5fe38ae55c1f4d7e31684ab0496d54c14d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239199, "uuid": "b927c604-b671-4528-beb9-bfa596266c17", "value": "T1E9763305B6D2C87BC79254328625730166B8EB6D0E2308670B691C1FACBDDBE583FF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239199, "uuid": "cf5411a9-44db-4bbe-bdee-1586825bb90c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239199, "uuid": "8ab7fe63-e627-4b71-a817-8a1a447c3d43", "value": "196608:91O53EojngsuI8vOraz28Chb1we0PqDMYRHcPfSl:3O57vQvOraz28ClOe0CpoSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239199, "uuid": "fb719baf-7a47-4d18-b87e-0ddf7af876ab", "value": 7596650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239199, "uuid": "7da9beda-c132-471f-8c3a-bc4cd1f0ac8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239199, "uuid": "eae010f6-aec1-4b63-87bd-96ba627c3e0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a0f0f4-a1c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675212294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675212294, "uuid": "7b0e4d16-f059-486f-8a45-cf7be4d97f76", "comment": "Malware payload (Smoke Loader)", "value": "ea7b534a4a03b7112b2db903fe7e3f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675212294, "uuid": "fb5c5cc6-f8c4-488a-af1e-80b028324651", "comment": "Malware payload (Smoke Loader)", "value": "ce4d0b1d0932beb5c317afb925d3ba0ecee735267bf2ed90569a0c07da56cb3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675212294, "uuid": "4cd2b3cc-ab41-49dd-9033-2bc87661b54c", "comment": "Malware payload (Smoke Loader)", "value": "b85d597962ec99b603ad9fdbb14cefcb2e8e7ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675212294, "uuid": "4a26e680-c8c1-4db6-aeaa-afb055c2d092", "comment": "Malware payload (Smoke Loader)", "value": "5c51f766a4f9f0eb02fe9aabd5d14792dc471144f8f66251b7e6912212b60b73db75b75f08f795281fb7e1dc06baa655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675212294, "uuid": "09848bed-4bee-4318-b74a-cb9529ab4711", "value": "T1A9548EC2B6F2BC62E9228A719E1ECAF4751EF5434F593365121BABDF25B01E1C1A3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675212294, "uuid": "171b5a47-47d5-4b5a-a557-9891bf710102", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675212294, "uuid": "c311867c-d777-4350-b9c1-c94221c769ec", "value": "3072:GOBzk8L2tRcYUwtCHLy4bB5JTgN4TyiyY5pbZrmqPUx6WfQz86UXu3MM5:vk8L2QYtyV5JcNbY3ZmqMoIO8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675212294, "uuid": "9fc20832-d58a-47fb-a670-eb00d762527e", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675212294, "uuid": "28e92cd6-b27d-42e6-a6ad-c5c51554d297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675212294, "uuid": "bdbe4a54-1634-4445-9f54-3ca84ce9689c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98173a12-a286-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675293447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293447, "uuid": "c249409c-1a5b-4647-9d11-c2452e123dee", "comment": "Malware payload", "value": "acac50cfc10d66c2e2e07b5bece04878", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293447, "uuid": "67d83f68-9bde-4dee-a3c8-e43aa98dcee1", "comment": "Malware payload", "value": "ce7010b5f47aa606ed1c2e13c5bece5fded4291dfe1dbeecbddc25226756d629", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293447, "uuid": "b5676dbc-421c-474c-b3bf-f064e3deef03", "comment": "Malware payload", "value": "23dc13995e68d232f6486e1098efa19706516823", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675293447, "uuid": "86ab2819-3e2a-4008-b074-2a16b50899ff", "comment": "Malware payload", "value": "28b6319550f215555e3864dc1addf7da1d1489fcf79de8c4a843d171020936ca9339c237175017a97f7bdb1e9716bc89", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293447, "uuid": "f5188d78-3f4a-4a9c-baac-b2b0b35263f2", "value": "T1D3963376E6E258DCD006AF58166616EF10FF7035BA0470C210BCC65BEE0ADC7BA92B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293447, "uuid": "62293509-1b6a-48a4-9e4c-479ed021e920", "value": "196608:39PGlkIkPFcNttpd3VLX5fQZYm+PS+f07N76Qqs:391IkP2Nt1VLBQWZS8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675293447, "uuid": "f0c06e56-4099-4f0a-9b9d-de4a93a905bc", "value": 9412780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675293447, "uuid": "63cc794c-e811-4d4b-99e6-4bd8228c6d47", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675293447, "uuid": "6250e42a-f668-4e7c-ad35-e4d081ad7d2e", "value": "___________________________________.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84356c7f-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264208, "uuid": "ae56bb3c-0c8a-4407-ba6e-98688df6f96d", "comment": "Malware payload", "value": "0e9f87ae8875065a87656ab6112dad87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264208, "uuid": "278ce2e9-2902-4b97-8709-e0f6d5100af1", "comment": "Malware payload", "value": "ceed1b655ebf6e2acb80a0ac41f1773d597a583645095ca07cd72aa22a61a712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264208, "uuid": "2488d2da-9c6b-4577-a2f7-5812acbe9bfe", "comment": "Malware payload", "value": "92af0d514e290afadde9de6326b3f40b2c5bddce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264208, "uuid": "c5347b65-11b8-422e-be0e-f004f8357664", "comment": "Malware payload", "value": "c98502496aa58fde63ba2493028c70bd881c9f03d4dad4c5938ab9175ea630f88737cc7883122865b4d3b48110b32199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264208, "uuid": "f722f4e7-f248-4fd0-a3fe-42c415bbdf4e", "value": "T1AF7633713ED3E8F4D27432312F856FECB256D0600F37286B67584A2A5D5E886F2B2538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264208, "uuid": "2e40d94c-3973-45d2-bfe0-b22d5e70decd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264208, "uuid": "2215f265-123d-4bc2-9f8b-6d665918afd0", "value": "196608:91OrtOXbur1QHxDvMJ9DLa5l8AavIsVPbLNWTo7DQZs4xPVp:3OrqburiHJI9DG5uAi2c7uttp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264208, "uuid": "997370ba-0dd1-4119-b8e4-986b8f6b4b50", "value": 7585292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264208, "uuid": "d8a36293-4ee0-46a5-b55c-774a27672efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264208, "uuid": "1951502b-41f4-4ad0-bac7-630567e2c2a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04de1ae7-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239513, "uuid": "781fea15-751e-404f-88f7-3c81a5bff8cd", "comment": "Malware payload (AgentTesla)", "value": "5f82deab1a78a876795648d4b4d01726", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239513, "uuid": "684546e5-89e0-4b08-b1c3-914ae30e8037", "comment": "Malware payload (AgentTesla)", "value": "cf51aa50908a14ccd1adf6a83917e9260a4c3267cf9f0be48a67116012267e0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239513, "uuid": "475462ab-19ec-4e31-b896-150d8fa9fef2", "comment": "Malware payload (AgentTesla)", "value": "1a4fd681d6470a9fefb3709ac5b459064bc4bab0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239513, "uuid": "f8ef6843-9f94-4338-b402-052f7d97b964", "comment": "Malware payload (AgentTesla)", "value": "c469e598508ba99ea0318237489c145657e23789334add71569fdbfd3b7c76999c021896e4e416045367e2c733da9f19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239513, "uuid": "39c3255f-f579-4548-87c5-7540fa92fa87", "value": "T1A462D018C1B74751D039AF3838E0AEA2760AC8FEE167557EC61A5414CA487DB60D4FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239513, "uuid": "4e259235-abd5-40dd-bd99-e34e8eb3cff7", "value": "384:1QSQeOKzK369ok6uD/cP1DN6a0uzEKssY/HuZLrd:1HHOKzK369ok6uEP1DXEkNrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239513, "uuid": "c365cc78-60c8-4f4f-9221-47678bdb69ad", "value": 15956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239513, "uuid": "928921e7-b546-4986-b749-7dae6cd48ea7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239513, "uuid": "57f0bbb3-6661-44d6-85ed-3d1af89c913d", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989d837-a279-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675287866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287866, "uuid": "89d667ce-0568-4c7a-b924-8001c96ca5c5", "comment": "Malware payload", "value": "b1575de35a52b22458858478f197ff41", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287866, "uuid": "ab252243-4ed2-4c3d-8681-60ef12f77a51", "comment": "Malware payload", "value": "cfef52c6925ba86878bf04f20ad3561de1f0bd0bec7a3719a677c397a29bd934", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287866, "uuid": "411db6b7-7c2f-491f-85b9-a37f4cbb360c", "comment": "Malware payload", "value": "b87a15325dbeb49d82e83e925d47e1292d50ab12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675287866, "uuid": "3e445ecf-3fca-48d1-bf04-dcc1b811b729", "comment": "Malware payload", "value": "827b716c4896d4f77ae44f61a230ebfa1be735aa403ff79b641025f95802645f94b3e0df088f41cce8963ba42d03d096", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287866, "uuid": "fac04e97-fd1a-4c98-95aa-ebb2e727dce1", "value": "T119D48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2D29DD139D1B64930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287866, "uuid": "f6cda912-6868-4c83-8575-fd9be29da6ed", "value": "ba10210792cf2849761b9bb94eae1772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287866, "uuid": "72b2080a-075e-49bd-acd1-353da1f49cc4", "value": "12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tT43+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1t8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675287866, "uuid": "52a840e1-f183-49b3-ad02-6df4f1fd71c7", "value": 656056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675287866, "uuid": "0f1d3785-e63c-4b7d-b324-6c8f4b8e986c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675287866, "uuid": "2f54ad5d-4887-4023-9739-a779dbf4a6da", "value": "14889.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ef1c33-a208-11ed-88f6-42010a9c006e", "comment": "Malware payload (StormKitty)", "timestamp": 1675239292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239292, "uuid": "3fc1eed9-f049-4257-ae55-be1775477f3c", "comment": "Malware payload (StormKitty)", "value": "587a57c6f8590b6367d67b17fce54c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239292, "uuid": "eea8e9df-4b95-46a1-ac7a-7d2e716b6ed8", "comment": "Malware payload (StormKitty)", "value": "d03d5b49976a7d150f77a892f429ed698246930ba82e538b25f7835d67b9323d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239292, "uuid": "c0a68659-ee70-467d-938e-0c5c0f3e93d2", "comment": "Malware payload (StormKitty)", "value": "cbe56fc0d05531d2d9e7f5c4ef628e1a9941fba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239292, "uuid": "e89d29d8-0325-4f0f-920c-6b912c8a62a8", "comment": "Malware payload (StormKitty)", "value": "14cfabaa238390b14431c2d526c2b8e4b83dbacdc1542d00e037fcf47ccd086ceb1062fcb02155423d7a7032c3ebce60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239292, "uuid": "6a9cffe3-b6cb-4dc7-b479-77004e0caca6", "value": "T185741881F2DA3CC2D01719F26D3DA720215DBE6E527C0E2E3B6AB51C5167197282BE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239292, "uuid": "7c78616b-b599-4044-9fc4-d36386609977", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239292, "uuid": "80e3a481-ea07-4935-9d6e-500bc2328ace", "value": "6144:oYa6Si77eBf68RvZWDvY4dUk931r+qzmnblebHqHhfM:oY4i46GhWDTldzacHqBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239292, "uuid": "848eb62d-66f4-4682-989c-9a6e2443dbcf", "value": 367066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239292, "uuid": "1f409038-3c5b-45ca-9598-a8a4e2eedc2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239292, "uuid": "c0bce7f7-9381-4f39-84f2-90578b8d9261", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5d29f6-a1cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1675213493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213493, "uuid": "979afc47-e466-41f5-8fa2-60c6b143b8cc", "comment": "Malware payload (ManusCrypt)", "value": "f27a83a7a811a6b310f47edf61c73b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213493, "uuid": "5425d831-2edc-4085-b1c2-5d0f3dedbbf7", "comment": "Malware payload (ManusCrypt)", "value": "d051841ec301d24688063983ca3c6a9f6b784f74e2c823eb5d0b84961bf6e1ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213493, "uuid": "04e06017-fb12-4cd9-994d-2cc01a0f6cd9", "comment": "Malware payload (ManusCrypt)", "value": "466ad712222c2fdcf7119ddd3fff53436f7cecf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213493, "uuid": "24b60e03-c0a8-4270-88fa-05780fd12f18", "comment": "Malware payload (ManusCrypt)", "value": "75b36abbf0ee4fb8efae9c82d34d51480109fd6ee7a929b576c1f32c9c64e5f30fa6b90fd5934db530d8134140d0af0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213493, "uuid": "a67c5d05-ff51-4562-82a9-061f1139efee", "value": "T18D548EC272F1BC62E9258A319E1EC6F47D1EB5524E583366121BABDF27B31E1D1A3301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213493, "uuid": "b214c5f6-bd2c-4fbf-b69e-30154a3f0fdb", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213493, "uuid": "014b60fa-3219-4d53-bf68-09ba6b92dccc", "value": "6144:94qLPap9RgVRT1hpR+53aCg1mqMoI0Q8M:9xrSngTzW3aqqMaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675213493, "uuid": "53ea6bb5-6538-4ed5-ba85-89bb62d725f3", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675213493, "uuid": "0a1ec117-dc2b-4294-988b-ed96fc0e0c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213493, "uuid": "afcd4635-6a73-446c-9b06-16d0f97c4dda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cdf37b-a247-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675266459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266459, "uuid": "aa71b043-4a50-4e0c-9c85-2fca974b8ada", "comment": "Malware payload (GCleaner)", "value": "5413f9299d02293b23686383ce47761b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266459, "uuid": "9e1f5b36-cc45-46c2-bcb3-917fb4a42f39", "comment": "Malware payload (GCleaner)", "value": "d06a93b7b1a4088e26691982fec0dd235d3dbcec36b730dca999098ebc95c868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266459, "uuid": "274a1127-0323-46c2-b3ac-097fb8575cd8", "comment": "Malware payload (GCleaner)", "value": "2cc41da77d211e62b15f9358182ed5b2fc343d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266459, "uuid": "b77ec9f0-a7cd-4313-8a2e-e2b0d82fcefa", "comment": "Malware payload (GCleaner)", "value": "f0ca26260ed64a8da6366e208c96b289d1eb558a7a034446b33570898cf93b13323adf7523dd0a5a694dabc5f51f5e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266459, "uuid": "ab0259ac-1f44-407c-a984-c664419d3e75", "value": "T1ECA533467B3DC836D2C1EF782911D033A7E69E62157C822A55F73C1B367AA83FC8A151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266459, "uuid": "9def3b98-f773-405e-b422-63f4ce6b56c0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266459, "uuid": "ea91846d-1ede-475f-9527-7d25dcb832b8", "value": "49152:icPLnQyJx7Fs0lMyG5+1ZhgzEbYhfVL94cZUghGMUyLCgv2MR:XPLnQy3Fs0lMyGcmQc63vav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266459, "uuid": "d2551b58-dba8-46b0-ae43-af03413e4211", "value": 2244950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266459, "uuid": "44a746ae-d5ed-4f09-881d-21fb44ad12c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266459, "uuid": "a40b955d-7c75-4055-a87c-ae644ce95bdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ac5976-a23d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261840, "uuid": "c6009268-a664-4fc3-b183-ef7e70ff9b5b", "comment": "Malware payload (SnakeKeylogger)", "value": "0348469c2faa81c6581790280e815c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261840, "uuid": "015c6b93-f1b4-424a-a4bd-0c4ac32b442b", "comment": "Malware payload (SnakeKeylogger)", "value": "d0d573cf8f2460ca3d4e9074af0a2c13b56c287fb7ace1560b8c8209170de73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261840, "uuid": "65b939d2-0c7c-4e9b-9845-7906940dfac2", "comment": "Malware payload (SnakeKeylogger)", "value": "abe0c89fefee86e8b69857d4499dc5d63607a7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261840, "uuid": "ede8e7b6-8b82-4237-9a25-91270f6f5e20", "comment": "Malware payload (SnakeKeylogger)", "value": "6d2087fceaeed6da38fd072a959bad0afbffa219f2f68ee58704fce4878a06166032ca76e5df1682d19a083f88debf51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261840, "uuid": "2e854a39-067e-4c1a-984e-c46bf71e7b4e", "value": "T138E4027E831DDDE3CB8842FE00B40445EB730A6BF59AE78E0EDED2A4458B74159254EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261840, "uuid": "21a47e5e-35ce-4a25-b8c6-20e48c596948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261840, "uuid": "9d0e6707-7a19-4adc-ad0c-2b9e06a0949a", "value": "12288:Tj4C5sHSY+/o2Qa1s9W7aB4Qyux3qSMWTvPWWeh3ih9HlAhTCV:AC5sn+/ZIWK1x4mGBYTuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261840, "uuid": "e8a6d1bd-7caa-423c-b61d-87a3ecf9d894", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261840, "uuid": "cbd2236f-5c83-4b3e-b2fe-9d1ee4f923c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261840, "uuid": "c64a86cf-c9ae-43e2-98b5-3efd7e617e8f", "value": "MRKU8781602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64f6f76-a1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675225638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225638, "uuid": "74e8d5a0-8c4b-4c71-9fdd-62dbbab617a7", "comment": "Malware payload (Formbook)", "value": "85908711708740b21e3fb02dbeffc664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225638, "uuid": "8206d36e-6461-4f98-bf0b-7b44790939be", "comment": "Malware payload (Formbook)", "value": "d14a33d70b8d8be176eaf739c6c51a2835a2856f446b975b5d13727a925e1738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225638, "uuid": "ee3acab6-5be3-4854-b808-f2359e5d52ec", "comment": "Malware payload (Formbook)", "value": "c62aaa57a9409fe9c6390f4d8b52d32089b2845f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225638, "uuid": "2760b7be-2453-4770-8ae1-7f47494db1ec", "comment": "Malware payload (Formbook)", "value": "dedab6c274759fc39dd1f63f62cfc2a5fac22201aa363ab73288a4a34afbbcd668477b4f9b5e459dc04c1efae2837723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225638, "uuid": "2908d58a-3751-45e0-88ed-b44456049119", "value": "T1FCE4F14CA2FA9E0ACAFD1BB69871282013B3B8556136D35E0FCD24DA1F67BC49501F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225638, "uuid": "148ee6c4-0e8e-4fc9-bbba-efad9f9aa2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225638, "uuid": "d4617fd4-012d-4a91-88a5-841da81d7bc6", "value": "12288:/mVVAH/RbmdGXvlePdiceoHr4WqFGSiUNIcuVUG+BTfhst/ERC5z:/mLAZy6teF5jgIcSeTpst/FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675225638, "uuid": "f31373b4-caf3-484f-8799-1710375e628f", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675225638, "uuid": "7434f0f4-8793-4526-857e-7df6efb661ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225638, "uuid": "2264692f-9908-4602-b9a1-245979c96267", "value": "SecuriteInfo.com.MSIL.GenKryptik.GFFG.tr.16214.23432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4abefb-a1f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675230322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230322, "uuid": "f5b825e4-df3d-4857-aae5-d84f8d9d6594", "comment": "Malware payload (Amadey)", "value": "50c81ec9e93c43ee6142a56d96000886", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230322, "uuid": "e429ab4f-3d61-4d12-b0ec-8254558d5275", "comment": "Malware payload (Amadey)", "value": "d304e28d717a2af0c49337800bb901bdc85eb58ad82d32570b6ceb1df96da576", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230322, "uuid": "1778b52f-c059-492a-9d9d-c664288dfec9", "comment": "Malware payload (Amadey)", "value": "d91a27e9cb7eb2f8ee8a952ec8d5db5cee1f90a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230322, "uuid": "1cce20fd-caf3-437f-97f1-701e3014462d", "comment": "Malware payload (Amadey)", "value": "14374aa8f6fb5dc58824d1411321a421a39ded82aa442979f88f5dbffc9f65404cd7244acf04eba8b2782b266360b783", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230322, "uuid": "fb7e5776-5808-4701-9afb-cf518d29118e", "value": "T14A510F2527D6D306E370CA37E6E5C20AD22AB800BA11EB1F859482560C66609FD72B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230322, "uuid": "7f3220bc-a860-4c7f-aa98-030cb61e7dc1", "value": "24:8klg0oi9+/QT4I07nDfE589WqXIFJXwbXcqrsUAYYYop9DUAYEU:8k59fMI2DfnWqeJXcXtwfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675230322, "uuid": "6d4d0dfb-6643-4e62-bf2c-b35e2c3e2d83", "value": 2601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675230322, "uuid": "0c0277ec-6d71-4d89-a4f2-8f44398d0ff2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230322, "uuid": "44183ad3-6614-491e-bc29-d0e7e61c4549", "value": "BTVA.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cc5fd4-a22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675254655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254655, "uuid": "bc4e2543-a925-49bb-a255-f15b37893edd", "comment": "Malware payload (Amadey)", "value": "c74685313f63bb17afcf48c28ff306ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254655, "uuid": "e1cc261e-9c47-4862-8aaa-9526719ef104", "comment": "Malware payload (Amadey)", "value": "d3d4e5eb744f32180842ca7eed2a34afa855da2daf00b97a33bffabbb6dc53f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254655, "uuid": "49134f77-e9b0-4940-b372-49e102d8c43c", "comment": "Malware payload (Amadey)", "value": "320b6253ae42a324abd8a7471387ee546dd55978", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254655, "uuid": "67aaf9bb-af2c-4604-82fa-2a2b5e41c298", "comment": "Malware payload (Amadey)", "value": "a43d29ab71008c697db76461ba1324d6ef8c06e39f902ce31147d7043820cb1bfca44ad6bedee0de469e977c888da753", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254655, "uuid": "a082699f-c692-4d33-8e3f-368598c215a4", "value": "T15534D02235C0F032C9FB44715860D6B83BBEB4315979A50BBBA716AE9F706D0673634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254655, "uuid": "d4e2d614-5f4b-45a1-8639-7a6c69c6cfed", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254655, "uuid": "4ffab453-d681-430c-a30a-01d1e15df204", "value": "3072:NSoGztqLcGvF4RgL5jJJWx0t5cNu15BQGeDoDJWw52lojTKt4nh:NSo4fmFxLFJJf8NQHeaWC2lo/Kte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254655, "uuid": "8972cb31-0ba4-4609-a727-335b145be8d5", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254655, "uuid": "fc4929eb-e29b-46df-a233-07bef4447553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254655, "uuid": "b1f23b3d-c182-453c-88ef-fc07b8b29544", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf3f390-a1d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675216817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216817, "uuid": "e5c44eba-bd65-469f-a44d-bf3cc31bd921", "comment": "Malware payload (RedLineStealer)", "value": "224f7dc9906836e40f2def3342c9730c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216817, "uuid": "58f66e9b-ca96-425a-b290-10b66c92021a", "comment": "Malware payload (RedLineStealer)", "value": "d3f96d557ec8323cc2f7ffaa5fc9dff7e84fd27074f1cd0ef4bb5b8204487a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216817, "uuid": "105c5b42-91fa-4ca4-a63c-34e8595bc08c", "comment": "Malware payload (RedLineStealer)", "value": "dc284ac5089883bf0edb16721b6b453e087d338e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675216817, "uuid": "e5ab3534-fb99-498c-b6fa-6ce985c1cbfa", "comment": "Malware payload (RedLineStealer)", "value": "44c066b705093e33ecf684f898c08c6fc6cd7ce5aef0f9e86990d399c1d1dad24957e4da4f2c5663c5f66af03a876201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216817, "uuid": "d4a8b7af-2092-4c4c-bf24-1f881409c5d6", "value": "T17C84C0C277B27C22EDA28A329E1EC6F4751EB5A34E186766131B9BDF15B01E1C5E3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216817, "uuid": "5c3a9702-8e1d-4ed7-9f55-61e0e0b49a3c", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216817, "uuid": "b767a5f9-e8f9-4fdf-b3af-2bea6dadfe9a", "value": "6144:YpWLQm/ejMstEjwCIYBY7OUCscPe2hI9mqMoIYh8M:Yk8BANjwCDKOUCFhIQqMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675216817, "uuid": "ca89a179-e6be-4ace-a581-8e65ad7c6b0a", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675216817, "uuid": "ae64ba64-ca48-435f-81d6-7c6a95152180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675216817, "uuid": "05657dbd-084f-4125-8203-e52e03546fdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dccb235-a22b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675254158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254158, "uuid": "112e097f-b1ff-45d6-adb5-cac7128f6f8c", "comment": "Malware payload", "value": "35accc152045c562dffe301dbd2d4764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254158, "uuid": "1b73ec37-6240-41b1-9527-302c2f911c96", "comment": "Malware payload", "value": "d3fcacbd5daec622e4b211994bcc475d69a2e6cbb4d601fdb9d60d242c97bb2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254158, "uuid": "f38d79bf-249f-4f99-b522-09a0701495ab", "comment": "Malware payload", "value": "41da551223cd9619e71492ec2e87ad676f672c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254158, "uuid": "b68f85c6-6823-47ca-87e2-4de9524308a3", "comment": "Malware payload", "value": "0631cfbe74f33ddf763eaf207eae4b6c33f74be495b8be1736d1c787280a39410b6770607519f2a597ef084f188d23cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254158, "uuid": "4ae85042-f703-4fda-8caf-daadbb8261f7", "value": "T16CF4EF057A4B8065C2F156B0383F849047EA3D7A2BE9DD1E394AF78B06FB39145E5E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254158, "uuid": "b508cc8b-a5ff-49f0-81a5-45375ff14090", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254158, "uuid": "9a5ea85a-88c8-422f-ac7b-72004f18e4b2", "value": "12288:VQi3pRKv6m6URA3PhYp1hf39Wkv8xwJiWt6uIn:VQiZoChhYpdUMic6uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254158, "uuid": "1fc8c4a7-0a85-479d-b089-9351cfb6fcba", "value": 776403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254158, "uuid": "8991f231-6dd7-43cf-82cd-925f1e3c2a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254158, "uuid": "c4be34b1-c760-4365-a794-7624a0365e0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9ab43c-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239986, "uuid": "c621d0f6-220a-401c-96d1-d0ff3c3058d0", "comment": "Malware payload (AgentTesla)", "value": "8403b552f0adb7920cc03d88565dbb03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239986, "uuid": "82b2ec7a-04f5-41c1-868e-c0f02624023a", "comment": "Malware payload (AgentTesla)", "value": "d4ee1c1713c6d964cdcf4b3d561322f78be458bc14b0c257b69eba2b441a07b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239986, "uuid": "575523a1-87ad-44ff-bf90-60724e6cabe9", "comment": "Malware payload (AgentTesla)", "value": "0c4363deef20a4fefc51b16db27bb1067d70dc4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239986, "uuid": "c59ff130-5ee6-458d-bd16-872aebecbfde", "comment": "Malware payload (AgentTesla)", "value": "7f541025ad44fd3eb0cabd25acdd0dfb38be726b5bfb12d633c9d7285994445bd7b442a295253683c6f130aebfd607d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239986, "uuid": "d6a35b0b-06df-4a1c-b997-a4150e182899", "value": "T1718208A842DC9323FF6D1BBD94B162C31BB2B637A501F61D788CB0D9199234582A571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239986, "uuid": "3b2be3a3-ec0a-4fd0-a827-ed79962fbdda", "value": "384:X2wZbPmZ4gndXvjpytTS3lkHok0NGHISSNd1TQL3:mgbidbp57pGEc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239986, "uuid": "778d1c82-cb7a-4155-989a-c4ee133fe41c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239986, "uuid": "95b138ec-1514-41dd-9692-c718c4e65320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239986, "uuid": "ccab5933-eaa5-4373-920d-1fb852c2381e", "value": "Msc1BANDcW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7559b161-a26f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675283511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283511, "uuid": "fe393d5d-86e1-4689-8158-f6a47d26254d", "comment": "Malware payload", "value": "9cdaae2d82bb7c82c3a00b66287b4cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283511, "uuid": "5c692a05-759b-41b0-8700-7b2034b7ea8b", "comment": "Malware payload", "value": "d562cfa800fc61a1c0dea698a495c922c29d5c0cd7a55d5c5f1dd5add9c9594c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283511, "uuid": "181ab3a7-6254-4c1b-8a4a-b2346cf8fe2b", "comment": "Malware payload", "value": "7300349c1abf23c07849acc8dbad6d7bc4fb74cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283511, "uuid": "8da21b3d-6f65-4098-9315-a685484cd5c7", "comment": "Malware payload", "value": "181939e0ddc8434327251204b62079eb29d706b8035986336c57786619992f81fd1338385711e07ce8accde55895da43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283511, "uuid": "bbcf5bc7-d460-4d20-96b3-fd32e4bbe4e4", "value": "T1A574F1223490C272C67754346824D792BBBFB4322536685B7B9B2BAD9F302D1B336357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283511, "uuid": "d05dd022-7c05-4735-846d-db622f8c6ffd", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283511, "uuid": "705954e5-3329-4564-b4f3-0d5397cf53bd", "value": "6144:yHuwPlLQ1M67t2niSLbFRjKWK0cyS4/5RYcGILy:yHugOM67tFybFRqI5xtHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675283511, "uuid": "49d2bd71-ac84-4674-9f85-7b4651858478", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675283511, "uuid": "cbc0bea9-d6f9-4e03-a767-3c29704a343b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283511, "uuid": "d0f191e2-77c2-4b52-873d-4e1113761aaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ac69f1-a260-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675277168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277168, "uuid": "494ffa17-7d95-45d2-848f-aa2f5d6dfeb5", "comment": "Malware payload (GCleaner)", "value": "23d72294871c183a86c22b55e3014da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277168, "uuid": "3285d30d-f75c-435e-8770-4aeb399b0eac", "comment": "Malware payload (GCleaner)", "value": "d57156117db4aeb3f3992afd6e3527d416f7b01408b0811c8facf588bcd74f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277168, "uuid": "47d4522d-0e43-45e1-a48e-456afca796e1", "comment": "Malware payload (GCleaner)", "value": "2304c0ffdd92dfb6c1707b43e1fca25b0b46b625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675277168, "uuid": "3ea742a3-3a37-436e-9ffc-b6dc156118ba", "comment": "Malware payload (GCleaner)", "value": "ae0aa8b406889f0cd057d100048cb73292f6af67f024ba520373ed534cdd8aff49bc71c9142ca5c959f2e9657b991ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277168, "uuid": "2d13383a-b4e5-4d24-b742-25c170adf62b", "value": "T13AA52301577C9871E192DAB43A31C2B3EA35AF94246DA32332EE7D1F3D7E6837908546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277168, "uuid": "a88a8f0e-caeb-40f0-9c54-65ca90d46d90", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277168, "uuid": "39eb60ec-5c4a-4bd1-89a5-45f91d30c37f", "value": "49152:icPLnQSeLb7XcrqPUM9Tq485WaFxbcdo8tXDp1+cPMkGNAaLCgv2MR:XPLnQSGUuPUM9TZkuykX91+Zkgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675277168, "uuid": "7b10b678-5016-4432-9269-f09190e07a89", "value": 2199269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675277168, "uuid": "1cda0010-425e-4fd6-84f6-60e43c8b8a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675277168, "uuid": "591f3f57-45f4-45b2-8a63-4553f7b13f6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2220d1-a21e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675248758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248758, "uuid": "e3957214-c7dd-4750-b5c1-9474f9bddab0", "comment": "Malware payload", "value": "002b31fa3fac0fe48ad615182c272eaa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248758, "uuid": "e081e0cb-bca9-44d1-9484-4c23ec68c4a7", "comment": "Malware payload", "value": "d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248758, "uuid": "b6852387-4f1e-4034-94bc-af705c992504", "comment": "Malware payload", "value": "867f8d94b736a10e2c68245cd1d692843b319a37", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248758, "uuid": "32a6b9a8-8b87-432a-bd29-3d1b0d064b55", "comment": "Malware payload", "value": "1d9085978de9fabcc9aedd3e7da3f3211cbea6b2945890b9660a454b3f981157c20d49df5f0588c517686ebf570924c4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248758, "uuid": "c8eb2ea0-6569-4362-a3f2-eabc0e932f3b", "value": "T15902C0C4CB430E09D493E3E6DBE2D9AE8A23A4E1FC429D25BD1353EE048119EB0FD904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248758, "uuid": "fade117c-c5a8-4ecc-8411-38704b8b8118", "value": "192:/MwHKzT4j8UMkKf15qD1DrKmlWbLE70dEphap1IZg:/MwqnUptAc0dsa8Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248758, "uuid": "edaeb66c-4c89-4b83-9075-41f31749bcbd", "value": 8794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248758, "uuid": "95ed0b7b-c38a-4369-a457-8e8cd5d253c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248758, "uuid": "7fea7c0b-4434-4b2f-ac0c-c1c3cc357f56", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67206539-a221-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675249986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249986, "uuid": "d12b1730-a284-4d40-81ee-2280aa998f02", "comment": "Malware payload (Smoke Loader)", "value": "f5174efcab7bba6c2c59c21159605402", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249986, "uuid": "ab87564d-568d-4fe6-854c-522099b40944", "comment": "Malware payload (Smoke Loader)", "value": "d6d92daca41dfae2e25f9917daef8de5f936b48c831dcba412e8263429ee81f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249986, "uuid": "b45e8a59-6b3b-4cb2-baee-b53df462a9c0", "comment": "Malware payload (Smoke Loader)", "value": "f297234bcad3b308fb2d53d4caff18a215a41606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675249986, "uuid": "7a9d295a-15ac-4b6b-9fcc-96300826fa81", "comment": "Malware payload (Smoke Loader)", "value": "bf7c52f443442880f6a26a48bdd43221edb6ffad8b0bdf94890450d0bcc61744b01bfda1bfa2d39b93a4f948b6fcba73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249986, "uuid": "3a56aa22-c677-40bc-8756-51d5599a1796", "value": "T1E924D02239D0D072C5B754705C34EBD8AFBEB5317439984B7B982AAD8F702D1663A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249986, "uuid": "6ae36a55-cf70-49bc-9934-f2b83b3dd1fe", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249986, "uuid": "9f3a2134-a42d-4b32-9122-e0bf877ef4a0", "value": "3072:KSZGCvoMrvzMSLkjWs05UuOYDEmCxLJgJiw/KXSuFvee:KSZ5jzdLkjFfXU3/KLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675249986, "uuid": "a7b6b995-2b1e-4af6-9831-5c24871ebaa1", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675249986, "uuid": "871afd94-bb00-40c5-9b27-bd86103236ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675249986, "uuid": "445a7f76-1244-4889-8f2a-c8893e791872", "value": "f5174efcab7bba6c2c59c21159605402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474592da-a211-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675243061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243061, "uuid": "b55765eb-d14f-4cb8-bacd-d5926b9fdd50", "comment": "Malware payload", "value": "467bd2fa72d4feef654998f63d046e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243061, "uuid": "2162db27-cc1e-40c7-a968-59b5a2d9dc3a", "comment": "Malware payload", "value": "d6fda907209a94813a40d6fc8ff0745a2efaa2a7a2d6de0720e96583e9f6215f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243061, "uuid": "9d041bb6-8d15-4bb3-9b71-65b6c6a635f0", "comment": "Malware payload", "value": "94229dd97bb5d4a2a1d404872a75c7954dd5e083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675243061, "uuid": "464e9b31-b250-4e45-94a5-82961f761dfc", "comment": "Malware payload", "value": "a1fbc69c1847820461be55d6988544456e9699aae18e298038f0c73638ad12282f87e3cfc7d142b2b33c35941ca2d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243061, "uuid": "f75ff866-4b5e-4d15-a68c-f9fb926c1f21", "value": "T150E20AD1A64B457AEEEB5BBB48BBC90001B25EAE98F0820F5095B6373E737534056D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243061, "uuid": "0c831785-9b08-4f95-aba9-ada64a10f198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243061, "uuid": "fb6ac75c-85ea-43f9-abde-1e2f199582ec", "value": "384:7c90sdSW6m+W4Cf4zoN1C4l5Lf1bSeY6r0vXYwYa03Vh+Be6tWtWSDyRjPH4jsJv:B+l+pr2n5z1bLQXG3Vh+nt1Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675243061, "uuid": "3b35feab-a730-4c20-9cba-fdc53253e49c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675243061, "uuid": "136794b7-46ed-41c7-a24d-af1a6bd0027f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675243061, "uuid": "b6d83a88-ebce-4f73-aaac-31b59430e9b0", "value": "PRP00343-01_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ffa74c-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675267213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267213, "uuid": "905c710b-bd31-45d8-b51b-326caca50c04", "comment": "Malware payload (Smoke Loader)", "value": "9feea996a75a190d73399e3cf425932b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267213, "uuid": "710c9baf-08d4-4f95-a596-a0ced9e1addb", "comment": "Malware payload (Smoke Loader)", "value": "d710773d9ce28074d500746ce58b0615cee1a2345a58e64f615e8a348ddc38da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267213, "uuid": "4f05746e-6296-4668-b526-d65045801c25", "comment": "Malware payload (Smoke Loader)", "value": "d8a6a9e105b8b51cd95178606ff09fc17632c6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267213, "uuid": "a3107cfc-7eb5-46a7-bd91-e05a06927fbb", "comment": "Malware payload (Smoke Loader)", "value": "c12a146086db1d0343c04a1b5376d4ca9d93f1954af30e05fc40d8dfde5c514ad03b1249686c470ace832cb608053a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267213, "uuid": "e195dbaf-2b37-42bd-a322-86d191bae76a", "value": "T1C0F3E024794CD073D05314B92830C2507A6EAA325E7AF907BF942BFD4F71ED12A2A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267213, "uuid": "692e1a4a-1a8d-4d7e-b4ee-6bd449782c21", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267213, "uuid": "8dfd007b-70e6-46c5-8212-af5a9fa15b99", "value": "3072:XjgpNULJgHg8of5RdcLZqVWdR7wG79d4QPgDZ1GeQBC:JLGHg8omLZqkp8j11Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267213, "uuid": "b82b7bf6-c5e3-47f6-bf2c-270dad3d4215", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267213, "uuid": "c0775101-0d97-4e6e-9f7b-fb140f6a4490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267213, "uuid": "2e0fccec-f31c-4f0f-bea2-44ffa3fbd323", "value": "9feea996a75a190d73399e3cf425932b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bb3a5f-a26e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675283167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283167, "uuid": "f2aca17e-73c8-4033-af64-8d4bcfd33446", "comment": "Malware payload (njrat)", "value": "09276b3caa8b82ef44f157340f578330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283167, "uuid": "247580c6-e710-46de-8c25-5de0fb954b77", "comment": "Malware payload (njrat)", "value": "d723eb3c668394170abc15f8174d3e930e529891ce10ce53f8af729074e525b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283167, "uuid": "2bfe2a49-ba1c-4495-8d4d-54ed13095477", "comment": "Malware payload (njrat)", "value": "34c8c8d6249fc738282a03b8c88c0df2858a66bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675283167, "uuid": "7b15b854-dbef-40de-9254-c80a4db8d5fb", "comment": "Malware payload (njrat)", "value": "005893d1b135c6542d9795f2808f828c72851eb7f4a94ab7ae1ee2694f73069a0022269829e5ffdc21c7e41adde73810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283167, "uuid": "027f4499-ddb3-4b91-8bfb-cffc8c573c8f", "value": "T156B60150965325B4E87FEB7B21BF9823957EB3730F02613532B0454EB12CDADB26A631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283167, "uuid": "0ed3fad7-1bc1-4332-902d-e7a2067be044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283167, "uuid": "b584254c-5eea-499e-8918-eb2218a5963f", "value": "196608:DZzUPMIH8zUPMIHE8tGj8tGj8tGj8tGczUPMIH8zUPMIHo:DZQPxcQPxkdjdjdjdcQPxcQPxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675283167, "uuid": "cbb34cc5-d4e0-4a1c-9dc8-c76ed906ddae", "value": 11161186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675283167, "uuid": "49d7f0ef-ddfc-4aeb-bac6-87fb73e39138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675283167, "uuid": "0f5421dd-89fc-44ba-9821-a484d99f17a2", "value": "D723EB3C668394170ABC15F8174D3E930E529891CE10C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbd9dc4-a22a-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675253727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253727, "uuid": "e285688b-b766-40bb-be79-8bd442df61ec", "comment": "Malware payload (NanoCore)", "value": "2a4d85fb030591cbfa42bbc72f27607e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253727, "uuid": "cbff3ff2-8e33-4d5a-bdae-b24ac935222a", "comment": "Malware payload (NanoCore)", "value": "d7dc5a4583f409639bf8c10eb62fbbc13ac2e1b8f702425e959d47e64463d45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253727, "uuid": "109695bf-cc79-4138-bae5-b7501bb63004", "comment": "Malware payload (NanoCore)", "value": "701232edaf6aa4a36509644d69b6a7c55443b1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675253727, "uuid": "3bf3f44e-0a8c-4bc8-8412-6d10730c71a9", "comment": "Malware payload (NanoCore)", "value": "5b6d07a9c33f42afc0c36b35e40df6069cb5dc6427be660e68bb08f010ff05298343b37522922a0500ff0af13b8c86da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253727, "uuid": "05e83337-52a6-4eb0-9010-137e3b45f313", "value": "T140056A8137B15862F1DB05B91028778C1E3D7443A6E6E2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253727, "uuid": "6322d6a1-c020-4b31-87e0-81c054b9ed85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253727, "uuid": "d4adf673-2532-4762-9e5b-9b9b015ec40b", "value": "24576:peia1r8NO9c1xqpB9cbOEx54w6RTc4N34HZ:ps1r8M9WmzcbOEbKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675253727, "uuid": "2ec0261c-ee2d-4bbb-a26a-a84278b10106", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675253727, "uuid": "46dbc30e-39a9-4e05-bce1-97a377adb0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675253727, "uuid": "19a956ea-626b-4cbb-a486-208a44b51f8a", "value": "2a4d85fb030591cbfa42bbc72f27607e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6657149-a1fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675233879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233879, "uuid": "962824ea-f61c-413d-a9b9-19b87af268d0", "comment": "Malware payload (Guildma)", "value": "992f5faaef370f7963b09123eaee18dd", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233879, "uuid": "0606af34-2c8f-47ba-bedd-182edfb47a50", "comment": "Malware payload (Guildma)", "value": "d7ddebfa36f629e5ef41b692140e2c06f23b5c8017040215eaf0247a7db3b2f7", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233879, "uuid": "a88e08d1-730e-40cc-b966-6cbe6ba67212", "comment": "Malware payload (Guildma)", "value": "cf99a5906e22105ade1f367f0c289fafa9952a1c", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233879, "uuid": "d8476397-b8ed-44e4-ad35-c5376541f7b1", "comment": "Malware payload (Guildma)", "value": "4ed35d15be68d58bebd68c3b4120e0d4c03caaf1c50c56ca5efe20f26f2e4d6aed22d137fb17834f728b89f69ab1aacd", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233879, "uuid": "47b78ede-4333-4711-abac-414d04de9aab", "value": "T1EBF02B88A8213EC0C0188C3FCA3B3B880D0C28070F45701207C9028840A0C88BA3AF70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233879, "uuid": "a2b3fae3-9d5b-4876-8dab-c9eceae4f546", "value": "12:8rflM8OBE6ZG8WgkQqWmSbjdnLehOmxm77Rdq/GjJpVNIgm3:8loG8WFtWmQtLehOem7HndNIj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233879, "uuid": "5efb7588-4b13-472e-b771-7bdff82df715", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233879, "uuid": "8ca66e36-1de4-42fc-b12a-b050454d8acc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233879, "uuid": "80587ab7-4798-45e4-a272-f9295cbb0539", "value": "992f5faaef370f7963b09123eaee18dd.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eb4b12-a206-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675238517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238517, "uuid": "2a403441-d024-4ad5-95b0-680925fe946c", "comment": "Malware payload (Smoke Loader)", "value": "fc61475c57a87d3728583bf276c42ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238517, "uuid": "de592992-180a-4b7c-be93-439c2a6a9438", "comment": "Malware payload (Smoke Loader)", "value": "d7f8686f76729af2a87589ff2cc8f10105cbf7bba0b601c209ce13ecfcc67048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238517, "uuid": "79c339fe-4150-4699-9388-2d3aea4381be", "comment": "Malware payload (Smoke Loader)", "value": "a8c826aa1fd3222176c122d98e1c9050133ea84c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238517, "uuid": "d442e129-6cea-458b-b216-8ff5026f46c5", "comment": "Malware payload (Smoke Loader)", "value": "c73477d4410bad5cd1261a10ede5edc45f9a46fd31acb1e0e4b1f984e01f6027fd271b2613b45386626c685804700ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238517, "uuid": "f92e3351-98fe-4fde-9415-32030e64bcc2", "value": "T17C34DF3239D0E073C9A754705C24DA983FBEA9311976584B7B981BAE9F302D2733A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238517, "uuid": "eca66509-c99c-468a-8b1f-183b6a468821", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238517, "uuid": "ebb8b9b9-f384-403a-a10e-635dac531807", "value": "3072:MW8G5h+dmC+gwLzNLgpWcC5X6iAbPwz/sZlcEfV6RUOEmhbj:MW8LGgwNLgp9G6iAb4TsZaENBfUbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238517, "uuid": "65157678-b5aa-4687-83d5-fdeb8cb28997", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238517, "uuid": "16a84f9c-9d7e-4e2d-8c6e-667171a1b813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238517, "uuid": "b0d53d43-df68-486f-a1bc-2f53b2f0486a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d95068-a274-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675285865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285865, "uuid": "ff452012-6f96-46ee-b7bc-57e8f8664a14", "comment": "Malware payload (RedLineStealer)", "value": "7ecbba643628f94ba19830291265d89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285865, "uuid": "14d4c27d-9432-494c-9d68-d8e5726e5b3e", "comment": "Malware payload (RedLineStealer)", "value": "d7f94c05f6d679ea0df97e773ee754166ecee640bd2b93e2b533bab9568cae84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285865, "uuid": "9622c516-5695-4ccc-a388-4560d2af7a09", "comment": "Malware payload (RedLineStealer)", "value": "03cf7509b4864f9d7f47ef65a47560083c4446e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285865, "uuid": "d7428ed2-efff-4c79-926b-76776ffa99e2", "comment": "Malware payload (RedLineStealer)", "value": "ca8d6e816a7f1394b630227a996ae0bfdd287e603b5317ae174ef0d70b1f7ae29be024c7aca62682eb043fdcaec1c77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285865, "uuid": "705c9dd7-31ff-47b6-8613-a9cf1e8a8ba3", "value": "T185355D2067AC9F19EAFD1B71B4B2012043F1E08A9091FB4B4DC164E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285865, "uuid": "508254b2-2aaa-453b-99c6-608825fed560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285865, "uuid": "7d7a3b95-47b1-4a72-aba1-5fcbaa15b705", "value": "1536:aqsAPqX6lbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed2pteulgS6pw:IeA6YL+zi0ZbYe1g0ujyzd1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675285865, "uuid": "0b48f714-94df-4e42-894d-fd8694706947", "value": 1097792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675285865, "uuid": "4a0dcdf2-1f81-47bc-a4b4-ec264bb9840c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285865, "uuid": "349b1740-273c-4bfb-9f2b-4f0f471a54ba", "value": "D7F94C05F6D679EA0DF97E773EE754166ECEE640BD2B9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffaabd19-a287-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675294051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294051, "uuid": "3b90ea22-a286-4a25-a7bf-3f9c8e3b1ccd", "comment": "Malware payload", "value": "8fd8048b2b5889800b03a504781e9e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294051, "uuid": "57bedb26-ce66-41bc-83c2-c4fd3b655226", "comment": "Malware payload", "value": "d80b56217b5d964d7ac83bcf17aad3461ed111c65784078f8aea5f87bb538dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294051, "uuid": "0e76fbf1-093b-49f0-a585-2366147b83e3", "comment": "Malware payload", "value": "98902d92ca2bb336b8b433baa9be3037123c27d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294051, "uuid": "830dd2a2-544e-4c9b-9795-ab870dbcab50", "comment": "Malware payload", "value": "6f7fb155ec856f194e1eeb8518cedd80de10577ee6765cf8c4e7ac7d4d6a124e2a889130b2f6565088cf3f0063afa1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294051, "uuid": "9bd74486-91d9-4d04-a05c-1e770afde1b0", "value": "T17634D02236D0C0B2C57650305C20E6A57BBEF5314975A95B3FA81BBE9F706D0A73A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294051, "uuid": "a13357b8-c47a-41c7-b262-4033723fd6a0", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294051, "uuid": "fe63c4f6-82ca-438f-adb3-5279df756928", "value": "3072:5RT0s98u73WxfLHFWvb6vr5p7pSgA5D8GmQ7n+aexlpyyF/sPbGV:LTLHmlLHFGb6LpTAeGNex7BabGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675294051, "uuid": "6dad2d86-330a-4bc0-a4cc-7f134d6c22ac", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675294051, "uuid": "90f4d48f-c8f1-45cb-a39f-7e64afff13a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294051, "uuid": "f31c65eb-8ba3-4787-9f2a-3a929429978c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b58fef-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675267350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267350, "uuid": "c8893589-b720-4772-aa79-7aee5f97c83d", "comment": "Malware payload (PureCrypter)", "value": "f0bb0ab9da29e56d6c4bb10a7a5f1b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267350, "uuid": "fdf7ec69-04c8-4e50-825f-0ab54db592bf", "comment": "Malware payload (PureCrypter)", "value": "d8ee67d4f6b79eecfb6dae9c3c176a1589a0ab15b9011723be11a7efacfc52d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267350, "uuid": "d9d19a2e-a06c-46be-afdd-e39398debb4a", "comment": "Malware payload (PureCrypter)", "value": "9997437887259ea6b24f27f8cc4dd5a699796335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267350, "uuid": "6924f4a0-c32d-4728-b7e5-88d4691fe06f", "comment": "Malware payload (PureCrypter)", "value": "80bfeabcd47834bd07ab96de84ed3431ede3dc24244bb45b814192ad06619c48498b4f18b1c6b589c236895ac316f5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267350, "uuid": "b13637a7-bbce-4bd9-b1b0-7d0b8e2887f6", "value": "T170661225239C91C9D17A9039CA864AABE7B57C429374C7CB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267350, "uuid": "7b819f7e-b5b1-443f-bc71-93c51db2f9f3", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267350, "uuid": "c350005c-d2ff-4c81-91b9-9280c69dfe8a", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKhbC:tV44xgrwo5tLMKRUGrMTC5H3SK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267350, "uuid": "359d1464-d301-4c3b-bcc7-de3043cd7ab3", "value": 6873397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267350, "uuid": "afde9148-5edc-45be-99c1-1ad92349f0f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267350, "uuid": "9b41025e-892f-40c2-9fd9-d95b0844af10", "value": "f0bb0ab9da29e56d6c4bb10a7a5f1b0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7032d04-a1da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675219706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219706, "uuid": "2f533593-ba8e-49df-acc9-cd96bfe01110", "comment": "Malware payload (Smoke Loader)", "value": "594826c519467b89d2da13eefcbd522e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219706, "uuid": "2418e1ec-2fee-47a4-b19a-d1ecad24dddc", "comment": "Malware payload (Smoke Loader)", "value": "d905037efac765050aca99e32b049cd9a8f6421373aab890183551d6d9ecaa3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219706, "uuid": "8d1a8b33-ef6e-4944-abc2-bd42956a821e", "comment": "Malware payload (Smoke Loader)", "value": "69f9db801a84d5074ce5674af29ed84420c7b7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675219706, "uuid": "9d6f7c5d-da10-4d91-96ac-01a578044ce4", "comment": "Malware payload (Smoke Loader)", "value": "fa778ae4f70ca03009f8f0d160a6b3f13b26838b10889d0ac53a8218f43f1478b4242cd29e28dc61428e6645971b0472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219706, "uuid": "b3144e5e-0680-4ccb-bf1e-4c3719ac752a", "value": "T172548DC276F1AC62E9338A719F1EC6F8761EB5524E19736A131BABDF15B01E1C1E3200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219706, "uuid": "b5283d8c-d6bd-4aa3-bb13-53c34a7ebfc6", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219706, "uuid": "0f20455d-0224-4d12-bfac-6b4cde1bdfd6", "value": "3072:rVBD0bL0fRcR+Omikkd8RRTgn6LSvO+g4HrdmqPUx6WfQz86AMyfT3MM6:70bL0CwTik487TfSvGEmqMoIzxT8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675219706, "uuid": "5f9fa86d-1c94-4b82-9600-3b0c2c556eb8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675219706, "uuid": "6f61df45-7afc-4b69-881e-8c1e1a543f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675219706, "uuid": "648b18cd-54f4-46f2-b50a-46c5a2fc4490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42d44e3-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675268181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268181, "uuid": "9f0e69c6-44e0-493c-be0b-3ab444047f0d", "comment": "Malware payload (AgentTesla)", "value": "aa72afc6fdca3aff5043694f61c54510", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268181, "uuid": "51f36856-a781-437c-9b76-d64ef70cc6a9", "comment": "Malware payload (AgentTesla)", "value": "d9117ba98a0abf65bd92272205ee3371dab1f2ad9bbd80d21107b4259697831e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268181, "uuid": "589cb02f-932d-442e-86d8-0fce953db29a", "comment": "Malware payload (AgentTesla)", "value": "01e334b719d0735e9fa27b227068ea6d8f07d021", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268181, "uuid": "28812a26-8413-48b1-b083-15e01b3841c3", "comment": "Malware payload (AgentTesla)", "value": "c84a564e7dfc67ae1bd075bd6118c1bdbdb61a9c3bc6f047bf8bc619c667863b05f504cfe85d787f343a043872a6012f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268181, "uuid": "b3b72130-9927-473b-8d0a-63b6350e9d1e", "value": "T1CD155C8437B0A4AFF08B497641183E986E3C705363CBE253967339D4960D6FBFA54DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268181, "uuid": "e005561d-7cfa-4b04-9c43-ce24fd67eeb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268181, "uuid": "c1992ebf-dbfe-48df-8c64-932f03145a2c", "value": "12288:+ZflYWr87728fM/f6RSabB2RiTh3DTUYX+IJNCNJ9i7+pv7c4N34iDstW7RQxK6R:kflYWr8BMX6R5N8CzTAJw6R7c4N34V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268181, "uuid": "7b20672e-043a-4667-8750-73ac22817f5b", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268181, "uuid": "4c2a31b8-18d8-4efa-b4db-53d795cb7879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268181, "uuid": "d8d1cb34-e2d5-4e04-9168-4b28108cdaf0", "value": "Zahlung,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9598eb-a219-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675246665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246665, "uuid": "d7bb7f5e-d8ef-458b-ace9-5beaafa66148", "comment": "Malware payload (PureCrypter)", "value": "e687a214a4e1045485278f75446d7330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246665, "uuid": "2e204dc8-7af9-4697-8182-4b1fbb2f8c8c", "comment": "Malware payload (PureCrypter)", "value": "d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246665, "uuid": "f19eedf8-8eea-48b6-9c90-a541af43f90c", "comment": "Malware payload (PureCrypter)", "value": "0525dba91f274da884135f8c2f487a404561309c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246665, "uuid": "3e2e4987-91aa-40c7-b495-0c008bdfa52b", "comment": "Malware payload (PureCrypter)", "value": "e064be62aaa150d99875af9e34233b17ac1699f226c44658c20f9d896bc70360f6bc770bbe4aeefb445f88dbad036d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246665, "uuid": "1138ff19-f02b-4972-b8eb-00f5f4005cc9", "value": "T17ED1B811F3EC8533DEBB8B39ACB66385037DB20658139BAE68D072176D1168D4762761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246665, "uuid": "a9e4f6dc-bdad-4424-b5b5-c2e9106d90e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246665, "uuid": "e857f4c4-e8b1-45d2-9902-232a421dd311", "value": "96:1rsKf/efqFIE99JXw3VpzHKTLBKMAtP4JYgdG/lT6eZmFkxctE0gzNt:xt3efqFIE99JXw3XKLBKoldmJjxUE0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675246665, "uuid": "e960bea1-be3f-4714-9ef9-0543a39e328b", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675246665, "uuid": "f0b6e90f-cbb7-4931-9961-81a8dda1c7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246665, "uuid": "322ecd52-3273-4e86-9195-eeda0c7d62df", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35aa5c1-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675267831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267831, "uuid": "c4aa277b-2e64-4362-b8b9-cc6ab8ff52bb", "comment": "Malware payload (PureCrypter)", "value": "ad127f6a6e823c10e54c779e92f4ef91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267831, "uuid": "f854d1e6-1384-407f-8a1d-62a906584570", "comment": "Malware payload (PureCrypter)", "value": "d9e7d9699b28022d1fd6b5ced9f32e3dd3210475d6a2b2ec770d331d6a910a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267831, "uuid": "0155194d-a1d8-413f-993b-be1617aa4b62", "comment": "Malware payload (PureCrypter)", "value": "26a021276b982afca759e04b62d3cb4caa4269fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267831, "uuid": "378e770e-776e-4f69-bb21-410fd15fdf2a", "comment": "Malware payload (PureCrypter)", "value": "868b288e02437fcb8b0ba80538b267b83c2c7f91a95db6e83eb6777ff4287180daa43f7e0259ae191b76241494b44852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267831, "uuid": "105aef6f-eba2-4d6f-ac5a-04cd771a932f", "value": "T1D4544B48B8B6D161C048EB383D92D2305B657C276A31C86E95C63E6FB7F70A73A411B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267831, "uuid": "b06d2bab-aab8-4cb0-a65b-a92970fe6ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267831, "uuid": "454260f7-f192-49b4-b640-cc3d6a8eb1fa", "value": "3072:s+LwLS2Vbqe+uZtuQ0UzDNwwh0wR2c2vGZ9pwPtV3vJPg1NXHII61gdZwgJRZ/2J:wEe+iXFBwhw0cvxwV3vaHIIiHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267831, "uuid": "19270f32-7f77-4e11-874a-2c3b5d37e8f9", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267831, "uuid": "a63aec70-46bf-4bc7-bc08-d7494d0aa200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267831, "uuid": "5848992c-fa32-4e6c-8f5e-0b486d50c081", "value": "Air waybill number 290132727 Physical weight 1 05 kg Seats 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959ae688-a1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Neshta)", "timestamp": 1675231596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231596, "uuid": "6b43e342-1e57-4e5b-b681-d04ba418b3ac", "comment": "Malware payload (Neshta)", "value": "25f57f13a57b781cf69336f00735a16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231596, "uuid": "b7b515e2-5313-4ce1-9917-61bce7fbb535", "comment": "Malware payload (Neshta)", "value": "dac51d130e6845f088cf0f73884a0766d968f50c5debebb2f54172a5f714788a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231596, "uuid": "d8eb3098-0a7b-424b-a1a2-2cb6904f48eb", "comment": "Malware payload (Neshta)", "value": "2e26d7d5bdcea36fc23b7641fad1876478b32283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231596, "uuid": "958f5a82-be9b-4346-929b-526ddbe18822", "comment": "Malware payload (Neshta)", "value": "5811f3d396c9f25e98a60b7cc20bb5d150d103e8cb2a802b68663d2ada088dbb8cdb8a63faeb29068af89b85e8680b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231596, "uuid": "3792f34b-996c-4e8f-af90-416bdabba112", "value": "T149F57D217B918076C273367185CDB3B8A2AEE6704F7502C765941E3E6F385D25A3CA2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231596, "uuid": "732e5b31-dc90-4002-a837-a593d3e805d2", "value": "00b4640bba55392cc0861a64ef5dd6b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231596, "uuid": "036bb020-ff84-44cb-807f-f5feb782b8c5", "value": "98304:jpSbilaS48FpKjHwxunJP1kBHFEVK/abYhsgF0zmwtAwuv/:B0HsBuKCO90zmwXuv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231596, "uuid": "a6f10564-0569-453d-893f-9cfdf453c87a", "value": 3519112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231596, "uuid": "c30a20ea-f8d3-4078-ad23-acbe198fea9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231596, "uuid": "f19d40c1-ebc7-4649-96cf-2f7e8387c759", "value": "2023-02-01_25f57f13a57b781cf69336f00735a16e_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e21f06c-a1f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675232845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232845, "uuid": "68391678-0735-4152-9db2-8ee39cd6a635", "comment": "Malware payload (RedLineStealer)", "value": "bb4397456ae239f8040d17466435fcc5", "object_relation": "md5", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232845, "uuid": "b0dc5c0f-4d23-4dc1-97a3-3d68e9837a99", "comment": "Malware payload (RedLineStealer)", "value": "db0270b977bf68fb8ce2e161bae88c7dd4ed82866b3bbc3d6c8a713edc69db53", "object_relation": "sha256", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232845, "uuid": "4d6b278d-92d4-4597-a80b-275e24e20afe", "comment": "Malware payload (RedLineStealer)", "value": "b19b553c2389c3d62d2cfd4b18af508b8a2b0020", "object_relation": "sha1", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232845, "uuid": "f41f6967-825f-4c8a-a80a-0ae4204472a1", "comment": "Malware payload (RedLineStealer)", "value": "df72700f30d3f0c18cd15a1fd3c710e4df5191a50ed561e601415a86bb1e84f63fa57797a4f2e2c35e25e850a99798fa", "object_relation": "sha3-384", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232845, "uuid": "e23472e9-2339-4d46-b744-b42c4686374e", "value": "T1708633486A4640EEEFB123F41CD60519AEEE6F5847B3711B4E1F218E250377939BBA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232845, "uuid": "3be3c62a-6523-4b4e-a3fe-a8a4e8527dfa", "value": "98304:PeOvVUAD89wQlghyam0mUOm/Q2AHIwDRnlWjsbkl73oyJ52otql16DDrlpoO8S:xVUAQ9PggxhmMdSjsbklz2lQBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232845, "uuid": "2b0a63a4-794e-4bde-aedb-f3243156785b", "value": 8014014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232845, "uuid": "e71704b4-ae7a-452c-9e37-0cc23ea0ff39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232845, "uuid": "0b92c7af-2def-4150-922c-7fa802f69396", "value": "ChatGPT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddef56a-a1fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675233569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233569, "uuid": "b58cac92-810a-4537-97e7-b0d92b0b7253", "comment": "Malware payload", "value": "12539ac37a81cc2e19338a67d237f833", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233569, "uuid": "a9c43a5e-675e-4b64-8d48-39a70521d38c", "comment": "Malware payload", "value": "db18e23bebb8581ba5670201cea98ccf71ecea70d64856b96c56c63c61b91bbe", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233569, "uuid": "2c290519-a011-41f7-a55d-ae5bd305c04a", "comment": "Malware payload", "value": "39a61c4d9d25c8ed1b38b1a51a8ef0b5cf51ce10", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233569, "uuid": "f6d63c15-84ee-4354-b697-f933361fab92", "comment": "Malware payload", "value": "12f139e740ef4541550cf74c559ae863987262439350a5cddaad2962ec9145bed1e821caf3e9d38e54bb02f32aebd935", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233569, "uuid": "6a2af60b-0af5-4ab8-8ec8-2171ef3d3f95", "value": "T1E156E4F5133A3ACB4545B51AD7E2F6B374F8C276BA61EDAA3AE70A13CC7D4D12011206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233569, "uuid": "76f6dd5f-f4fd-4f03-8a00-d9172a7bb544", "value": "24576:VFZTwQ66V/O3yDlkG/O3yDlka/O3yDlka/O3yDlka/O3yDlka/O3yDlka/O3yDl8:L5hlnltltltltltltltltlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233569, "uuid": "d834264c-352e-41c5-a0c8-b6ba7f97b17a", "value": 6254878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233569, "uuid": "80d4d90d-7433-4c7c-83c0-b3033c8dabfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233569, "uuid": "071c143f-4826-431a-a693-77b4a8a76123", "value": "db18e23bebb8581ba5670201cea98ccf71ecea70d64856b96c56c63c61b91bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1d32f6-a20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675240329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240329, "uuid": "aa9cd89a-9d74-4991-99fc-158ec2d6c363", "comment": "Malware payload", "value": "052800a764dd7d31e244a10b299e666c", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240329, "uuid": "47e711a5-cb3e-49de-a2fd-a1dcffaeba49", "comment": "Malware payload", "value": "db53c5052be26fbe49e0430fc1d60ab602d87918cad8dd7892974316c3eff0be", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240329, "uuid": "7ae87beb-37f3-4199-9889-894004a9a138", "comment": "Malware payload", "value": "1cf333e45f92a107237ea006b5db92a0bb778af3", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240329, "uuid": "27364023-23c5-450b-8ff0-db92d448bd7b", "comment": "Malware payload", "value": "4e4a598ed0a404428435c8fcabf182ce01b4b489c298dec2f81f6a6b95af17aa35cf73ae38ce503d33f708f9a623c9df", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240329, "uuid": "4ec0ec9c-b2f8-4877-9c03-0e84cd3acade", "value": "T127D308C076804259C1A9053D8AA69A4B712EEFC27153CB1FAB4637CD8D71F90CA539FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240329, "uuid": "0b9ed244-b924-46cf-83d8-87dedf115ddc", "value": "384:Q5FcRTVveql+KDfx+ZJOEgJ+6qa5Xvhn4yjojU:Q4RTVmqJkwEgJ2a5Zn4Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675240329, "uuid": "085850e0-d98d-4080-97f8-d27227c7672e", "value": 134976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675240329, "uuid": "5ff3ad66-39ed-4c49-b5db-aaccf7efdac5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240329, "uuid": "309808fe-be0a-4783-8254-2599f8dc1f0c", "value": "PO2041032.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e652526-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292921, "uuid": "68d4f63e-a7a4-49dd-8040-d72595c9e8b5", "comment": "Malware payload", "value": "7a522afe8031813ad4e57c896e147049", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292921, "uuid": "701d7592-805c-4ecf-9709-040235983ca0", "comment": "Malware payload", "value": "db98ee5f159964b6ba5c2d567cd71350f70e95b2c7c65ac3b7aa460409347ead", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292921, "uuid": "50050534-6a31-44d1-8800-83043fb4de71", "comment": "Malware payload", "value": "6bacdd33391542d7e7f8ac5705ffc94d63a86014", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292921, "uuid": "c908fbcf-ab79-463c-88a3-7596881eac07", "comment": "Malware payload", "value": "942ab32f765c7d9db3443fb3498cddefe71d41cf9e0fceda72df069d7af0be14f8908b8a775c83a301d49529c42d322a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292921, "uuid": "63dfd871-91f1-4fb9-9a62-65d511a9aa77", "value": "T1E4363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292921, "uuid": "0b19933d-f122-47cb-91c1-e7a9fd0f38e3", "value": "98304:Iv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXf:IvpvFa+g8RWLdPk/84tCEr0RtNiC5eS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292921, "uuid": "c1ad35dd-6d83-4353-8e30-d82324f23e3a", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292921, "uuid": "704db93c-7050-4818-98da-7f3b7c17058b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292921, "uuid": "d9fe4453-a402-42b7-a74b-8a9778babb45", "value": "db98ee5f159964b6ba5c2d567cd71350f70e95b2c7c65ac3b7aa460409347ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad29334-a26b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675281748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281748, "uuid": "886380c4-cc0c-4d53-ac05-61d845acf844", "comment": "Malware payload", "value": "9eb99fe010df9c0936fe5a8a70734058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281748, "uuid": "69226e9c-0f7e-4945-a6b2-b8371d615f3c", "comment": "Malware payload", "value": "dbf15fc0e7a8af37ff257078dbb428423dbf68ae2ddcfd98377d543a2260f7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281748, "uuid": "b963d848-b356-4836-9a61-8790bf0990d0", "comment": "Malware payload", "value": "9e05e6201f5cb31bdeb64e8ee494e837ff1df1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675281748, "uuid": "9d706ab2-0ed3-4fe5-973b-4b2c65bdc1b0", "comment": "Malware payload", "value": "ed3c3be19fa8c4d5669a18a4fb427ba95d791f67f6a1d027f59a5668647c52b1e3ae5a0376d0de3fca70df4b5ac662fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281748, "uuid": "a64eff9c-fb63-4d6d-bba1-25195495bf8b", "value": "T14A34DF3275D0C073C47715309C20DA99ABAEF5314A79E85B3B6816AE6F70ED0773A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281748, "uuid": "4b80b277-cc44-4c93-8a05-a85f2a2d6376", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281748, "uuid": "92c99726-e3ba-43b9-9af6-aeafc23927c1", "value": "3072:0H7T8EvCFBraSLbQWMx5CLcLSA+Z4mT6tG/tEX5xci/:0HcJfrfLbQ9e9rvTGG/t65xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675281748, "uuid": "f49d2ab5-dfed-412c-82e5-3d9cce3a5f84", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675281748, "uuid": "0db6f398-6a5c-4dc4-b9b1-957cdc95a441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675281748, "uuid": "60dd3950-de5f-4f79-9950-17fbd4b83fc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50a1cd9-a1f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675230789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230789, "uuid": "0e510dff-d3ed-451d-9622-d925d158c665", "comment": "Malware payload (Smoke Loader)", "value": "9f20f7842c480ffab72563e8673ae395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230789, "uuid": "033be0c9-3121-4730-b2f9-e25c7a169fbe", "comment": "Malware payload (Smoke Loader)", "value": "dc08b144cc58ad668a7d4759517cff50bcf4a3f466f4ab8e12e7540a74d549e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230789, "uuid": "36208346-4ece-4b1b-9e76-41a4a1f5a4a6", "comment": "Malware payload (Smoke Loader)", "value": "84aae97771be552032fcdbcd563b2c3462c0ca3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675230789, "uuid": "3e49e4bc-c556-419c-b952-4f9c8c3e2d57", "comment": "Malware payload (Smoke Loader)", "value": "3628aa2454b49b36d1c765f7b00c3686f48e19009ce89a22656466ba76d4b3ea7db1a4d67c0b3d0a432763354e21f6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230789, "uuid": "c164cea2-9d83-4d6c-b167-5e244b47c4cf", "value": "T17334D0223E90D072C66A50305C30E7947BBEE932D574AD477B588B6E9F702D1A33639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230789, "uuid": "78f9f36d-a30c-4e1b-82b0-dffc7af94075", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230789, "uuid": "a0b99051-2c71-4bfc-9a92-44b9020cbb47", "value": "6144:zWYgbgUbLYCg9ltakqpqJoLlu/UPzFXa:zWTLbr+lxJMu/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675230789, "uuid": "44b38f58-aa92-421c-a907-5e312719bfbc", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675230789, "uuid": "5b7036e1-25a4-4f3f-961f-9a86eaf5eb99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675230789, "uuid": "a730a804-c8bd-4eb6-887b-00e6e8acb72d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97744a5-a20c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675241132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241132, "uuid": "2c4cb0cf-93f8-45ff-9ff3-0c257ebec2c9", "comment": "Malware payload (GCleaner)", "value": "2186fcd386b1fe7b9387a8230caaeec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241132, "uuid": "6de93741-ff22-465d-9568-8d5999d7327c", "comment": "Malware payload (GCleaner)", "value": "dc6d6b8011cfc776a5d38517d13cca00de76c42e8ff3afc328fc17a35b57d2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241132, "uuid": "6774a4d7-d64b-43ab-9779-0c43efe43cf9", "comment": "Malware payload (GCleaner)", "value": "c600d5363582e52fc45582379009955e7944c860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675241132, "uuid": "d074fdc5-f481-4da2-9808-1fbc0bfbe5a8", "comment": "Malware payload (GCleaner)", "value": "5b272de79100306b19ca8fbbe055aef8f3005512012778c6cef1a3a0c471433d68a109fefb0926b6cac42da3ab6e2c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241132, "uuid": "0a7004bf-f626-40e1-9460-1a6bbbec3353", "value": "T16DA5336A55398C37C2C3A5B42E64C16A9FF2AEA138B8E21152EC3E5F37BD1535C0D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241132, "uuid": "00e7a518-bb22-4aca-a3ee-26ad4a653904", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241132, "uuid": "67ed08d8-f2f1-4377-986f-2e22fab79447", "value": "49152:icPLnQ3L7Mu9iPVNAuoR3hRy9Leu3C1zkfAyl0PEPLCgv2MR:XPLnQ3L7dSaR3hI1Mipv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675241132, "uuid": "4fb4f5fa-8108-46c2-81b7-25d3b32972c2", "value": 2215336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675241132, "uuid": "85cd2b0d-ad0f-441d-8fae-410c9c20c020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675241132, "uuid": "62936d61-ad81-4768-82a5-da2b059fc16c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d2fd55-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1675234254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234254, "uuid": "04b6820e-2fa5-40d1-bfa1-41e4f6e3d150", "comment": "Malware payload (IcedID)", "value": "0dcf849c45cbcbcc80f2faf974a2da70", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234254, "uuid": "6a1dc3b2-c023-4f60-9e09-ca141a4399d8", "comment": "Malware payload (IcedID)", "value": "dc8d25b04313db41d710d03a22c60eb79eff2f2c8e36980fb8328de6f62e00af", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234254, "uuid": "2d11291c-04f8-4301-9aad-e779c7460242", "comment": "Malware payload (IcedID)", "value": "fb649af9030286b008898cbb0314f39689323a9e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234254, "uuid": "138ece25-1716-4635-be00-f56d5f46189d", "comment": "Malware payload (IcedID)", "value": "517eea136a5995583c3c124dbd58c1981ea0c0d1b6b0c5d3665e819e40562a92548c3d938e513398846faf94bed72389", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234254, "uuid": "9c08d5d2-0dfd-4764-8861-524cbad9362f", "value": "T13A31442F67E4471AE1F2467264ABB3118232F811E5274A2B41C0A18ADD20600FD2AB3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234254, "uuid": "4075afdd-219d-4350-8bdf-a827ea2cdda2", "value": "24:8oWJR/AP97s4yMp5zCxUA6e+/U4I02Gd+dsT+m9l:8p4PtzUCeEIUd+dC+Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234254, "uuid": "ea0f574f-b234-4c1f-bcd5-f7d3f97363e2", "value": 1784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234254, "uuid": "e08ea8c1-3ec5-40d7-8571-65135aca9b4d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234254, "uuid": "0859200d-6e22-4780-8e35-7feacca09fbb", "value": "DECIDENT.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24c5141-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675279399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279399, "uuid": "5f4f88dc-64ba-4cb2-9f0c-a47a0fb50c90", "comment": "Malware payload (QuasarRAT)", "value": "bcfed92d8aec2b33ff1a8a69f962a567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279399, "uuid": "0747c3f5-3329-4392-9583-a33b37d624e3", "comment": "Malware payload (QuasarRAT)", "value": "dcbb3d569265aa68fb9e55d9023141754f2f89c57609621a3d74278cc8547feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279399, "uuid": "b468f9da-8939-4986-86a2-27d0957dc50b", "comment": "Malware payload (QuasarRAT)", "value": "e0af3ac88b27ef2dc40bb9845ef3c1c59d913e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279399, "uuid": "b2ade830-d22e-47c3-94a7-dc4d49ca293a", "comment": "Malware payload (QuasarRAT)", "value": "2a878ba2985960475529d6a03bdf38768479fb2e910d6fb0523ab2dae50e28e55aaa30dc13e226e78dec99f37da03eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279399, "uuid": "1a7cb62e-e5cf-45a4-9aef-b2eedf53bfeb", "value": "T12C55AF710B96EDCAF59B1E5890093D109D191C477A68E394FCC832AFA1F9A74F588FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279399, "uuid": "6d436391-70ec-4355-a924-6cd4fb47df2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279399, "uuid": "63ccd6d8-5469-400f-bf9c-9d81930867be", "value": "24576:hk7m1B+BQyBlYKP00ZywxPCW7liG6zGky8ovgQVmLG8o7HxdcayLsWInd+uBHQmL:hXGYK80AjuI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279399, "uuid": "ddb84bf2-9dfe-4e79-b2e8-f2293eeb9354", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279399, "uuid": "9f23bf5f-8e2b-4589-856d-626d60e762b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279399, "uuid": "291a79c1-0bf8-4ac5-b094-912ffff1065c", "value": "bcfed92d8aec2b33ff1a8a69f962a567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76e8fc1-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675268213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268213, "uuid": "70cc84d2-debc-4ad4-9af6-2b6278669ca3", "comment": "Malware payload (Mirai)", "value": "18fb4442c2b69e28d791cb1009af062d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268213, "uuid": "9023ee77-8386-4429-abe0-8760f7c0ac4c", "comment": "Malware payload (Mirai)", "value": "dcd99547609933d61213d6f389609f3cbecb9802da97bbbe3d91c9c17d678ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268213, "uuid": "ffc37fe8-4e34-4b79-8a1d-8d2f27e38cb4", "comment": "Malware payload (Mirai)", "value": "ec6c5b9b739f6a0a7df243a7dbb04ce7d9d66683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268213, "uuid": "9bd8b0f5-e403-4184-9f2c-58a2f0647caa", "comment": "Malware payload (Mirai)", "value": "7b3a08bd3ac417c9c7ed01050eb9c1a64c8f0d5d96acf88eb205d98a0e6a0163c69b66fafe8d1ee8a19d4bda86f7d337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268213, "uuid": "ef68920e-2f38-4b33-b0b5-c88206f5f07c", "value": "T1ED338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268213, "uuid": "c5176aaa-0a3d-4bdb-9dcf-f2c2456fbe95", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv1:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268213, "uuid": "059f4377-2199-4573-8219-3f800a55ea1e", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268213, "uuid": "8b6d7ed0-5d6b-4a0a-8ef8-dae715a94d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268213, "uuid": "1933adc9-84b8-4287-8122-6b50cfb210f7", "value": "18fb4442c2b69e28d791cb1009af062d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78e15ee-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675264268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264268, "uuid": "dc3195c9-7f17-4020-bf80-ebb444084d17", "comment": "Malware payload (AgentTesla)", "value": "a3735459ce8dc8e939847308f520a685", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264268, "uuid": "bcc43a5c-3782-4710-bcf0-09e6710bf483", "comment": "Malware payload (AgentTesla)", "value": "dd5fc8aff34d9f67a5288b4a20c89ba0335cbbed6954a1c47e8d3c6a7fb9f2f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264268, "uuid": "9b0fee71-dfad-4259-a29f-36a7dfa220e2", "comment": "Malware payload (AgentTesla)", "value": "e16b09ed30a1ec6d0eeb41ae238c73845340d963", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264268, "uuid": "4d40ef88-c02c-4a2b-bd9f-60a175a5e4f1", "comment": "Malware payload (AgentTesla)", "value": "9a021c18fdaceb84877c77d21993c3befb589ef2d9e3200b9bcfe8864733bf36917ee6b326f3fef1fa295a094949ea3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264268, "uuid": "a40a8220-e16e-42f1-87fa-a264086c3129", "value": "T127055A4137F14862F1DB05B91028768C2E3D7447A6E6E2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264268, "uuid": "54d597de-c2cb-40ef-95a4-020d529f476b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264268, "uuid": "1fb69226-d361-494c-85e6-7eaa871bb5e5", "value": "24576:zeYaOM13qxIZEvqtqH7fr8zw6RTc4N34:za73AIYqte7fr8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264268, "uuid": "2105585c-8dfe-469e-aab1-0c952f914f8f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264268, "uuid": "98b9146a-ed1d-4b51-a7b3-7d524e38f3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264268, "uuid": "ecf9aede-0e01-4cc6-b3a0-a5b8704dee5f", "value": "Maersk_224518246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f92b80e-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675267610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267610, "uuid": "f0abe18b-4327-4816-b302-b0a73256d958", "comment": "Malware payload (Amadey)", "value": "4cf63b9a3e4bc0910af4d8baa5939238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267610, "uuid": "2b8e66bd-00d5-4a49-bc58-f4ad43dc6859", "comment": "Malware payload (Amadey)", "value": "dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267610, "uuid": "7b9f9040-1969-4ad8-90d2-ce31dc142cf0", "comment": "Malware payload (Amadey)", "value": "361eea9bb65071ebf09d9598fe7a482e487b919f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267610, "uuid": "7138bb96-5925-4c3b-aa8c-1adf21c267c3", "comment": "Malware payload (Amadey)", "value": "aec0c9420c52b599515f3b8554ba88f48c1ec1d3f308e55760424715e6cc52dd43607e577b5ad28a5e74d4f8f38e47c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267610, "uuid": "249dcc18-e5b9-4dab-ab5f-bfecb32e103d", "value": "T122936B1030D2C071D67E55351878EAB68B3CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267610, "uuid": "812a9f46-1995-47cf-a521-49532d8acfbd", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267610, "uuid": "978a1a2b-d124-403c-9046-8d51d08780b3", "value": "1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU43aB89p:UoUCWbBNpplToUs1uNhj25LJUOaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267610, "uuid": "5d933a7e-cad8-49c6-8468-9c472d820dda", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267610, "uuid": "0d8a1a59-4518-4dfa-9118-a3521010b585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267610, "uuid": "b4fca042-d28d-4173-96cb-65b17d124d07", "value": "4cf63b9a3e4bc0910af4d8baa5939238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75e04eb-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1675267354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267354, "uuid": "ced36eef-74a3-4805-9310-b3862a5aba3a", "comment": "Malware payload (Nitol)", "value": "c13b566342eb1a97ea58a72d01901a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267354, "uuid": "82c5b0ba-6778-4d4e-b2b1-e41ba6762a6e", "comment": "Malware payload (Nitol)", "value": "ddfc4f1ce5b765158696cab7da9107ac59a8b2dc5a404f180ef2118e66da52cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267354, "uuid": "30b67834-8112-479c-9b9d-b840544a4a59", "comment": "Malware payload (Nitol)", "value": "2d60b269d6f59299e2c8c7950daccb4aa37c43dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267354, "uuid": "2bbd3105-8bda-46dc-b178-2911ba61b055", "comment": "Malware payload (Nitol)", "value": "2422302615a4b6903786771196b918dcb2adbfb6cdf858f5e7f3b448d589646dbf948dafb20162be74e628dc16eab94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267354, "uuid": "8862cb60-5249-4aae-af1d-f2ed0867cc50", "value": "T174F423DDF384CDB3D1579874A95BA427F1368C860AF317822A2477B2746631E7BB42E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267354, "uuid": "b101fcfc-68f6-4d53-b6db-996261702be9", "value": "19f0b3d2ee05f9f69be857786f0a7be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267354, "uuid": "cd1dedf1-a1de-4f63-b509-007519cf4d70", "value": "12288:sgckEX2NLq+iOHcflNeFJTbX/3wqSvqB/A6wlOMZQJqETGv4Ih/QLc85OK:sjkEX2NLLDH4DeDDIq5VJxTOfBQtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267354, "uuid": "8ec137eb-da20-49e5-aeb9-4d6514cf1453", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267354, "uuid": "309d924a-f461-418f-aeab-3c83a0281ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267354, "uuid": "1e1eebee-1f1b-416c-9b45-f2f295db4536", "value": "c13b566342eb1a97ea58a72d01901a8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd8a2bf-a1d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675215212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215212, "uuid": "e207a3f5-2723-47ac-9e2e-59cfc4561ace", "comment": "Malware payload (GCleaner)", "value": "ba0f5fe18fe1d1dfd8444f9d9812f4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215212, "uuid": "21402139-5d2f-4540-b7df-0a2c9b068f72", "comment": "Malware payload (GCleaner)", "value": "de260b0bec8fe09b25635dea2ae1aa4538ffad6f1c3c375ee3105cc4efb8b554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215212, "uuid": "b00f6484-3a2e-4bd0-bcc7-a5de93b3afb2", "comment": "Malware payload (GCleaner)", "value": "9fcea6031c9b041d6cd026f8afe558e4a8557242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675215212, "uuid": "438defee-1283-4706-b36a-a5dc8c821ab6", "comment": "Malware payload (GCleaner)", "value": "25c0c4eba6d46a9429b9e4e16ce09a63173959b0f46aae3f60556d157f905101ed036486d5e21219df7a62cf1ac33f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215212, "uuid": "9ef0221d-ed85-479e-82bf-6fd2416ce9e6", "value": "T1D5A53317B9759D79F211DF700F2284507BB37B7D32B88101A29E3BD92D7B10A446E72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215212, "uuid": "31c31f75-ace9-48ce-97c9-8ee3f42d4530", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215212, "uuid": "a2970354-8932-49f8-9841-f8751194d34e", "value": "49152:C2uZ+UqMvnK9GCY2olK6L6JiMfjJBINgd8/VbgafwXKqLCgv2MR:d3snKMjpKviMfjJWgw3fmZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675215212, "uuid": "593a2e7c-bd7c-4187-8cd5-b1ff75dbc244", "value": 2205690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675215212, "uuid": "c11d5f7e-1b01-4b2b-90d5-f10682784a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675215212, "uuid": "732c24bc-7e7d-4c56-a764-d9215923000d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd1146a-a21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675248061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248061, "uuid": "e6f75cfc-9d22-4e0e-9819-97f2c38278b2", "comment": "Malware payload (RemcosRAT)", "value": "a083335ca799d11b4e9dd8237fe2ad6f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248061, "uuid": "0323ece0-1f39-4768-989f-38eb1936d209", "comment": "Malware payload (RemcosRAT)", "value": "de61fa24535c677a8946f41e636df832ee0b97327d1c3d7ece42192c05360eff", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248061, "uuid": "feaaf7c7-cd71-4b4a-b016-d5a3a429c1f7", "comment": "Malware payload (RemcosRAT)", "value": "c3b2b2a38ae95f7f3034d2b9c17550e6d4491125", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675248061, "uuid": "7822696d-7722-4f8c-befa-cd3afa652cee", "comment": "Malware payload (RemcosRAT)", "value": "70c874dcbf009b90390f4924c505c57d43dc2a999a3cfba010ed85cae7f383c789607c8884f3a7f679b2861b9f90cab8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248061, "uuid": "de83bb0d-17ff-4d4d-aaa2-b97e588fee13", "value": "T1F7F423FBECF56127F4920337D8E7F48B8A27744920A25927B9D4E90561C88F26E5D8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248061, "uuid": "d252db54-6373-4c02-a510-7c6bac42decc", "value": "12288:ppkRuqxG6x5SGGqZ+IckRttetxxu4S5RFu+OfPYu7kqeMVmyeH+4pncUW3YAZ:pWRuqxG6DNj+I7otxxS52+TuoTF7eYcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675248061, "uuid": "b92dc22f-9dbc-4ff5-a5ea-5a9314b18c95", "value": 735939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675248061, "uuid": "b29c51d4-2e91-48e6-a118-c43d3683578d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675248061, "uuid": "bbc1b18b-3013-4a43-a76d-1cd5432a4355", "value": "ATTACHMENT5678.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f089709-a253-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675271421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675271421, "uuid": "f2e07233-c631-48f9-8f34-db9815c94469", "comment": "Malware payload (RedLineStealer)", "value": "9007ce1150dfd34304264607a6e92079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675271421, "uuid": "62cdb34e-b903-4de9-811e-b910e6bde149", "comment": "Malware payload (RedLineStealer)", "value": "de9beb65aacbea2d3131a969760a16c060a056d4765197982fdd395fe5295857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675271421, "uuid": "a0ba21c2-d6f6-4830-af77-456fb8172f40", "comment": "Malware payload (RedLineStealer)", "value": "e029d6806105612c709f905d25eeb909001e9781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675271421, "uuid": "921327c8-e227-40ea-9260-69a458ea77d6", "comment": "Malware payload (RedLineStealer)", "value": "3040a3d5f883024d1602b045f6aadb38be57e1b80f88c321c52e423d10f11fbdf59135cd80bf24d0ddc596c560ea9fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675271421, "uuid": "43fe583b-8c61-4a0f-8840-5200c4c4a09a", "value": "T13DC19524A79D1633ED728B329CA263D1067CF753A9539BAE9DD0211EAC416894A60FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675271421, "uuid": "82b4b114-174e-4a9f-9903-d42e7fda55cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675271421, "uuid": "1f24cd99-7c55-47de-8401-c36a6dd36aad", "value": "48:61qWCOq+vmCah02sT27PuGF5pIK3RNMgwOq963r0HceHaalD4u5P9smqBHB6hpsT:86jnfue5JWOqpHauFrk8YV2FnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675271421, "uuid": "d4a00734-3023-4472-98e9-fda824647c81", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675271421, "uuid": "cd00204c-c881-4312-ba3b-4f09f89d6ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675271421, "uuid": "9fb8ec15-cfed-4cc7-bb2f-771c83b3afa7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b5baf5-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675267246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267246, "uuid": "47d54a4c-582e-42c0-b41e-cf6bdefec5b3", "comment": "Malware payload (CoinMiner)", "value": "90fe41847e9539bd7595c902ea98d4ce", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267246, "uuid": "8f627225-eb6d-44d8-8468-adaaa277712d", "comment": "Malware payload (CoinMiner)", "value": "df23480215b2f252a928d9ad444131d21e2ce6b14a7e0faaa15d1d75bc1eb7c2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267246, "uuid": "a81b7a0d-d923-4cc6-b385-dc30d6403260", "comment": "Malware payload (CoinMiner)", "value": "4aaf0914e6897d4bf40b16e2aaa76ae72d83ee96", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267246, "uuid": "879421a1-9fba-4d95-8be2-368cd8ecdff3", "comment": "Malware payload (CoinMiner)", "value": "3f8841ed93632fe221a9bd8c9a546cc0f1ece1cc0347c6e26eb3ce8d1eef8d5158c4d69b60c2a5a49e03140a1437ce3d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267246, "uuid": "7d152ec1-3a0d-4a6f-8b9a-38cc6e3b29c0", "value": "T11085181BE19350FCC67BD135475BA573B972F82902347EAF2660DB342F62F602629B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267246, "uuid": "815d6d98-5f10-477c-bd94-f2a2db700fc9", "value": "1a903a65eaa735683683eef11a03cfb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267246, "uuid": "a6c7d870-4fa1-454d-a499-2456952201ff", "value": "49152:0/2N9SdDAe7HNEZ6ia/ulEVuaMYEuFShvXAaiW5DjocFtZLj2XMhpF25FxjZVqi8:0/eSdMeEZvlEVuaMYPShvXAaiW5DjocT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267246, "uuid": "53183417-3206-4cff-8884-c87bf0344ae8", "value": 1872154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267246, "uuid": "0a745934-c736-4ee3-a2f1-47be68f4d563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267246, "uuid": "3f0fe031-85f7-46f0-8bc4-81389dcf30dc", "value": "90fe41847e9539bd7595c902ea98d4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd92521-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267093, "uuid": "f5e01406-f350-400a-b213-c9f706c5d3f1", "comment": "Malware payload", "value": "2af3fe33c4060675bb68064b3e71cd93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267093, "uuid": "6b5f23f5-6693-4d7b-8f05-2b2188073438", "comment": "Malware payload", "value": "df294b31d522a42534985a3c12a29a0e85299769a76ed09efe3d579257d712d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267093, "uuid": "7b34e12d-46ca-4d6c-8b7f-f7e4f3f0b37d", "comment": "Malware payload", "value": "49ec950718d1a2ebcb30b5381cbfa5ff5a549b56", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267093, "uuid": "06db9f47-ac47-4caf-92cb-8ba11abf7faa", "comment": "Malware payload", "value": "199538c6f9da86ad75e5910f8b285806f3b012fc96657d0b76e084e782cce869f61e7640683a5f10433da3a479d48af4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267093, "uuid": "7f06b4ee-8dd7-411f-a6f9-0d550e337089", "value": "T13DF0811D7C69E1DE850273CE6580DF0F858458E9351FA9A9210CECC9A41356B35F8D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267093, "uuid": "5d36e377-0238-4b5d-81b8-d6e38c9544c7", "value": "12:qONd8gc2q8YHVvDzfqTvNaOMX9+QbAqm+UcdCMkbrPgn:qONd8l2qp1nUFaOMNdAYmPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267093, "uuid": "c2c9f9cb-e683-4e32-ad9a-7c2f70763b7b", "value": 570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267093, "uuid": "22899f0b-57ca-4eac-99bc-8918f3bffde6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267093, "uuid": "e6bb236d-2128-4303-841f-527e72683644", "value": "2af3fe33c4060675bb68064b3e71cd93.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633c8f49-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675258999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258999, "uuid": "8808b30a-a958-4b30-a573-0e2d3f9e67da", "comment": "Malware payload (RemcosRAT)", "value": "7bd82d65a053d5b9a4f753fc337c2fd1", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258999, "uuid": "c71da35a-16a6-4a78-bf7c-4aecb62104a6", "comment": "Malware payload (RemcosRAT)", "value": "df31e13e2e6b9fc9d519b6c7a9601bdb5c80df3be88f66d7b4133abae6afa978", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258999, "uuid": "2b420725-0770-41c3-83fd-90620b7f20a7", "comment": "Malware payload (RemcosRAT)", "value": "07cd6ad388bb5e4b85cd536b6ffa866f616ebe13", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675258999, "uuid": "b569e41f-cb74-4fb3-823d-cec82d44f99a", "comment": "Malware payload (RemcosRAT)", "value": "9165f343ed9b4634f502b7f2232206a10dc99319d14e4ef6402441f484875f2e0daf0f4649fd532c9362939429ab1057", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258999, "uuid": "534d6e4b-77c9-438c-a463-ade091b2b7dc", "value": "T1BE153340E66FAEB2F201CD98A582C36631FFF91804962E7DD7DD4576D04B2F861818BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258999, "uuid": "f9e238b3-163c-4c3f-a3ff-039cf16d6bae", "value": "24576:oCXvtg0ptrBeC6Pp9W2yLSohrWFFJKAj4Rr7y:Z/1pt9Op9Ni5W8RPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675258999, "uuid": "361145eb-567f-433a-9aef-e580b9d91831", "value": 935720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675258999, "uuid": "39113b72-6b2a-4d3b-8545-c294cc0fa984", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675258999, "uuid": "04ffe5d3-8871-4d07-bca6-8cd29f3006a4", "value": "DHL SHIPPING DOC PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0fe834-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675268117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268117, "uuid": "744ae1be-726d-4623-8533-435b1b611153", "comment": "Malware payload (GCleaner)", "value": "1eaa6bbf7022368bb4ddd2b7886ef0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268117, "uuid": "9bfb86fc-f670-41e4-b338-216c67a9d93e", "comment": "Malware payload (GCleaner)", "value": "df6d83e92295f8e4c8a1eb251b8138dbfd7226ef03db342908d91e840e127cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268117, "uuid": "63282b2e-75c5-4be0-9320-d87b47f14de8", "comment": "Malware payload (GCleaner)", "value": "8870cd9c581e7d7dc6bc8051c2156cfe94e290fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268117, "uuid": "a5302d4b-684c-402e-bb19-f626e59af54a", "comment": "Malware payload (GCleaner)", "value": "f8b725da7a328bae0ed84c8734073ba93069498e2d9e57c0c9c643026a5660fbdb293b067c97b68449dbaa6cb90225d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268117, "uuid": "31210007-1fe6-4979-b971-0d0118975429", "value": "T116A53373B538CC3AE5628EF96910C22113AAED8619386A4262ED7D5F7B7F7833C09511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268117, "uuid": "1536451a-0949-4dbe-9d77-b72ce5505b56", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268117, "uuid": "e5e45689-2973-4d23-aec3-bc38eeea2534", "value": "49152:icPLnQNugDTonTHUsCUtwJZutKS+Fpe8KLXQlx7hc0ALCgv2MR:XPLnQNvAHUbUtwbutKSc9dXhQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268117, "uuid": "6d8171ef-d8ab-4f34-8356-9a7c10529284", "value": 2190304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268117, "uuid": "f0ecd601-a69e-4909-b1a0-5607e83f5de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268117, "uuid": "4e2c5718-838b-47ca-8ada-3137dc63f756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630ddf07-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267159, "uuid": "c073da60-e17f-40d7-9d5b-3819e5d05fce", "comment": "Malware payload", "value": "cfe54df026f15a3afecaeb31546d09a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267159, "uuid": "ae23c417-f2a9-4dbb-83a3-9a395cbb8ed7", "comment": "Malware payload", "value": "df830796a1716f2279da6702738ebcbfcb9b0127a7ac2d63d4cd1a8c6547e031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267159, "uuid": "e71aa635-a6cf-4142-8bff-e5513766bf9e", "comment": "Malware payload", "value": "c216942558e5395b08f0a7f817c90f95f5076f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267159, "uuid": "2cddc5ac-37f6-4aee-aa2d-4d24764a468f", "comment": "Malware payload", "value": "3b764fd4120dc600a20b5e1d441a4321467b1f6424a0af84882e277b9b303dce8ccf1521cc075bff18a9d81762248bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267159, "uuid": "3716cd0b-c75b-4184-a1c4-30a9544e3bb0", "value": "T13DC10D515EEE50DAF227073017EAB3BB1675F8B1542E62F930448A585F31BD0C862FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267159, "uuid": "de90ee38-6a52-43ab-bf71-f5e53fbd182c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267159, "uuid": "e52212e6-7a0a-4c1f-9738-4b6ed77f13d4", "value": "96:7SQTTVUqwG79NDCF4r0NNuXvt58k/X3SvFd3ojTrl:Jjwg9NWF1NNkvr8k/XKFdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267159, "uuid": "b7e00162-9ba1-4144-aee4-3369858a597c", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267159, "uuid": "40d9160d-02c3-467f-82e8-c8d9db56e366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267159, "uuid": "a85593ac-350c-4dfc-b49e-960540b940e1", "value": "cfe54df026f15a3afecaeb31546d09a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e5763d-a273-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675285228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285228, "uuid": "ac57540e-1cb1-429f-9f0b-1383a55f2c19", "comment": "Malware payload", "value": "1fd5d23bab8f8f4073ca84e64593e277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285228, "uuid": "ea252c76-7996-4ab4-b8ed-5d7ea3624810", "comment": "Malware payload", "value": "df905c3df4ea603f88c9df0032e442613ca4eb8e1869579997028db67a26a33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285228, "uuid": "d304b84b-a5ca-4e6b-a643-d5b62ca72b2b", "comment": "Malware payload", "value": "63dc3ea29ba3b3887e4c03742c3f3894041c8312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675285228, "uuid": "d2b23f41-0e53-42c9-9067-73ab033b36aa", "comment": "Malware payload", "value": "4bfbe236a88a949fc0a86c2a16e3893222efaee3c9d3e57a76a713507ebfbb6a88d0836bdb2b2abc71b697035ec7dbbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285228, "uuid": "293c645c-f3d4-43a8-bfa5-119e0da04a69", "value": "T18334D0227480D072CCA701309860D6A57FBEF9315979A95B7BAC16AEDF702D0773A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285228, "uuid": "b2511d0d-4c64-4e5a-a1fa-6bd967eef170", "value": "5b3e1365fd24e4232cba105b88665e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285228, "uuid": "19e9c93f-2d20-4337-a345-80e9cf5d68de", "value": "3072:klThLyAS34I96lH4L/uWUQd8r5lHn+NmH40sT2nvoAmKhdKpe8keP:KTRy3hUlYL/uhQdiewr82nvoZed3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675285228, "uuid": "ff50465f-388e-493e-b136-14a6b5865967", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675285228, "uuid": "dca8541e-b417-4690-b102-24032c580967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675285228, "uuid": "1c0f03c9-68c3-4920-a963-1d9f56e4e94a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7157304a-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675280068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280068, "uuid": "c37cfbda-dc88-4bf6-b58a-3391c84c22c2", "comment": "Malware payload (Vidar)", "value": "0f131923f1dcfef483d379462db488b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280068, "uuid": "fcc2e52f-dcb5-4bef-914d-8b31dc3f5d7a", "comment": "Malware payload (Vidar)", "value": "dff661724a10f8b50a9a33882699c4b20fb79c3caf16832ebfb70b9b6aeb1db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280068, "uuid": "10d08d30-2834-49f1-b64a-23fa870408ce", "comment": "Malware payload (Vidar)", "value": "64bfe2d518fd416edeb346df0e7105251fd425e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280068, "uuid": "0c6825c9-1600-4500-85e4-3068fd026db6", "comment": "Malware payload (Vidar)", "value": "67fc78f40746fb9a28a7cb89dad5c417d895668fa9a515b70cbf4f03c16af2d5e0367517d45b45a73c9885d2d022cfc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280068, "uuid": "31e4efcc-e120-4c0d-8aab-64f24953a12d", "value": "T1A3271262FB4331D1D5E4887188277CF731B17D6B87C05B3AA4F8758108A279ABA36937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280068, "uuid": "766a8b0a-c5a6-4b83-9f7f-3f5b80e78210", "value": "9f95eae0e562cdd8c0f94b7ddd3234c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280068, "uuid": "4d35d425-b27e-4d3c-b699-3f735209fe25", "value": "98304:HAYXBtgbPrAuVAE6lu0gaq8JmGnVFJIBjg9KXQup70J8RgB0hJk48JI72P8qz7gn:FRtgPrAXEBXuwg9Mtx0JhunkJ4qz4FNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280068, "uuid": "a0c2cf9a-9c30-4edf-ac5e-6e095c3821ce", "value": 20935791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280068, "uuid": "355bb88a-372a-4181-9420-fb8730a60df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280068, "uuid": "feba382b-3704-4462-aedb-c3b28403ee74", "value": "0f131923f1dcfef483d379462db488b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b579da-a1cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675213364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213364, "uuid": "18933680-87d7-45fb-8e09-8219e77b0d63", "comment": "Malware payload (GCleaner)", "value": "9b2ddede46c63c4d1f31a237a37b7438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213364, "uuid": "6d50d27f-32d0-4d55-90db-6b33cd30e2a3", "comment": "Malware payload (GCleaner)", "value": "e0c4c851d46339dd2a82a41d44a77205fdc644f8803733ca22839793bdb37c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213364, "uuid": "2d789efe-3f0e-40cb-b49c-320b98da04d5", "comment": "Malware payload (GCleaner)", "value": "8a2b8b352bb2e9ae228cdb826a6d03cd4bf4294b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675213364, "uuid": "fc3aaf4a-f1c1-4782-a55b-e6e0c9a2210a", "comment": "Malware payload (GCleaner)", "value": "38c8b72676c3a76ae301323fd6147575d67ac2d7d6a1c761b30db834490cd2992a585435f113d5ac65de1e843bedfd3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213364, "uuid": "0a82766d-cf7f-4dea-932a-fbaeee396a83", "value": "T1D3A53304A9606073C282DB78E9644B006AE1BF59397747B0BAFDF64E8F773A11E1E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213364, "uuid": "c0dbe55f-1874-423c-bd02-720c1c01741f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213364, "uuid": "2588cceb-5ba8-4100-8469-7b25183d87e3", "value": "49152:C2JxbG9QBlI3Tii1mVJFa1dJhEFmleFXhCD9SDC2LCgv2MR:dJlJbSmi1mVJ81efDDTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675213364, "uuid": "63201eb8-c7be-4e13-b43c-6f7cb4b75fcc", "value": 2185562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675213364, "uuid": "3dbf2c11-c609-46e2-a0db-d0c9508c5eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675213364, "uuid": "70a29ffb-8f81-41a6-b99f-3f8b50733e17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716be7a4-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675247426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247426, "uuid": "381eaff1-d01f-4d2e-a2ff-f0950fda530e", "comment": "Malware payload (QuasarRAT)", "value": "2674f1deb958d278c0f790703c27622e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247426, "uuid": "dd3561dc-d402-4b3e-80ec-8f7796e9cf45", "comment": "Malware payload (QuasarRAT)", "value": "e0d8602d3d0e1e3739b3ed5e175533e503628151966c17c6dba1f8e89dbecc0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247426, "uuid": "59595ead-a06f-48d6-a3e0-7c8e13b87bd8", "comment": "Malware payload (QuasarRAT)", "value": "c95081e0417ad47acc4fb6650b1f503cf807430c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247426, "uuid": "abf90d16-6f4b-4396-81c7-6f542a79c777", "comment": "Malware payload (QuasarRAT)", "value": "410927b73806bd9f2b1c2fe633bea9ed002c06b0d45151f7fd8e572d892a66ec0f078cc537b3440601bbe57c1259ef66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247426, "uuid": "6295d31d-4257-4361-b5b1-42f04a76c42a", "value": "T1B7D55B1877F80E2BE06EE772E5B1101267F0F82AF3A3EB4B618166791D53B415D412BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247426, "uuid": "759be2e6-c3f8-45f4-b5e7-cad9fe6ef88c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247426, "uuid": "7f0237ad-74cb-4496-8dc1-dfa4805bc1eb", "value": "49152:5DHxopr+Sza+2wat1p8aSjptZwF/hQjpzMjxz77Hpfas1xgrTiOrP37VtDk3lP02:5Dmpr+Sza+dCn8aSjK7tkNBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247426, "uuid": "fbc8b97b-d4de-4762-962d-35d957372005", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247426, "uuid": "7322df94-d63a-411e-8c05-814a4578f7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247426, "uuid": "717fa47c-6c55-4dc8-a51a-2db9e0db88b5", "value": "HEUR-Trojan.MSIL.Quasar.gen-e0d8602d3d0e1e373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17afe4c7-a20f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675242122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242122, "uuid": "8e292b41-ab1e-4b9c-ba7c-72f84bb388c1", "comment": "Malware payload (AgentTesla)", "value": "654e530bbff91fa74cb61551f9c32e7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242122, "uuid": "c2112d21-6453-426a-a75f-61f404bf5d58", "comment": "Malware payload (AgentTesla)", "value": "e0e3a3f77d65abc9bc24781692b535fe5166410ae8cf5692ab05030e177589fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242122, "uuid": "b6095f85-0e0b-4d2f-8418-49b2d2ca6fa2", "comment": "Malware payload (AgentTesla)", "value": "5ae5b89d3cbe5d7b0f6d2ae6345aaf0697b48018", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675242122, "uuid": "1450da39-37a5-431a-80f0-80ee3b698b77", "comment": "Malware payload (AgentTesla)", "value": "9d14ef2b84ca3ec59866cf84958f3cf6eba405fb8148fe41f85aba4c5fa061847e02b059702f1ec2cc3ad8d50a502fec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242122, "uuid": "44d6653d-5faa-4784-8b96-764d3941da01", "value": "T1CAC4235263B4D7AED13F43BDA275A53083396A4AB503E7045E8850EC255B7AC1B327F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242122, "uuid": "f3e94137-3f2d-49c7-9ca6-7807f1fe882c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242122, "uuid": "d7d4c2db-38c5-4291-b4e6-3c5277bb00a2", "value": "12288:mmqqnx+O/vbYw1xJ1yLBLGSXDr8z9i7+pvFCWtO:mmHxFDYkJyFLG6r8zw6Rkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675242122, "uuid": "461bfa02-eea7-4272-abcb-32740fa2bcf0", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675242122, "uuid": "450016f9-57ee-4785-b851-6109b5e8bd35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675242122, "uuid": "ccd7d030-5899-4966-adc0-86c279ee8683", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2815182-a230-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675256528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256528, "uuid": "b8032431-32b5-4cfa-878c-b7e5984e102a", "comment": "Malware payload (RedLineStealer)", "value": "5f353250f27ff6c2c1a44175ce68ac12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256528, "uuid": "8d67a55b-c4f3-42ff-bc7e-1863969ac287", "comment": "Malware payload (RedLineStealer)", "value": "e185c33240625497b731e67474d10e50bfb0f163c6e0e95487abf258b3450b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256528, "uuid": "90f910cd-e28d-4088-921a-dc4aa2a86f25", "comment": "Malware payload (RedLineStealer)", "value": "04278e07bf75bac2bf40a73c8e1c1b6d134e48d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256528, "uuid": "d65e9f0f-efe2-4907-82fa-ee83d927bb57", "comment": "Malware payload (RedLineStealer)", "value": "8269d0e435854807beceed03e8209804fddedf680f01498061dbdeee5290a83fc5648e9c52006c03480acee117c57f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256528, "uuid": "ae444fff-508a-43f4-96e9-5946ef48874e", "value": "T1C37402327980D073C97B0174A828FB64BB7DB1315AB55527779937BE8F302D06A2734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256528, "uuid": "f40e9885-bc7e-4b88-9de3-a93d9e0cce6f", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256528, "uuid": "b9e3480e-1498-4e54-97f6-69dad339a33d", "value": "6144:+SfWfz9LVJju9FyQv9V7vX2A4qYoz59FQoh:+Sub9hJj6FbvX22z59F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256528, "uuid": "a0e859f8-03af-4701-a503-fa94f1c171f6", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256528, "uuid": "0338ce7c-c4a3-452d-9fa0-ebdc2f4151d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256528, "uuid": "095181a2-b160-40f7-bbcf-58b7a87d500b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20661218-a258-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1675273490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273490, "uuid": "b10ce3d6-67f9-4e54-ac34-63ddf00b2520", "comment": "Malware payload (OrcusRAT)", "value": "eb3cba58bb78fa152e27f7054a835358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273490, "uuid": "0f42cfda-f538-414d-9103-23092da5d18c", "comment": "Malware payload (OrcusRAT)", "value": "e19c764d8c70cfecf85aee9f560f843a19c0819b921ecbc26f036cb70f4533d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273490, "uuid": "309a92a8-d5b4-4a66-92c9-25fba7b34e9d", "comment": "Malware payload (OrcusRAT)", "value": "42eb4aaeb45e06fee3fd7d2bab3d7efd9f8c6dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675273490, "uuid": "97cff35c-d3c5-4650-a692-2f1645a2d9f2", "comment": "Malware payload (OrcusRAT)", "value": "37e96a89876f16319c1948be1ea9b170534252f2e4c1b47ddd7a7fb7b6d4ddb855e4ecc150fcc88784f33f1eb67f6d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273490, "uuid": "8c585702-dfbc-4ece-972a-ce8baa9f9917", "value": "T16515BF013FACBD0AC1BF3679B3B71AC907B8E90A5452FB4E085851AD1D9B701BD163A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273490, "uuid": "89a96d32-e8d9-486a-8923-b179374f6df2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273490, "uuid": "0f6e7a9c-c813-4cb1-bc3f-d7ec8acc2de9", "value": "24576:Jtb4MROxnFZ3LRM4GrrcI0AilFEvxHPJooR:JiMi7LlGrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675273490, "uuid": "41d764f5-7d3a-4388-8f51-4b0bc644033c", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675273490, "uuid": "2d120a6b-9a8b-486b-aed8-3d56c1e20ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675273490, "uuid": "f35dcb9d-be82-4e11-b876-afea8a4c7790", "value": "activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f3e4be-a236-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675259143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259143, "uuid": "38dd2f35-1f52-4d75-92c2-792d5053da71", "comment": "Malware payload (Mirai)", "value": "0e27995c4709c8d8a9aa7a2d961826a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259143, "uuid": "8919e374-41f5-4fc8-afde-950dc80fdf31", "comment": "Malware payload (Mirai)", "value": "e2edc82413ca525600d93841afde3e11d71849a96536c774e1ff3befde2c39ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259143, "uuid": "f52d70a3-9e65-4360-b578-18ef749d2520", "comment": "Malware payload (Mirai)", "value": "22253369525eb0dd5f1bcd8031981d4c139b925f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675259143, "uuid": "36842a4d-5b6e-4775-9397-29b28b35612a", "comment": "Malware payload (Mirai)", "value": "610005b7155072f449d7ecdbfeeb8be4bf52398119a0eab86a72bd93aac4eb0294901bb266df51e62a0f4f5f68d70044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259143, "uuid": "d260dd85-4813-40e2-b41b-fc3b59749413", "value": "T1A4431891BC918A16C6D422BBFB2E01CD372623E8D2EF3207DD216F15778A81F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259143, "uuid": "31082548-8999-4fd5-b465-a7116431058c", "value": "1536:S3spJeaUU+WAzkjFHromu4t5Fj28PufxcR6:S3spJAiFLjrbFjWJc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675259143, "uuid": "fb008410-40c3-41b8-8528-9955664c69f1", "value": 60360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675259143, "uuid": "706aa8be-979d-467a-ad4f-f883e7eccbb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675259143, "uuid": "8e373bae-0ce9-44ba-a2a7-17ea1f8aec92", "value": "0e27995c4709c8d8a9aa7a2d961826a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f98f70-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675264080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264080, "uuid": "df949ffb-8156-48d0-93ee-3c9328dbf524", "comment": "Malware payload (PrivateLoader)", "value": "80db0830528a254d1b205009122ad06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264080, "uuid": "5462c42b-6110-4144-88b3-d7c083a07cb9", "comment": "Malware payload (PrivateLoader)", "value": "e305ceb9129c9f131269561ddbdb58d72ffad8479ffa3c41b3a4e477d7cb5168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264080, "uuid": "6897f022-0509-4267-ac50-6948bbed5333", "comment": "Malware payload (PrivateLoader)", "value": "91e33ac6fd47a806b15de1241eb60ded883bd6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264080, "uuid": "14accefe-9335-4cac-b5ff-722ee76f93cf", "comment": "Malware payload (PrivateLoader)", "value": "d79b1ab3c665b2d5756d16a6ff057823a2d652224fa4968b956ff6167094c7a7e40eacaf1b804f59e48250e770680aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264080, "uuid": "96b5226a-526e-4e45-a2ba-324bc660a7a5", "value": "T1973633C3A5DCC0C3ECA1C87D111B4E7445A6E8AE770836C43A7FA8951B371C8D9A29B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264080, "uuid": "91d0c78c-7161-487d-a554-03c25433ec27", "value": "496fff7f26eb25a135e9d530fa8ef62e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264080, "uuid": "60e18e3b-5080-4aa7-a3ea-af0e7a4ff58d", "value": "98304:C0maPaNRkAbtWF5UOhFSV0MCHvPh+Y5C7dGPD2stX1/EUSuMbf+IQ:C0m9jY55hFSVqHXhjmzsFCU9M7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264080, "uuid": "0070015a-bf76-4f44-bcde-575d6b9c37e8", "value": 5089792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264080, "uuid": "14d1fbd9-b117-47ff-9c12-34e69e6a2357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264080, "uuid": "cc87a5d3-88d3-46a0-b08e-32dd450e6cce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa02b37-a207-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675238745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238745, "uuid": "bb518c97-38fc-4305-906b-887aeecbacf7", "comment": "Malware payload (Gafgyt)", "value": "b7feddb5d556a33a3c9cd9ef7d1f259f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238745, "uuid": "b93ce1b7-6e3f-42dd-af48-38e9b554d9da", "comment": "Malware payload (Gafgyt)", "value": "e31b3eb5fa8a6538cc6cf074dc88c580356c2e46cf6355fdcbcc053ef402fcb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238745, "uuid": "4b8bc480-064e-4bd6-a8fc-0cc291abc0fc", "comment": "Malware payload (Gafgyt)", "value": "5f4bb7086f73238af529e68b73f95b47a5dd2ecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675238745, "uuid": "079970ed-f008-4749-8d27-50f054d11484", "comment": "Malware payload (Gafgyt)", "value": "69ef43cc05f12c839c2d2c42373e2874e05ca4a9cb08aed9051f231fcd79f23614894b405998d91e68f7c72a48c09f10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238745, "uuid": "e640b007-09fa-475d-a877-8fa7ce9d2018", "value": "T1E6733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238745, "uuid": "0397efba-0e77-4b42-9e86-498cb6c8d903", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzM3MmLI2VOCjXUfJRk:45omr0xKFn6J+O0MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675238745, "uuid": "a7523336-b36c-49f8-a8c6-02254c28541f", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675238745, "uuid": "83b8c32e-d388-4329-bd0f-ab35c5bdb5f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675238745, "uuid": "4e95f62b-c8e4-48e6-849a-7642ae8d7288", "value": "b7feddb5d556a33a3c9cd9ef7d1f259f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f352de91-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675264395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264395, "uuid": "daaf3b1d-1c66-4613-ad97-4c493619d0e4", "comment": "Malware payload (RedLineStealer)", "value": "b381670a9763a4ba3a8fac27d818888b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264395, "uuid": "d1b758ec-e28b-4c7a-bc67-20222b95b12c", "comment": "Malware payload (RedLineStealer)", "value": "e434770bccde8ab68b6328aa17a4e81075a7797f9be4dce7b0dce423379bc27b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264395, "uuid": "682713a7-0ba6-477c-9b1a-99cfb0032b5c", "comment": "Malware payload (RedLineStealer)", "value": "69475bf404f04c912dcc8b607f63c799d2cd7386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264395, "uuid": "7755b30d-0eaa-49fb-8865-551c03413185", "comment": "Malware payload (RedLineStealer)", "value": "e745987100297cbb982facdd6672b51dbb7818b73a54756ac1eada704803be167ecd51a7560e4ba5e88bfb0edbc39839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264395, "uuid": "508045cc-f21b-4ad6-8d97-2984f0ea74a8", "value": "T194C4959BBB60C9A5E04425F5C1DF0A3AA3F167E71773C146ED091E920AC23845F5FB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264395, "uuid": "adb02447-55ab-4cd6-ad30-bf941cf312e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264395, "uuid": "63cae7c9-e08f-4143-8d0b-e546ba8d6445", "value": "6144:Gw3eTDIhxYvMwPFM6+0SrwitMmKKIAo9Vukw0MvsrC9UioE1lEgoqDvsXr8K0mP6:/DfHjtDKjRMEBqDxoPdD0cwIh1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264395, "uuid": "e093835d-6d3d-48e3-8e3f-5cc64773f272", "value": 552552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264395, "uuid": "15688966-ae05-4567-8761-e92eaa592a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264395, "uuid": "f749a669-f856-48d3-9d05-6aaba0d33e5a", "value": "b381670a9763a4ba3a8fac27d818888b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53783504-a1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675225901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225901, "uuid": "ae6792a0-ae8d-427b-98c6-45bb3fd98232", "comment": "Malware payload (Rhadamanthys)", "value": "071c11210a2edc6b3d92fb55617dca53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225901, "uuid": "93ea2a71-1b73-4fb6-8e8c-bfd26d990b05", "comment": "Malware payload (Rhadamanthys)", "value": "e51556831016f5f023d16c6102846ba14710d4ae79aef682c4c61ebde023fa77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225901, "uuid": "8b230289-452f-459e-941a-dc2cff64dc97", "comment": "Malware payload (Rhadamanthys)", "value": "887064a172b18b0409ec880c7ecce2a10ba8d919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675225901, "uuid": "b1518513-d9e7-4d7e-8f52-56cfc2799ed0", "comment": "Malware payload (Rhadamanthys)", "value": "cc992b5bed8941758585098b3ba1fd01c2c1ca9f5d83df827ba4c3e893b913c8fef8effcef8b4cca2d8e4b53dd602ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225901, "uuid": "2517b9e1-621f-4aad-adf6-d5b304bc5015", "value": "T1B8548EC276F2BC63E9228A719E1EC6F4751EB5528E087365231BEBDF25B01E1C1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225901, "uuid": "71dbcae2-345e-4775-9e54-a0b502b261d5", "value": "68213f3d28175c3ae9682456ac8e5857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225901, "uuid": "bf19355e-fa1e-4eb2-82ca-4e53eb3ab739", "value": "6144:r2DL+zGpGr9CpD0TXleerB0eIbVhmqMoIv8M:ryazeP051B4bV8qMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675225901, "uuid": "0b19e3d5-ddee-49ec-b3ab-00db41f9a66e", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675225901, "uuid": "0107def5-b287-4a51-9f22-ccf50d32c220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675225901, "uuid": "8f5141b5-eaea-4e9b-a286-5835e8c8f404", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0f1981-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675262797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262797, "uuid": "420a3960-1862-4941-b2f3-9c9e122f819e", "comment": "Malware payload (PureCrypter)", "value": "a3a1f1bee14b0e117ca9698ca7d4a964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262797, "uuid": "2117c64d-1445-4c65-b2e3-11151b1315d7", "comment": "Malware payload (PureCrypter)", "value": "e5a5e82935acb5bf1706cd0e04a9bee5b0d995c4bf19ee3c363ceb9e6855ecab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262797, "uuid": "4275c1a0-8a31-4692-bb2a-db259fdebb83", "comment": "Malware payload (PureCrypter)", "value": "c69838ade96ae8c914093516975929b84a86f098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262797, "uuid": "68afcf40-8efa-4a2e-a25c-873edce658b5", "comment": "Malware payload (PureCrypter)", "value": "27e6fcb8796e53abcb57b8a08a155844b2fc7a39c4d84ab897aee2cd8af63dc03cea559e4af19ca05fe4fece2a84afab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262797, "uuid": "925b9efb-a6c0-4943-9ead-8f6091809fe3", "value": "T154D5AEC92288B815F29867D469BF17DA8CE0BE1BCA4765CCCDE1DB36FD09260531924F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262797, "uuid": "2fafe518-7d5b-4187-983c-5c8fdccb30ea", "value": "49152:dKfd3LCcCAwvevqw6m4OHoP45KBNu20Rt3CNuiO:ed3m06m4OIP45wN10Ro+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262797, "uuid": "4df18601-bcaf-4e79-afe6-1cde8960735a", "value": 2875904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262797, "uuid": "efdfe11f-38df-4ace-b816-fd38f765aea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262797, "uuid": "aab1640e-e838-4ea4-a4d3-95ca2840e3fa", "value": "a3a1f1bee14b0e117ca9698ca7d4a964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b69797-a22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675254688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254688, "uuid": "9a5bf02d-a648-407b-a877-4c2700ce80d3", "comment": "Malware payload (GCleaner)", "value": "29986bd1f6290cb29d1c3cc42e525beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254688, "uuid": "4c0fac7b-2d85-42d3-9d18-d4d730fe3f5a", "comment": "Malware payload (GCleaner)", "value": "e78217d707581e0ef78df3dcc48419cc5ee2ec0e7fa3c20427f39b4eb7e0ff5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254688, "uuid": "bafab9aa-2fae-48b5-9a7f-7fc4f36ff568", "comment": "Malware payload (GCleaner)", "value": "a79ab610cca23cab7d15f76f253a899d6417e6c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675254688, "uuid": "2920407a-b5d2-414f-ab4f-8453510d7e06", "comment": "Malware payload (GCleaner)", "value": "0d3868f7ea7470930855464b38becc23a2eff19ff43e03f331246c4b013d7c7e8ba94569410503a8f96ccc78f5fe99b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254688, "uuid": "8a4c991b-eec2-4b1c-863f-38e8a895a029", "value": "T1F5A533067575C433C1C2AAF86D20C6A2FBB2AE6522B8526274EF3D5B777F3829D0D501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254688, "uuid": "b70d913f-bfa2-43e1-bf3f-041329c3ba3e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254688, "uuid": "0bb80343-d494-4e64-a4b9-d2f30ab5b461", "value": "49152:icPLnQE0+SReTUMbsFcatzozVoOh8h4Dj9+fKHZxbV2dDgZC0bLCgv2MR:XPLnQUSEUMb6cahoz/8hzfK5xbiWC8vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675254688, "uuid": "233be89b-c672-4019-a477-4f6260ec94a3", "value": 2238418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675254688, "uuid": "1b48baa6-cb79-49d5-8d7c-f0fe08a05c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675254688, "uuid": "3651256d-e70d-452d-88c0-b67f294ec10d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611b62ba-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292926, "uuid": "cb4feecb-8457-4b8c-b5c8-b5d7b9a3225f", "comment": "Malware payload", "value": "e511a5fe35d9ca18dcddfe29e7112b33", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292926, "uuid": "731e7ceb-a370-4410-bf88-b59bbdb1b78a", "comment": "Malware payload", "value": "e7d6666e07dae16f21a1449726ed07d892cac11f26a8c16f63681f96a4c2ca13", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292926, "uuid": "1b0500df-d406-4a26-b446-f6c85a323db9", "comment": "Malware payload", "value": "10fe73acad1b34a223e706a92c04cd814b545203", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292926, "uuid": "af90c454-d423-42eb-959a-087e6d4fc069", "comment": "Malware payload", "value": "5b359a1e48b9006cf558a8a5bca4eb580352a5a0380dba0359926e50d2aaf1c3bb1f693c7eb9da9be4fcc8721af92020", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292926, "uuid": "d78de222-460b-441e-8fae-f604dca18014", "value": "T190363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292926, "uuid": "6672d772-e5c8-4d79-85c9-6ad333cd4c2a", "value": "98304:+v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXV:+vpvFa+g8RWLdPk/84tCEr0RtNiC5eSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292926, "uuid": "8736f01c-c907-4ed6-974f-54be6ad84213", "value": 4991488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292926, "uuid": "a55499ce-9979-4f32-aae1-c549a07a1aad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292926, "uuid": "7bddf4cd-e16b-4f8c-a4c8-3f61b3064c03", "value": "e7d6666e07dae16f21a1449726ed07d892cac11f26a8c16f63681f96a4c2ca13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8035b990-a247-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675266349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266349, "uuid": "67892716-7f38-4196-ae5f-34d08739cd54", "comment": "Malware payload", "value": "4d361b40c18c17ab671aebad5d5ecbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266349, "uuid": "1b30e374-c5a9-4087-b262-6afc56c3572d", "comment": "Malware payload", "value": "e8167ce7398c2fd228fe34d1c4c0c74d80feb135b40c2d2369d7e27b06b0ef5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266349, "uuid": "27f8e800-02fa-4737-b171-28f005327e97", "comment": "Malware payload", "value": "72ba6708bd6a1e066cecd7968685af834b6eb921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266349, "uuid": "63482699-aa1f-4cb3-8981-9c7c48b52679", "comment": "Malware payload", "value": "f7d5efa84a8a6adc4b706e5d9affa65dbfdab2ca4c0118efa060774cb746313c7769804b9888e1ff3ea2ce1e1935c407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266349, "uuid": "ac8c5d1b-a9cb-41f8-b939-aec2632f6bd2", "value": "T179E45B11B4889836C7231E31FE98F67DF2AC516407A904FF43AA9D007D67983B629D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266349, "uuid": "ccd9bf85-fe12-41bc-b79a-d2e121318229", "value": "12288:W6KygEtqB1ZEAZHDl5AmQYRSwFXNF/QN6KWn19uWQgmlXViXMWI9OqJEhkc/Qj:WqgEtqB1yCHD3AIsiNFIN6KYvuWQjiXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266349, "uuid": "2363ab08-43a0-49e9-811d-17091d51953e", "value": 698227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266349, "uuid": "bb92ac2d-541c-4830-9428-0af21e07e3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266349, "uuid": "7548d78a-8ded-40b4-9c01-ef4c8148449f", "value": "4d361b40c18c17ab671aebad5d5ecbc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acdddd6-a25a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675274500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274500, "uuid": "a23dad7a-034b-4c49-8119-9b38a99c9f5a", "comment": "Malware payload (Amadey)", "value": "5e97265b66c192183726e7dcf09a419a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274500, "uuid": "b044b8bf-f748-4a34-a485-d72260c0c85c", "comment": "Malware payload (Amadey)", "value": "e89b343d91e7a3e93b75800e8d100cd193545fa3f0a59b70df3883e7734d15c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274500, "uuid": "cc32ffb7-b7b0-49de-aa08-fdbc21a43fdd", "comment": "Malware payload (Amadey)", "value": "fba16f0607f6fa655567bc18887d23d7a72daaa6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675274500, "uuid": "3ffb6cd4-87fb-4098-9535-1072654b36d5", "comment": "Malware payload (Amadey)", "value": "9ac0066088add59375658d0f47fc092e348f74387e13eabd4818907a8245ad538bdd394a4c47fee2cdec77c7f8a65098", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274500, "uuid": "65c5f8a1-8ffb-4644-95a4-ccbc34ef4890", "value": "T15A24DF2279D0C073C07740715860EA917BBEA931897E551BFB981BAEAF706F13739386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274500, "uuid": "b7976742-df1b-4c20-a149-fe9affbc2e53", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274500, "uuid": "070daed7-0821-4c76-9756-aefd3c966771", "value": "3072:ljtzh2fQpM+LIcYcBWLY5J5tI6Gt/pu8lH/pgiL7hlex1:ljU+JLIcYcBq+SnxZ1/61x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675274500, "uuid": "64c84dc3-bfdd-4bd4-b094-81411e54c2b3", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675274500, "uuid": "3e1781b1-ced3-4fd4-90bc-08f569c170a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675274500, "uuid": "0dc8855b-3719-487c-92a8-48d44e9910e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5430b7-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675234315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234315, "uuid": "337dd87d-9115-45e7-b013-7f8edc934b97", "comment": "Malware payload (RedLineStealer)", "value": "cb82f71d474860c5d6c98946ae220614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234315, "uuid": "732812cc-e230-4a46-b522-b0886cf471d8", "comment": "Malware payload (RedLineStealer)", "value": "e8b1cc1db36f6dd29c489bbc3e644b5596d034403d0d5ba50bb3fbc7799742bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234315, "uuid": "590187b9-ae0b-4c2d-899b-00fe7adeb993", "comment": "Malware payload (RedLineStealer)", "value": "325eb103af33b126a5d1fea6f63b1b811022f20c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234315, "uuid": "31682937-9a16-4134-b204-e9f1f78ca7d5", "comment": "Malware payload (RedLineStealer)", "value": "7d9bdb490800c09bb364236e71d9f9e8fa61c7d4ef7ae007faca3aa5ee2e81cbf4b829c27eeb4dd82bb8c79e2822702b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234315, "uuid": "9c070521-3bee-425a-9b73-ab6451d251ae", "value": "T1ACB48397BB60D9A2E08421F6C1DF4A3AA3F167A31773C546ED061E914AC13845F4FB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234315, "uuid": "fb95f71b-b26c-4c73-b61c-73bce8605830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234315, "uuid": "3c658744-d115-4a75-b48a-e7f132d06210", "value": "6144:LYb3Yp1p/5R04X65ml66joPiMtTHt2erzXwixmkGLAIBch6dB7FWKkAl7zGihJYj:7p/5R0g6QwlJRGLAIBcosKn7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234315, "uuid": "abf98716-35f1-41fe-9703-db121efd91c3", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234315, "uuid": "6a0d6153-9318-4927-af5c-94866615c538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234315, "uuid": "afaf9a2f-d33c-415c-b68e-b4368833fd2d", "value": "chatgpt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e726ea5-a1c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nymaim)", "timestamp": 1675211746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211746, "uuid": "f8f22684-a9c6-4c21-9a61-ff544283b8ed", "comment": "Malware payload (Nymaim)", "value": "30be19a7b2ef7fa6421162ca6bdfca4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211746, "uuid": "2554ea75-f0bd-4e43-858c-659ad6c3d304", "comment": "Malware payload (Nymaim)", "value": "e928e034c1df4bf61807f5a294c6b1a2bd7d6948a85a7db1a5ed6c4b27a37b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211746, "uuid": "3e5815f9-8892-42b6-9a17-327898bd3464", "comment": "Malware payload (Nymaim)", "value": "80ad8571e258025ef7631366420c50591c84ab2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211746, "uuid": "a9a1a566-8dba-43ae-9fc5-8bd0d95f2802", "comment": "Malware payload (Nymaim)", "value": "b08c6e03bda3a5f40656f6f1e30dd2b2f246b987c96b70bbc27216c0a6a1caa9fc6fb8608b36ba57f8a9ce0453adfb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211746, "uuid": "43f9dfdf-d196-4d8f-a850-331f89649afd", "value": "T17FE4124592EC54B7F5724F78959183BBCF82C3E71F6A68BD18F08A02CD48A59C2E1C9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211746, "uuid": "51dd1b38-fafa-4337-9260-e37f9f01c66b", "value": "a4c59f8399a53bb5c57d011baca5b971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211746, "uuid": "b71c7bc5-f2ce-4863-b98f-786ac20ba790", "value": "12288:fIV/3vgf+7+vQltM33Fy/lN2vNER4g4OCuNo4/NL5QCUYOI:fbPDQN2vNE+NluNLvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211746, "uuid": "ee4163dc-b11a-41bf-b758-7c213db2c515", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211746, "uuid": "575f260e-23d7-4745-9244-82d721baf865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211746, "uuid": "42d0b3ae-66d6-4676-9cc4-2157eff0a148", "value": "SecuriteInfo.com.Trojan.Downloader.Nymaim.Y.25375.7821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6e9842-a241-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263789, "uuid": "8372d4d6-628a-4758-bd3f-f1b37c6fffeb", "comment": "Malware payload", "value": "34cbb5ac678f627ed2053a87da50e163", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263789, "uuid": "cec7523b-d3de-4194-bbc9-5ebae9de4547", "comment": "Malware payload", "value": "e9644077e66d0c3a6c34486eb4b6db56f83c3bbbd643473b729c10b05dc77e68", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263789, "uuid": "537c20ed-2a71-4e1c-9ebb-1f41de37cdf6", "comment": "Malware payload", "value": "fa01c68612b2c1e83cecc2caff490a1a305c16da", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263789, "uuid": "1d85d25c-e4c2-4188-ac02-d158c35e2e82", "comment": "Malware payload", "value": "8298d971f2f9293276b48936918feb7afc4d34cb2f943d0621c1c7996891f3423b13dd1d340533bb32be77b8aedf3890", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263789, "uuid": "6ba65246-ed32-4c71-a1a5-ec3ad33eaaeb", "value": "T17563F8527681C54ADA9907314CE2D7EA7B37FC919E7683073254F72F6EB36A0CA03606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263789, "uuid": "40bd8d03-4fa1-4ebd-8521-3c910dccb287", "value": "1536:KrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA2PdvSYPXGB:KrxEtjPOtioVjDGUU1qfDlaGGx+cL2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263789, "uuid": "635c971b-e7e9-49ba-9eef-b8cc2758b137", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263789, "uuid": "859deea2-e4c1-4ba6-8557-6a37bb0b6e4a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263789, "uuid": "50e04d89-91e0-4073-a9ba-17e7c050034c", "value": "Pago&Calendario.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4f9949-a24a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675267601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267601, "uuid": "3c81593e-00e7-48ba-b4c5-6f59980db01c", "comment": "Malware payload (SnakeKeylogger)", "value": "9dc5600bedda76a29aa0e33da951fc30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267601, "uuid": "0a102787-8134-4097-bc8b-5f0b5127c086", "comment": "Malware payload (SnakeKeylogger)", "value": "e966cd1651a960bc88f3582b328d274b2cbf2b84d59df761cbcd1702c38d5a14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267601, "uuid": "27fa1c90-5d2d-49dd-86c0-e3d18b98b3ac", "comment": "Malware payload (SnakeKeylogger)", "value": "9daa8192ef8b03ee276de60e656a56b88ec2d074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267601, "uuid": "9b3927e3-d135-4573-b071-1a02696e0db6", "comment": "Malware payload (SnakeKeylogger)", "value": "decd47105154b54012452214a52b6bd2e6470feb11d0edee0e7a644f93d94edb3452848a4e98c4bc84a8394f97625da5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267601, "uuid": "819cdcf8-d7fc-47cd-8f0d-f074b09df3ed", "value": "T1E6B4220176ECE77CD23D86BE86BAA020D3B56B689E1BDB044FAC50FD7167F081325652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267601, "uuid": "c8aa73be-fe06-4b85-9037-df579bb7b084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267601, "uuid": "f27da8ad-777d-4e0c-afda-83856a79ca4d", "value": "12288:8RFO4oYvuoQouswXH06WAx5HSbr8z9i7+pvdCWtO:8TO4UdrE6J4r8zw6Rsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267601, "uuid": "b64475bb-d958-4a89-a435-4ecf115f92bd", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267601, "uuid": "293978ab-d446-49b6-8b5f-62facb528b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267601, "uuid": "5da19c07-b778-4a15-bb30-3ee4f0a329db", "value": "9dc5600bedda76a29aa0e33da951fc30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553c5788-a26d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282598, "uuid": "27cd9bc2-2445-4645-94e2-f038d9492cb6", "comment": "Malware payload", "value": "2ba9e00bc5c34d1783e06a1a31f487d6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282598, "uuid": "a48cadb8-6c5a-443a-ab82-8b35dae386e4", "comment": "Malware payload", "value": "e976d956193d784606894bd29c825ab735629a9c7b15003209d031dc5b241f85", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282598, "uuid": "34b11e39-5cf6-4959-98e7-c6ac7185774d", "comment": "Malware payload", "value": "3e0cd567e031c669b1582002bb96f90005187430", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282598, "uuid": "bdabc0ac-b2da-4c6e-b612-981c5c1c2950", "comment": "Malware payload", "value": "fc2edf423c9d5f12caa480de95e6e9404346f6c927aff41263eb377d66d2ebc934e5048d72acacedcb71256be72e60f5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282598, "uuid": "776148f0-a49a-4c86-8d9f-ef9223813359", "value": "T1EF64F1207B93D073D55E00715538CAE5AABFB83256799587B3900ABECF703E1AB67309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282598, "uuid": "819a59c0-61d2-44ab-b55b-1c2188e451ed", "value": "e72f606dd0982c47d40a1b2d2827cdc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282598, "uuid": "2ea3b2d5-ef3e-445f-9843-e0f8e86fec89", "value": "6144:CmfaCL+bESsLBoNUfotoNU9TkKMoi8dbZ14CNsWBWXH9e:nFuESsLBxNUpfMZ5CjWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282598, "uuid": "365a5127-a7c3-4529-a454-1890a80eb076", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282598, "uuid": "c41efa2c-bacf-448c-aa11-faf396067eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282598, "uuid": "0ef02f5f-fda8-4265-9324-81673553b19f", "value": "file64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf32c0ad-a1f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675231263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231263, "uuid": "d37b92f0-6708-4595-bcca-4d7f191810f1", "comment": "Malware payload (Smoke Loader)", "value": "ee57a1babbcc44de91d0f640fcfcf275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231263, "uuid": "4d3f7fa1-574a-46b7-9da1-a96dfcd4f429", "comment": "Malware payload (Smoke Loader)", "value": "ea17a83ea973399dfea67513a93e5cbb6e5b2066a416e6837510092339b709e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231263, "uuid": "5f78dd19-7edd-47a7-9ff1-c1f9e1daab75", "comment": "Malware payload (Smoke Loader)", "value": "abd853b98f2da2fc5e120d2dd8bdd22e0d47cd7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675231263, "uuid": "ebdbafff-2e2f-400e-8374-0280271d6429", "comment": "Malware payload (Smoke Loader)", "value": "c8f634a2416e9e852ad27b998cd0a86bae7e8d3969d16841c482ee5f88a598c3736061ff84fd40a9e661d6e821a5babc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231263, "uuid": "fddc3284-ae57-4397-9bb5-ef978e7bdb46", "value": "T16334D0323990C072C57B50709C30F6A5ABBEF431553969477B9817AEAF702D06B3A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231263, "uuid": "2a05893a-d7ab-429d-b0c8-e1ed9602bc59", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231263, "uuid": "98832ed4-4944-46eb-bd70-9cd7bd37aa28", "value": "3072:gW/GAAeoYRQW1LxAWXZ5anDo72Fo1RopOiPdlgVMJvYGvGH1K6e0:gW/+CQ8LxAyWDE2Fo1RopOiPdD9WHwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675231263, "uuid": "066ec66d-6713-42e0-91a3-db689273ffa8", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675231263, "uuid": "91004a6a-83e6-4f43-a7a4-270297f3157b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675231263, "uuid": "0a46e1fb-8128-41b1-8581-e515cbd20683", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5534fbc-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675266841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266841, "uuid": "a92ac133-73ed-4e1c-a40f-7f6ce308b9ee", "comment": "Malware payload (SnakeKeylogger)", "value": "09b35406e447813c6aabe80f34bedc4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266841, "uuid": "11056adc-fdfa-4198-84c8-a31193ff295f", "comment": "Malware payload (SnakeKeylogger)", "value": "ea98f05d2d90731aae39655b1857b68fd99d342cb900fd9d4e132777ab980f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266841, "uuid": "42e65d31-01cd-426d-a0b5-e8c8390bfa21", "comment": "Malware payload (SnakeKeylogger)", "value": "a322fe8de29290306f5ae7642b4452f4fb432115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266841, "uuid": "14c5c82a-2efd-422a-9dd7-92cfb796e340", "comment": "Malware payload (SnakeKeylogger)", "value": "56d14cc9b9a2fbd333052b99103d02943685dfefaeae9ab160e3c8ad06422e784acc92867edeaf5875d75f09dc9550db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266841, "uuid": "3d972b8c-4dba-4650-bb3a-c41e81168782", "value": "T137B4222623F8823ED7BD83BED1B69414E3B18A868F57D7945FA814F91C437025621AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266841, "uuid": "d45aeb74-5b1f-4e55-990d-e38e04202501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266841, "uuid": "eabe8a01-3c54-4e80-b350-d7d057bb0672", "value": "12288:2za2zvecFar1RQAGltFlDr8z9i7+pvfCWtO:2OMGrLEvDr8zw6RKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266841, "uuid": "139529e2-2e08-4649-aa1a-090295abb57f", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266841, "uuid": "7bd24910-1ca8-4d55-873b-9e4a8f03dbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266841, "uuid": "c117ebf6-ad09-4e97-94a1-ab293b56b575", "value": "09b35406e447813c6aabe80f34bedc4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ffebab-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675263371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263371, "uuid": "139c0906-c1d1-4902-96d1-081cc6bec1e7", "comment": "Malware payload (RedLineStealer)", "value": "a85b1ad45e8908234c6253de7dec647b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263371, "uuid": "e9d8f158-7e26-493b-94fc-84a58200b250", "comment": "Malware payload (RedLineStealer)", "value": "ebc799b1d3811388f9771247535859e33c4b1d334eb4b79e67ec1a7acb2c4ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263371, "uuid": "bdbecd76-0dfe-4e2c-bb7f-b8e197063356", "comment": "Malware payload (RedLineStealer)", "value": "84b391203840b3e5b38053a1a1989722fde2a188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263371, "uuid": "f5ee303f-0bab-42ca-b671-a0d714af365e", "comment": "Malware payload (RedLineStealer)", "value": "6ec41208cf6cb064e9bca84efcf45b5da1980d70e76c6056daeb6ed9ddbc63d1e89525501d128ecf4fa0b047ec8382ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263371, "uuid": "94317c02-3c96-424a-aa52-97511334ace5", "value": "T17204D51037FCDD11E1BA5A3F6961A05086BF9802A842F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263371, "uuid": "d166b98c-61ed-4594-9ab3-f53b13b47190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263371, "uuid": "da373437-cffa-4664-b20a-cbc72f83297c", "value": "3072:BxqZWBJaHEDgXeiIVsIe3V5FuhfHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOs:zqZVeiIODduh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263371, "uuid": "f6e18ded-4303-4db8-86c9-31115be7bc15", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263371, "uuid": "97cc2b88-ea50-47a5-b1c8-4401795dfc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263371, "uuid": "75a11a0c-a601-4b9d-b3a1-6fef182b8fc3", "value": "a85b1ad45e8908234c6253de7dec647b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2642268-a248-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675266970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266970, "uuid": "c742d7ad-a961-42ef-8af8-d3d968d71e4f", "comment": "Malware payload", "value": "2a0e4fdc073c63e9fedbc104582d0343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266970, "uuid": "1399b899-3f9f-451d-ba51-9dbfa17e759b", "comment": "Malware payload", "value": "ec82a15de2f6770b776c5ca7ed7b6e0deca7a17fcd6658eb952193c6a2fe2784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266970, "uuid": "2b71949a-ebc4-4bb8-ae5b-78a1f8cbdb8e", "comment": "Malware payload", "value": "3a4e8dad938f44eb7547e583edbb511fb15eb8ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675266970, "uuid": "a16a06b5-472b-4b67-8542-e020cdb55487", "comment": "Malware payload", "value": "db7313c9ed541c1a28270cc86b080e4dbb33be64748f3050c29a5af9a80c58255533676c5be744b0a280a3025d83cb88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266970, "uuid": "b50cb22d-48a3-4b90-9868-31bad071e3d4", "value": "T1E1C53366798DA425FCED3DB6181EFAB35441821F87C5561C50EDBE28AC60308E94FCDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266970, "uuid": "d548ce09-ebe0-4ad8-9d72-40b8dfb5b247", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266970, "uuid": "f4d2c0d3-f5bc-46e2-ae28-8f7d2a14fb47", "value": "49152:Nr/3aZfa8Xvc2b8QC5YoM2GtGUA4zReZQTVc24PNYd0z8cgUYpvKc:liZi8fvdCdUASkQpcXNPgcgUYpvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675266970, "uuid": "00e1ca1a-b5fb-4e42-8a0e-52d84a5ad022", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675266970, "uuid": "549b323c-0bc6-4164-a316-e9ece5aa8897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675266970, "uuid": "ed4a353c-a018-44e9-b728-cbe2c15040dc", "value": "2a0e4fdc073c63e9fedbc104582d0343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9630c014-a255-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675272399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272399, "uuid": "38d925c4-006c-47c7-9472-bdf58e5e37e1", "comment": "Malware payload (Rhadamanthys)", "value": "58b466cd96d83528f269b326a71b242a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272399, "uuid": "22048bb2-d427-4973-95a4-21ad5cb00b0e", "comment": "Malware payload (Rhadamanthys)", "value": "edeecc89f12a014a702d92083107492dabf0ec3a0017bd8fc6aee6b21f605a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272399, "uuid": "87dfcd9f-1344-4add-8642-320f6d7b18fd", "comment": "Malware payload (Rhadamanthys)", "value": "c6853aec92856b05a3d4bbb82ba1e1590199b7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675272399, "uuid": "382443f9-39f8-40e2-a6aa-a1b8d138be9d", "comment": "Malware payload (Rhadamanthys)", "value": "f39a97fdb41c823941d81a1b98bb13bc0160ed8a98ae0a82f7888737f3c3eda3fb82ca5bbcdefe18fe1d2bdb8feb5459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272399, "uuid": "51160186-5fc2-49c6-a797-70893ebce366", "value": "T17A24D0B235D0C03FC57B50306C20E694BBBDB5308A35995BB7AC16AE5F702D126BE396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272399, "uuid": "14f70dc9-1a7d-495d-87e0-e870f1dc7d4c", "value": "a89584e4d2db1e57afffb93455aeedd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272399, "uuid": "f39b4f22-9523-4430-9641-7aafaabe3967", "value": "3072:jj3Cgvspld80LhyWUh5gj4jY7Cmfaq+lUktVa/k1HXCTgrlZS2fx:jj2przLhy5+/Wftt4/2XCTgrm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675272399, "uuid": "e74d947a-ee7e-48fd-a21d-84f526e5ae02", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675272399, "uuid": "e5aee5a4-567c-4ba4-a0e7-903782098deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675272399, "uuid": "43b300d1-c1e8-4838-a247-3cf796a7e0f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140c641b-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675267886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267886, "uuid": "e899c7c6-8d02-47bf-90c9-e6f9e623d7c1", "comment": "Malware payload (Smoke Loader)", "value": "1839af406a6969cf0eb6292cdab2ec0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267886, "uuid": "0f97d9bc-1561-4b1a-a1b0-c7014dbf328c", "comment": "Malware payload (Smoke Loader)", "value": "eedc74bfccb5930208c7ceedc1dc56d14123cdea6553bcf999aab011b6b1e4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267886, "uuid": "0c4414fa-12a0-47af-bb40-8560b25bdc72", "comment": "Malware payload (Smoke Loader)", "value": "170e0a7cdb66dc605c7b102503fdbfd01f8b666c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267886, "uuid": "cd9e8f46-2b06-4952-b260-df7fa5b1423f", "comment": "Malware payload (Smoke Loader)", "value": "a744d49f26fc2cd4262624540b4a20852de41db60d178aa878bab529db1dde7798560dbd4994d1863b26f4342ef427e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267886, "uuid": "f814e5b5-7bd3-4677-ac4e-5ee9574ec9ed", "value": "T1BB34CF2279D0C0B2C46F553C5C60EA95BB7EB8311935694BB7A81B7E5F302C1267A38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267886, "uuid": "b9568316-8479-4813-a4d0-c2e40c8cae5a", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267886, "uuid": "0c3a58e6-b275-4543-9ab4-c8f05a7b0e11", "value": "3072:ZmAGKutYuIBeLTOWcmT5zOMHvq+8BdGmyO1f95xA:ZmANxALTORmFOMS+8BdGmymVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267886, "uuid": "e9b61294-c1a2-4b9d-8d5a-e4b3578a2514", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267886, "uuid": "39e51a20-fa7e-4d1e-97ef-49c344c58559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267886, "uuid": "42830b57-9eaf-4ec5-81f7-e8a4af314845", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637fde3a-a285-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675292930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292930, "uuid": "e5e30790-9a26-4957-8809-f30d28d2727d", "comment": "Malware payload", "value": "4c3860c8860f2a1d192af688467e8dd9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292930, "uuid": "caf71196-7e89-4bf3-b7b7-c147bb1c96ec", "comment": "Malware payload", "value": "f101b1d5c944d9748e5676c0856876829fd81c04a76ea0ddc292e879bf40c0de", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292930, "uuid": "62ce3ca1-43fa-4f1f-918b-a9a9f8e448b0", "comment": "Malware payload", "value": "b4fa901287535717233a2c770e7056f12cdbbb5a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675292930, "uuid": "0ad17079-7c51-425d-9552-8b05e7708f23", "comment": "Malware payload", "value": "e15b9958deb1a368df770be2f8bc96de87856d0e3ae1d6ff11e180de1ca8e803c3b9d8df351492ed92bcbd46b6b425d4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292930, "uuid": "f46d03a1-7d3a-4626-80cd-0a41ac853a60", "value": "T13A363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292930, "uuid": "8b8743da-5ba6-4574-81c4-5471b83e4cdc", "value": "98304:Tv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXE:TvpvFa+g8RWLdPk/84tCEr0RtNiC5eSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675292930, "uuid": "b8dfe666-4791-4251-aaa9-abb4e308ae8e", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675292930, "uuid": "d7b3ed0b-b698-47d7-9e15-537ca17e3061", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675292930, "uuid": "b345758a-076b-4539-b1c6-893feeaf3dfe", "value": "f101b1d5c944d9748e5676c0856876829fd81c04a76ea0ddc292e879bf40c0de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24898f6b-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675262330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262330, "uuid": "f856389e-7bfd-406e-bccc-3d928285e714", "comment": "Malware payload (SnakeKeylogger)", "value": "119ce65d4a9e479cd494c1a6de72c586", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262330, "uuid": "d8018fc6-9346-460e-a3a8-29e5844f3402", "comment": "Malware payload (SnakeKeylogger)", "value": "f108a18c3b7eb3ba3a30f7535eca4e0a0a1901323052bea2156f67a9cb89788b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262330, "uuid": "5692229d-9f61-4bd7-ae5b-90c9fb4e37a1", "comment": "Malware payload (SnakeKeylogger)", "value": "812bc57420005036eca281e3210dc6827709c4e1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262330, "uuid": "ab06601e-4518-428c-b860-32db877660ce", "comment": "Malware payload (SnakeKeylogger)", "value": "ffc159b8dad68f886c2d3f0a61a0750cba6d60cc71d364e708adf8d2a7dcfa0abc86ccf2701f56091cd9b7f3e05c1de6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262330, "uuid": "a21ff15c-4ac4-43fc-b44a-aeb9a2adbf4b", "value": "T19113075AE38F0264CF952277131A0A8996FDB33EB35141B174AC937433EDC2E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262330, "uuid": "4cbdfab6-1d18-4799-9822-2327aafc85b3", "value": "768:GFx0XaIsnPRIa4fwJMY3l5KAnFeunXaPAdLNv+YF6pNxfwvtyrDwmfwt:Gf0Xvx3EMSKdu+i+YF6p7wFyrDb4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262330, "uuid": "5ed4c639-cce7-4121-8469-cb9f610a5d57", "value": 44522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262330, "uuid": "11461b08-1219-45a8-8dc6-b88d4162a790", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262330, "uuid": "d38284f5-48f0-48c6-a68d-13e03060e2fa", "value": "Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49401a69-a243-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675264539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264539, "uuid": "9f9b8172-1e6e-4806-bac6-e07d0b67030d", "comment": "Malware payload (GCleaner)", "value": "93c1ed8713e8d81e99cbc9be477a533e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264539, "uuid": "38e34d9f-3a65-458a-acf8-33f143f8edac", "comment": "Malware payload (GCleaner)", "value": "f16dceb0a4185b2c4b919aafbe5c2c5cda789491f7d4f8889acc54c35385228e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264539, "uuid": "a80944d2-4876-4648-b827-e8fce85f4eb5", "comment": "Malware payload (GCleaner)", "value": "c8964dd1fcadd16e2804c5aebf969a274fc4354f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264539, "uuid": "118b62c4-2eeb-4701-a43b-7fdd3ed1e89a", "comment": "Malware payload (GCleaner)", "value": "32b7bd8d47dfbc9937d57cb8ead88fe7b25c3bcc949a3c08d0bc59fe72da45804ff6e181e79cf325762ae50efc1a9018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264539, "uuid": "75351ea8-ee9e-4cf6-a36a-abbe02ecb8c3", "value": "T115A523577B2C8C36F0A249F82D22D2325EB3BEA56129C60564ED7C9F737A7529C0C361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264539, "uuid": "21a71f9d-1097-4e7f-aadc-36d34d164ba8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264539, "uuid": "1a0e280d-8116-4d43-9281-ae5f84809109", "value": "49152:icPLnQqsQMGZTDvnpZTxQksEYpRBTCMJTTAC/yWoBkBhkHhLCgv2MR:XPLnQW9bppKBeqTA2hktv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264539, "uuid": "70fc21c3-0cd4-40ae-ad73-6afbbcb1cc9b", "value": 2212479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264539, "uuid": "fa9f9afe-c76b-4cb6-8d4a-2efa5f941a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264539, "uuid": "04ab1bc3-9a29-4a66-8183-3d1d7292c113", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55e02fa-a250-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675270304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270304, "uuid": "175671cc-c2e1-4b02-b285-f3719218715d", "comment": "Malware payload", "value": "57072ca03b59b0fc66c0a62d8f99162b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270304, "uuid": "8072aa27-aa33-4652-90e2-b2ef4f7e8dce", "comment": "Malware payload", "value": "f207bfb319dbf63c592f7fcee92b85e2330247c3aed4aa1f61de8078d4de3e63", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270304, "uuid": "56821a0d-3788-453a-bf8c-bcc94ab06a1b", "comment": "Malware payload", "value": "f0e47b19480213721d3ce33ca78bcd879b5f8ea7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675270304, "uuid": "f7b13fd3-bdb6-486c-a310-622dfda2210c", "comment": "Malware payload", "value": "f601b9920da3ecea1bef6ff89b236aea6a15edd42b1c92b37e29f81362b0d789d8d6d2170a2f4db897a4d3b68d0d7987", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270304, "uuid": "d77425bc-5ecd-48af-b8a2-900613aaf1c2", "value": "T15176012275C5C233EA6F4334252ADB3B51F96EE0377380DB53D8962E0E759C09376A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270304, "uuid": "ad66c60a-1dae-4395-a5af-df489a185c51", "value": "98304:cYUMV39OAlAfwrtyB4veHjPMNa6LULFiCMrYwiIxip6/4QM8CV3lUe/aOHqAVI3I:HoYeH9M84YsD/UV+e/azl3jR/ItQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675270304, "uuid": "8e46296e-0212-4426-b40b-bdb9f46a14b3", "value": 7804928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675270304, "uuid": "dc0946c7-a5b2-4d4c-9d7b-51a2c64a9e39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675270304, "uuid": "a44a10a9-aee1-4dae-8b0e-feab4f5f845c", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.9140.26587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6847f5e-a209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675239892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239892, "uuid": "9391c9db-51c4-4f71-a679-28b34e2f11ac", "comment": "Malware payload (AgentTesla)", "value": "207f3d1b002d604ca2e230e9e5b5abe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239892, "uuid": "88d51362-5fc6-459c-81ad-564ed71dfe19", "comment": "Malware payload (AgentTesla)", "value": "f23e3fb55ed796ffce910533d5e6886e4c84d22195054c16540baf515b0113c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239892, "uuid": "3c984cf3-d679-47cf-b055-7a98ecca3d98", "comment": "Malware payload (AgentTesla)", "value": "79a0fb5d85331fe8ab6e0c4ef6ac4416a3954d75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675239892, "uuid": "47a7929b-389e-48fb-b493-d80016bfa92e", "comment": "Malware payload (AgentTesla)", "value": "29c8310aa43ad6b88af92a51759a727b0cb4d31e7796e2b297eb70ca19c702888e5f4860d5bbb2a068ece50245d38b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239892, "uuid": "286d3e3d-ce59-4b0d-bac3-a466e2bc8600", "value": "T1AE0501E2528A0664E82F5EB8D331AE64913FFE7A7D9EF5443E58B08673732C53121613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239892, "uuid": "fa664945-98af-4896-b7b7-b3252126a389", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239892, "uuid": "8397cc5f-43bf-45fe-8d07-23a90de495cf", "value": "12288:FnzVG9SEfrQ8hFz5JTQCaosJ584ENRu67fr8z9i7+pvfCWtOMnW:FnpGLhP1JEV85mUfr8zw6RKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675239892, "uuid": "a42c994f-feb9-4e01-a93a-71d9d432a60d", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675239892, "uuid": "7222fe6e-1e01-44e0-a4b5-3d173eb42366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675239892, "uuid": "37b8390a-cace-4026-a9cc-65dc87c426ac", "value": "Payment Receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c54085-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267160, "uuid": "0f9ded27-c70b-4545-bf9e-b56f0051788a", "comment": "Malware payload", "value": "6c15c7029783f0346c38ae0bbc05a841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267160, "uuid": "590b086d-87a0-4a94-9814-de11f01ca5c4", "comment": "Malware payload", "value": "f24ef9d438c83af3a2b6d5499269b56996145bf8ca5c033f2706e236db00dfeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267160, "uuid": "9a47e4eb-4eb8-44ee-98da-470ae57facbe", "comment": "Malware payload", "value": "4e83201b3781b180694399dec65870142f2fc510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267160, "uuid": "b12fd902-8c48-43be-b74c-d1d2e16f847d", "comment": "Malware payload", "value": "9dcb29c0c7f43b13e5c000c5f16e76878a6478e3246cbf40482a79b3525a789389b5d53fdf55d1cf12771a54728574ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267160, "uuid": "a196300a-5e7c-42b9-ad2f-227fe2231230", "value": "T19CC1DC415FEE50DAF22B07701BEAB37B1266F4B1552E62BC30444A585F31AC0C862EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267160, "uuid": "c53b8d21-69e1-48f5-9d5a-0252c22a8655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267160, "uuid": "2968dcbd-8c7d-4b4e-af9f-77bbf6697172", "value": "96:Trr79RQCFnAlpUqTQ6t9NtUqzQvLvud3ojz91rl:TT9RTFSUqTBPNtUqzSudsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267160, "uuid": "a6d8f02e-ff47-4e8d-90f0-4dbe67b26a06", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267160, "uuid": "1fb4f9fa-1870-4194-90fb-23919b85766c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267160, "uuid": "82476217-e8e4-4a6e-833d-57ecf951b5be", "value": "6c15c7029783f0346c38ae0bbc05a841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6541c3bc-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267163, "uuid": "85e495de-5296-4ff8-9326-faff5a8edf4d", "comment": "Malware payload", "value": "ca08a1dbba4869f7aae7b6796d7f82a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267163, "uuid": "e280efa3-1253-473d-ab70-6072dcd8fe34", "comment": "Malware payload", "value": "f3276b6406cda3007ac47fa24f240118680df7244e745c3c73cfacc2a9028ead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267163, "uuid": "767acdab-5c5d-44ab-a5cd-6975ce281bb1", "comment": "Malware payload", "value": "db0f37c475147520a9765826d36a326260f1c54b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267163, "uuid": "d7fb8f97-9e51-4232-abfe-bbda2ae9d45e", "comment": "Malware payload", "value": "8d062eb826f74900706480b5683409bdc8dc8043dfe50eb781f4fdde867898fff8151fa841767be80b2a4ef15c6bccd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267163, "uuid": "246f54d6-89be-48c5-b06d-e1145d11759f", "value": "T17CC1ED115BEE50DAF22707306BE7B7BB1566E8B1452E61BC70944A5C5F30A808C21FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267163, "uuid": "9cbcb538-fef5-4936-a233-c23752472cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267163, "uuid": "6a88f3a5-2729-439e-a139-a2079923345d", "value": "96:ESg479DCL1bhycQmaDlcLpwUq7vlAYNsVvk+F7tYsgd3ojJIrl:au9DCL1bhycbolcOUq7+Yqvkjldl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267163, "uuid": "48450022-0427-48a1-bb52-25fa2b29a3ed", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267163, "uuid": "fa6ba90d-9f6c-4972-825d-61332f189758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267163, "uuid": "c0586de4-f2f0-4553-be87-b96be0108103", "value": "ca08a1dbba4869f7aae7b6796d7f82a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3910baf3-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675267089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267089, "uuid": "9b5c538c-7274-4503-b4b2-3e4c67c1152d", "comment": "Malware payload (PureCrypter)", "value": "e453ee4e1a1a3c97ebab67171893ae7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267089, "uuid": "e6b2d90f-7adc-4850-a05c-13a3cd4f9e8e", "comment": "Malware payload (PureCrypter)", "value": "f33f2b0823a6b41f1632f5d19ebe4d144375781702b3f7b544c6321937f28161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267089, "uuid": "901c0221-7047-45bc-927c-b83d6a704975", "comment": "Malware payload (PureCrypter)", "value": "b4c24de8784bb530d549ed1df3716f2640e52d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267089, "uuid": "c206f035-f460-44c2-baca-0fa0fa02f007", "comment": "Malware payload (PureCrypter)", "value": "a84bca16bcd4337fb0f6439088f62da1920dbc2a9e29cc34ac7010768c49aaefddf754a1fbb8e228ee709129d8f5a708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267089, "uuid": "e02aeff5-dce9-44a1-a2bd-e7429c76d2bf", "value": "T181C5AFB3F7295E65E83E88367948E002817A2D3159524D1FE8F4F58A76272E37EE3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267089, "uuid": "4371ee2e-9236-43d4-b47a-dde067b6d4fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267089, "uuid": "656d5d72-a6fb-4178-a610-6cbc0f1d2153", "value": "49152:bRPs+XkKb9mSewZPhGDcUovKdd+hHHafaQG0:dPD/tFKdd+ZafaZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267089, "uuid": "a9c85449-7c22-4791-9c80-9b3af9e3464b", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267089, "uuid": "41fad5f9-3861-4699-8229-6f389a89d564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267089, "uuid": "5e781b05-4bd4-4a20-b1d5-297a8d11472b", "value": "e453ee4e1a1a3c97ebab67171893ae7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09d0ff5-a23c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675261760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261760, "uuid": "63c190a4-75fd-4c8c-bbcf-a365a95178d1", "comment": "Malware payload (SnakeKeylogger)", "value": "e3b5082079385dd845858497571af27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261760, "uuid": "bc793084-523f-4f2a-a754-0d9f81a3790a", "comment": "Malware payload (SnakeKeylogger)", "value": "f3b007849f67bec665e7d2055762802fd0d87fb1020fb7a2459306109c6ccf4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261760, "uuid": "ffe728fa-900b-49da-a807-123f59103677", "comment": "Malware payload (SnakeKeylogger)", "value": "2f8255b3f7b796d596352bb93d71febcfa79b44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675261760, "uuid": "a1c2ce63-73a1-479d-b66e-f256ee58b0e6", "comment": "Malware payload (SnakeKeylogger)", "value": "7f1f3a24720d56b2e5f885db4c025357b52923217ef5a97522a229d92e68c2e9ee3065bda8189769a5838959d0c27fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261760, "uuid": "bdc21437-bf92-49c0-a050-fc292b8ff720", "value": "T159441224BE74C1E3E5B646707E396271AEB9EA0230F4471B57018F5D7E723A2E51E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261760, "uuid": "07243fec-714e-48bb-b03c-2c188e000d7c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261760, "uuid": "30812111-56b0-4f50-b66c-fb2de711b747", "value": "6144:vYa6f3iwk2eOJuVDgISMLAcvfB+yDc8OeUhGqIs2riaw1BW:vYd3XkzfQM3J+ILOFGqI/iaw1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675261760, "uuid": "8758adb4-d0de-466d-9721-8b7a7c888801", "value": 268866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675261760, "uuid": "c9a87d93-820b-4f0e-9396-3749e311fb76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675261760, "uuid": "dd134573-2cee-460f-8f0e-1496f9718754", "value": "FSG04345678909876789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc82a041-a238-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675260115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260115, "uuid": "0f6a57b6-5126-46ae-a48e-1cff4a2244db", "comment": "Malware payload (TeamBot)", "value": "0a5714f29cd899212c5bf90e07ada490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260115, "uuid": "c4fc1e58-0dc4-401a-a2be-68f03e63e943", "comment": "Malware payload (TeamBot)", "value": "f3fd9667dfa6fb87489204b2b646eba80ab1daba0ba2ad7447a2bf73b5eaa2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260115, "uuid": "e8c21a34-9903-4950-9a44-df864d8a1114", "comment": "Malware payload (TeamBot)", "value": "6d96f6b443629d0099d05c44028fc67eb19eea90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675260115, "uuid": "aebb2a27-7aef-4772-af44-78cd824fa67c", "comment": "Malware payload (TeamBot)", "value": "1351613644da64db025f18fb9a3820e6807d988ec9638d4d5cca4824557da431b2000716da031b86d70053096129c1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260115, "uuid": "cf3a4c02-c24e-4a87-8989-3639e22dda56", "value": "T16834DF327590C072C1A61D305C24EB91BBBFA93169759957FBA81B7E9F302D0633A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260115, "uuid": "c72d2797-2efb-4c12-912a-0368353ad9f2", "value": "d01c6281454d353a6df0a9c31baea59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260115, "uuid": "c6127dba-4c72-4119-9d19-6842c77e3963", "value": "3072:imzGtSQBoD+FuL0+Wsl95z1L0Pv1VMrcfbuZRHpS53vonsbF5Ac:imzJ68L0+9lR21Qc485Qn2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675260115, "uuid": "6e257d90-0533-4860-84ad-0b1930f2e30a", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675260115, "uuid": "80c13c40-e816-4cab-80ad-e4e098201c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675260115, "uuid": "781c2ce1-02a1-406d-a77c-d69ea849f8e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e07da30-a267-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675280062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280062, "uuid": "cacf769d-052e-4596-a6cf-d6d848f17572", "comment": "Malware payload", "value": "ad309a13f935f685cc0809af99c198e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280062, "uuid": "046d5eab-e2a9-41ac-8efe-5779034ba7c5", "comment": "Malware payload", "value": "f44026b4e831c9297565ce9477c49859f0fe3a2e99a7ebe50abafcf1ec99487a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280062, "uuid": "ee1a7db8-810e-48f3-a091-731ff6dcd224", "comment": "Malware payload", "value": "77bce6bf562cdfeb9d970f39acb5d3f93cb18a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675280062, "uuid": "0591511b-2c7c-4ee1-afaf-908e22e7cb77", "comment": "Malware payload", "value": "e2cbd02ffaab4f311dac8b7040de05769e2d6319eebebabc14ec0c38958e5014ab91ec8bcb6eb1ba3e0abec4ad21f026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280062, "uuid": "cf5e7e38-86be-4781-adc7-0d6ca1a06698", "value": "T1F976330B36306592CD3E32B446D5B00A6BB01A93C4A50AD62AC7B51C42D77EFFBDDE25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280062, "uuid": "a80175a0-0121-4d0d-aedb-4c052816caa2", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280062, "uuid": "e7c7b3c1-fd3a-4725-944b-c52d81b81920", "value": "98304:QR8l/ckDXTyRrZlTBDd+RNb4dwJcQWURSHDCccR5ZwbRQ9jNKgh6jc6boj1HD:Q2+VZzdukdbQlRSjCcc76RWKUzYojJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675280062, "uuid": "dc925858-eb15-4cc7-97d7-c72c39313d4b", "value": 7138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675280062, "uuid": "fc049a8a-5dd8-4a6d-88c8-fe361da6280c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675280062, "uuid": "a54e221a-2307-444e-b519-53f16a5e00af", "value": "ad309a13f935f685cc0809af99c198e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11268623-a243-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675264445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264445, "uuid": "07e39026-f4e8-40a5-9922-71e56c62e849", "comment": "Malware payload (RedLineStealer)", "value": "acf54cfad4852b63202ba4b97effdd9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264445, "uuid": "f62ad8ba-2d98-4d80-982b-dc61c6435ff1", "comment": "Malware payload (RedLineStealer)", "value": "f4bfa9f592a953ba496c92d14b1ef1698ada62b9cb547e6a0843ced061fb6e8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264445, "uuid": "dbc48266-739f-4d66-ae3b-2110ea5282cc", "comment": "Malware payload (RedLineStealer)", "value": "cc7456e4b78957fc2d013cec39b30ea7ed8dbaa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264445, "uuid": "84af6992-96fd-4ce4-90bb-ca81e8fa91ce", "comment": "Malware payload (RedLineStealer)", "value": "bca680c2516ab0c563248923453c478c085b417c790b4b356dad3e7018e560d7f70a339dfb5d5114ca6ed50db3d38175", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264445, "uuid": "bfb77c56-8455-4e3a-b757-d78209ef1ecb", "value": "T13404C51437FCCD11E1BA1A3F6961A05186BF9802A852F35B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264445, "uuid": "7663bcd4-a631-4f3e-a972-750aacbb37bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264445, "uuid": "fa2825c2-0232-4aab-9be1-4d9065e4f847", "value": "3072:0xqZWTHaJIppU4LFca4devt9ThVTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOi:KqZH4LFcxUTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264445, "uuid": "872aec5b-5fb5-4ef5-b0f4-c3cc1a845c2f", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264445, "uuid": "1ba2b51f-52bc-41dd-8fd3-6cae165ee155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264445, "uuid": "9e09dc20-3b3d-491c-83e3-5bdd52d2723f", "value": "acf54cfad4852b63202ba4b97effdd9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52d7ab4-a23f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675263029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263029, "uuid": "412ba406-37fe-4d42-b341-f3edbbaaf5e9", "comment": "Malware payload (DCRat)", "value": "458572c88677fb8604b4628d451adbba", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263029, "uuid": "eda3f5b1-a090-4faa-9ad7-108ae8817987", "comment": "Malware payload (DCRat)", "value": "f4d2a5c70bef00bc9eda121795152366650bb517bd9411fdaf27d90055db6ddb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263029, "uuid": "bbda9465-3f51-4ccc-8af8-f6a26e7b8386", "comment": "Malware payload (DCRat)", "value": "5af9fbc7e0541b288b839ed72b83e492939bf351", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263029, "uuid": "13a148d1-1bdc-49b8-b6f3-db2e630b35c7", "comment": "Malware payload (DCRat)", "value": "06fe6daf724fcf4364c3221423cd93aebb587bf1dc17a109ba142af9e43540f3fbfdecd337e8c87ffcafbb630aee86b1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263029, "uuid": "78f2a6f4-a663-4855-9655-96003c26f9c9", "value": "T12CC5338BA2A57162D0B7C37049E146C39931BE601B9449FF12AFC6B9DA377F43136E42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263029, "uuid": "4b8e1662-de2a-4cd1-b19c-d4b86ad2b569", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263029, "uuid": "a69fff7b-1121-4007-aed3-3d14401c49c3", "value": "49152:cP8AFQKReWGfdyHnOhGyUAzN3zIelmX9xZx1Dn8eiJ7iyDZj+oD:Q8AFQKefcuhGHwPluDn8tFiEj+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263029, "uuid": "912e992f-988b-4aea-99c3-09584075418e", "value": 2597376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263029, "uuid": "2d1d2b38-9abf-41f9-86fd-7b8e51998bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263029, "uuid": "adc8fd85-6bbd-4a6b-84c9-95d1cb714347", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-f4d2a5c70bef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9412b231-a1dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675220426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675220426, "uuid": "21020d44-02b1-476c-b71e-0a1f5d80aa4a", "comment": "Malware payload (RedLineStealer)", "value": "b414b961c18b744dd00be5e31d0608bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675220426, "uuid": "f2e901e1-4e2d-4a92-86bd-70bf340a3e43", "comment": "Malware payload (RedLineStealer)", "value": "f57091890ef159b25852de7ebdad726e0e33f5579a7d0950dd119eb8a8f7d83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675220426, "uuid": "b44f1ef6-989b-4ee5-9eb1-d28ebb43e98f", "comment": "Malware payload (RedLineStealer)", "value": "7569aeb22e656926a96de115b54f4a7f68a3f279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675220426, "uuid": "ff1e2822-0bf4-46ca-9acc-1e5f3911cded", "comment": "Malware payload (RedLineStealer)", "value": "03514c360b3924c0ef78f2ab6234e68894375b8012b04aaedec6f8e04bc34319361768b896904183b5697b05a67e7816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675220426, "uuid": "b716a43c-ae39-4b4d-a6b0-6583a2d0ae8c", "value": "T13DB50AE47F1626CBE84C90BCAAE2EA05C6044673D11484D9ED5F3C33B85AF57258CFA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675220426, "uuid": "f4deb7b5-21c8-4f05-b34f-df71dfd85549", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675220426, "uuid": "60be89b1-87e6-4da0-b7fc-843b8c4f16c3", "value": "24576:vJdHGI8AVu0Ai5XJhJSbz2ux98tOn0ceJoHnbsIR6dKz4RyV5fPePCR3WILlI3Px:BBGSwWi3WILSu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675220426, "uuid": "f64594bf-fb1c-45ee-af51-b071ce90c736", "value": 2354704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675220426, "uuid": "6d0e486b-7cf1-4999-b8e7-653a34bbcce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675220426, "uuid": "793748e8-0ae7-49ee-b641-135c9b23ce62", "value": "b414b961c18b744dd00be5e31d0608bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230a8a43-a245-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675265334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265334, "uuid": "4a102e90-8aac-4087-9ddc-71d3ab267056", "comment": "Malware payload", "value": "456848de9f87723b82147547facf6b07", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265334, "uuid": "7ab52c3b-52d9-483b-9be2-143aeafc6f65", "comment": "Malware payload", "value": "f61e6c906ba6429321dc8c1e8f89a6fd295cd4ee8bd21d394dd1679e226d4f3b", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265334, "uuid": "19a75aeb-499c-4f92-8476-8b288ca42dc9", "comment": "Malware payload", "value": "78e653be3f88694c80bbb864c6ac0936bed90b76", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675265334, "uuid": "c997cf78-1289-490e-ad3e-42d47eb734c4", "comment": "Malware payload", "value": "d634b2ce2577f57d83264dec8b3f7de6afabf33ac9aa24d9473c64eed94506fc7195d7979ef74b48c12e5e0ee516699a", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265334, "uuid": "f6d43e97-d7af-4c84-93e9-6b4ef240d7b4", "value": "T17404E11226F545E5DEE47BB24DA3971DAA2BBE27E212035F4BB56A2D8D60310DC0470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265334, "uuid": "06a4ef8e-940f-455b-8c79-d25811dcc771", "value": "3072:iaA0YRw9/WITtTWR7IbNzvL1aSbYCuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCC6:Ia9xytedL1fEw4iERB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675265334, "uuid": "66aad562-f288-4c87-91d6-a9cc0667243d", "value": 176243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675265334, "uuid": "9efec59c-da30-4a6c-8135-4b6e30f3d0a9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675265334, "uuid": "17769425-38d4-4a04-b328-908057cea36a", "value": "ComplaintCopy_47292(Feb01).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e70a8d-a272-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675284753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675284753, "uuid": "e22a0d3d-c4c7-46c5-973c-d2d379429104", "comment": "Malware payload (Mirai)", "value": "039d17f061bf87a3a01f9c15b431f916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675284753, "uuid": "0e765b10-0d2a-4239-a152-b9d56399d7f3", "comment": "Malware payload (Mirai)", "value": "f65fb40e8aa071ed3bd5456126815d60bc3afd2e18944edc1e5fcf2ea6477429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675284753, "uuid": "f6c32852-8b5c-4dfe-98db-6faf0e593f56", "comment": "Malware payload (Mirai)", "value": "f16e973723bbc3c6bad8f2dd293cf053c80958d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675284753, "uuid": "897273b0-1b45-4136-ac30-cb73da360bc6", "comment": "Malware payload (Mirai)", "value": "aa51c60949ffd0ea9a5fdd7f078089243586a51bfe7f445c1cd40654648da80848926b25f6721a8c959bdbe463b504e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675284753, "uuid": "e9f5d795-63b7-4705-85ea-2b1b77c2cdfe", "value": "T1A963E81A2A219FEDF75D873547B38E70A248339622E1C240E55CDA016EB074E746FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675284753, "uuid": "289da6c5-e25b-4db3-8122-cb4ba056078d", "value": "1536:jD40LjqgBlSYD8UpsBMjT+lXZOuGrxepcbg:jJLjtBlSYD87BeEzGrUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675284753, "uuid": "4594c998-e4ec-4393-a751-5a751301b83e", "value": 72268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675284753, "uuid": "a66631eb-e2ec-4587-b969-a57484e44e81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675284753, "uuid": "82833479-5ab3-4ccc-ba6b-c7aab59a0599", "value": "039d17f061bf87a3a01f9c15b431f916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4652d9b-a265-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675279375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279375, "uuid": "72a0e20f-c835-43a9-8ca0-a866e8b4e4ae", "comment": "Malware payload (SnakeKeylogger)", "value": "88c4672051179b69d528a807f5944b3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279375, "uuid": "ea396d17-3275-42d5-9cba-c104f067f3d2", "comment": "Malware payload (SnakeKeylogger)", "value": "f6acf4d217145bc4c53e7e9b17046134b2afc502ba7ef0b7cd96d165b1602c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279375, "uuid": "def5abea-fefc-46df-ae36-a9b5ce3d73d1", "comment": "Malware payload (SnakeKeylogger)", "value": "7b0008e74ca576c7ba246f967dbbdd89275fe4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675279375, "uuid": "ff802b71-887d-43cd-ab0b-6339ac4ce0bb", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea50946584523d8ac5b9ea8022222dc519d9f30dbe136a311abb9c18d41ea3c0cf488b76a086f1eb60dfd2fb7bfb71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279375, "uuid": "debf7ef8-691d-4bff-a7b4-8552ad15906a", "value": "T1B8E47C8777B19872FACB10A5142837CD2FE0B103BE95E267AB7B79C097058FB7698141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279375, "uuid": "b45ab9a1-3d84-4f9a-a9a2-24e2024c1323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279375, "uuid": "3009344d-80b3-4772-92dc-5c50a1032ee8", "value": "12288:1tz8L6guT42Feg33IhrcKZtULPpal+jxnag7Y7xMRSR5SAqG4yPa:ILb2YaIFcstULPpRjV7QyRU5JqG4yPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675279375, "uuid": "6ab394ab-6cb5-4393-ab69-0aa20fcf38d4", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675279375, "uuid": "78f6bd11-d238-4a11-a8a7-72147321c29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675279375, "uuid": "6509d3a4-70e8-48c3-927c-88f4fb30ed6d", "value": "Paymentinvoice Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5232a8-a200-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675235664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675235664, "uuid": "0770d078-36d3-4c63-9434-9bad2c95171c", "comment": "Malware payload (Smoke Loader)", "value": "d76daaccac1ee459969e2161809b1875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675235664, "uuid": "00eb31b4-d924-41e9-b6cd-8c7b8ac66a13", "comment": "Malware payload (Smoke Loader)", "value": "f7b2f75077529c52682a30665d0e154306d96f5176faafc05e06741a10e9ee42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675235664, "uuid": "4da21ba4-03c5-44a4-af50-a53093a21dd7", "comment": "Malware payload (Smoke Loader)", "value": "f23dcfa3df2c3463e23d22ae7c37cdb11566068c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675235664, "uuid": "2f1eb79b-deb9-458a-9af3-342b30e08333", "comment": "Malware payload (Smoke Loader)", "value": "c2d3ae39327f068a6ce6ef6f7751c20c8ac0d5c25cec996aeeaff805cd6ebf7293886da243521744a2895af2901ca15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675235664, "uuid": "ffec5944-ef5c-490c-9eb6-f25496b281be", "value": "T18034D0227990CD33C8E650344830D6957BBEB431597BA45777D82AADBF706E0633A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675235664, "uuid": "dc2f76e9-4fed-4ade-86a8-52de0787d9c9", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675235664, "uuid": "a2c6f41e-fdeb-47f9-bff0-40898fc6bdd2", "value": "3072:HW8Gip614tEx4McL4ipW9cL5P8yKS1fLKw2GsStrnhLU9tBt+SU:HW8w+ExcLhpDNYhLYBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675235664, "uuid": "7a58b1cc-1ded-43d0-9cd8-cfeefb4158e5", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675235664, "uuid": "de0720f4-ba26-487c-8d6d-15ba5f0b4f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675235664, "uuid": "da7c6cf1-96d1-4a1e-9c77-dda12c7b539f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cb2ccb-a1fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675233212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233212, "uuid": "626d730b-7495-4e88-9189-10c4f9d2755d", "comment": "Malware payload (Smoke Loader)", "value": "02510c07c0ab1f6099280c9cebcf645a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233212, "uuid": "426539bc-2ae2-4db9-8e73-107a7631a2e7", "comment": "Malware payload (Smoke Loader)", "value": "f8280593a2b0675b0cf5ab201457706593cc5fb6c6c789632825e578db8acd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233212, "uuid": "c42e1f1a-b9d2-43d9-bc27-b37694148146", "comment": "Malware payload (Smoke Loader)", "value": "9012536f8919558e35b1a07954e5796cf09faba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675233212, "uuid": "191b9677-7d21-413c-8403-a48604cc220a", "comment": "Malware payload (Smoke Loader)", "value": "c3d22ae674a5ffdfbfe4bcf26b17720a47b000db37d8f2c470b8d5c9acd80f6d20417cffab4d41a084d05d2eef2b001a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233212, "uuid": "2cf9869f-6753-429f-ba5b-e651a95dda57", "value": "T16914E021BA92D073D55B50705830DBE53FBFB4321EB9459B33A40ABE9FA07D09B26306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233212, "uuid": "4b55f4d5-e47b-4f5c-a2fe-04eec9d44196", "value": "9c1a4a6c7fc0c3ab02a26e7bf3b91fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233212, "uuid": "0f2c0f84-93d2-4e80-bd51-e58496179af3", "value": "3072:0XEzw8o0JRXI4OBlH05haQl81X940x+hQhYKzA0Any2CPa:w98poBlHMaQlM94Fmsjy2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675233212, "uuid": "d3183e79-4a7e-454a-8a68-fce20b06d398", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675233212, "uuid": "51bcca8f-0c0a-421f-8180-c477e59a244a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675233212, "uuid": "851365b3-ac79-41d0-9465-2fdaae9c0b94", "value": "f8280593a2b0675b0cf5ab201457706593cc5fb6c6c789632825e578db8acd50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f32c524-a20b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675240497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240497, "uuid": "ff851174-31a3-425e-8eda-fb37e0044b65", "comment": "Malware payload (Rhadamanthys)", "value": "076a277a182cd9a0a322349ccac432e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240497, "uuid": "c5efa645-11e5-4ec0-adc2-d0c44c24e37b", "comment": "Malware payload (Rhadamanthys)", "value": "f93b85ca07f0392ab1516a34b157e175936e45b31773d1dce409b7e4872a8946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240497, "uuid": "33068204-3a71-45a8-ad8e-b5f99f4c79d2", "comment": "Malware payload (Rhadamanthys)", "value": "eff767dbeb2d905d1e4009605e91319bf17c01df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675240497, "uuid": "1386f2ba-a324-4eeb-aaaf-8ddde1de68df", "comment": "Malware payload (Rhadamanthys)", "value": "111dd90f074b42008d366a39e421dc4a4a34defc978b842cb9d14e34f613d49c88b041dfcb6dfddb339dbc20ae09e498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240497, "uuid": "bc65cd64-6cb7-4d9e-9050-4e062ba65015", "value": "T1A434D0327AD0C072C5A640709870E6A57BBEF4315979984B7BA81BBD1F307D16B3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240497, "uuid": "5588db0e-e86d-445f-87e4-8461dbda6285", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240497, "uuid": "f7d8de90-74ab-4a12-ab36-acf7dd46607f", "value": "3072:0WEGMOHw3PpgVLZAW6F5Se4n1BrQY5/WRXeBmo10aZ4MESvG0hZ:0WEz/pGLZAXKeGQYVWhfoaaZmSu0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675240497, "uuid": "01ff06ab-c149-42ce-a2c8-922e5bc1e42a", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675240497, "uuid": "2d614e39-c869-4dcf-b27d-f9ec4c2ea6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675240497, "uuid": "c51af7a8-6474-4ee0-906e-25dd6f61eec5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a989a227-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675264271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264271, "uuid": "d72d4497-82d3-4044-9e71-0979a2520a38", "comment": "Malware payload (AgentTesla)", "value": "ddc295155087470963369c0372b77c6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264271, "uuid": "5dd3c8d8-6cfb-4e98-84da-6d7e854302cb", "comment": "Malware payload (AgentTesla)", "value": "f98bbd52d7dcc0a3bebcc97a3cac39cd453aae870a751908e7fd94f81b4e8eba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264271, "uuid": "90e78177-de88-4e40-897b-a3d07dc22bef", "comment": "Malware payload (AgentTesla)", "value": "5b2906fe3b648cfb5001a01dfd3ff1c7ea54ee5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264271, "uuid": "b5067221-b218-411d-bd51-69aaef9c87f2", "comment": "Malware payload (AgentTesla)", "value": "feee44cfad16e6e8d9241280378e3acba3d6d032434605b6f57beb7464e07977af2659356a14ab945a204e060f0438e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264271, "uuid": "be87241b-121c-44f0-b856-fed1ff86736f", "value": "T17F055B8137F19462F1DB05B91028768C2E3D7443A6E6D2665BBB39C49703AF7F298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264271, "uuid": "1bbb4c12-f2a6-4297-b8c4-9fbaa296bd4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264271, "uuid": "e5a8d2d9-470d-4803-b3d3-f552b0f78c1b", "value": "24576:gelaKRi5Oeto9DD1dn5Cb1WpWhUr8zw6Rpc4N34:gBuGopWhUr8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264271, "uuid": "5e109bf1-3313-4474-a0bc-4acabe6b1d07", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264271, "uuid": "b998c242-a2a8-4ec0-ace1-b071c779b767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264271, "uuid": "7f266652-052d-4ebe-9bee-1d511188a5ac", "value": "FedEx Invoice_2341741712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958866fc-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675263378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263378, "uuid": "dfe37851-8fb0-4ceb-8c17-9f44bbe9ed48", "comment": "Malware payload", "value": "2415802a0d02b9e6c3977b8d6a1b59fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263378, "uuid": "f2ccde9a-803a-4be4-9877-764cc31b4afd", "comment": "Malware payload", "value": "f9bd1253246788e34e49031cc526a5d79ea4a9052b48ad22a2b1638a7d00fb82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263378, "uuid": "3786fcf3-e885-4963-bc4e-87d759e4a7e3", "comment": "Malware payload", "value": "9d46dbce7c9799e0620084f03dbcf44d3feae989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263378, "uuid": "c71595f3-70c1-4fb7-a094-ad9497ecb5a4", "comment": "Malware payload", "value": "bf46ff4b07a5adee734b080b2fd96e0f623fbca4fb7f3fb70d142f7254d962090b30b7c5f6f30e0ce7c672c30d2f32b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263378, "uuid": "d5475155-526f-4cb6-9810-de33fb8b455f", "value": "T118853308F6E09877E90B0A37BA04F671E91948730635614FFBD4294E9BF21C5F299793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263378, "uuid": "e95a7ce1-187e-40a2-9eae-262096af7120", "value": "2e8b3dc3bab93b5d4f978cd02983172a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263378, "uuid": "bbee5c66-6ea9-4c2c-877c-ae726f6d872a", "value": "49152:8aiH1hPGKtpEjJQ29iLccnR3m136d3bD:8ayPGKtpE+zmAd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263378, "uuid": "fb400af3-20b8-4db4-b610-9d29d094b2a3", "value": 1841152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263378, "uuid": "c612570c-0013-4b9f-b921-09c32c7f7efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263378, "uuid": "2e2fbdc2-1a6f-4e68-be97-60da7e37fc57", "value": "2415802a0d02b9e6c3977b8d6a1b59fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917660f0-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675264231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264231, "uuid": "380b4fa2-fd7a-4d0c-a3c8-6738f5038120", "comment": "Malware payload (Formbook)", "value": "6593450ea57d8a11affe9e5360d12587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264231, "uuid": "0aba3516-37e2-47e9-ad0a-14dac7638667", "comment": "Malware payload (Formbook)", "value": "f9d55b9da595432539830f1dc35cd8be32668d9eed89ea051fedbfd82e6ab1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264231, "uuid": "3696be6e-c116-4b2b-9c19-b134518d08c4", "comment": "Malware payload (Formbook)", "value": "cedf611ef39140922eb504d884ee74dfe126ad06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264231, "uuid": "4b6eafb7-1053-4981-8639-8f5ce82d5044", "comment": "Malware payload (Formbook)", "value": "17ec8f626d59b55112c44e0f9c6291f55ef1b00eb59990d6e41440d63658b45be4f0b68e233d2f93e50b8bbf68c33682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264231, "uuid": "3228da29-5440-4401-be8b-f1892f1773fc", "value": "T1FF4413297BD994C6CD4E2930884342481B716DFE78CBE10CB5DDBA2C1C727EA5B2DA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264231, "uuid": "9fe3a1bf-5600-4265-95de-36f7769fbe97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264231, "uuid": "ea8b8451-b533-48c8-9147-22136c119145", "value": "6144:RpvR3Kf+c+iURa29P24nrFgpQREqLr4KroUNGf:Bw+0329+GFCrGk2od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264231, "uuid": "32ceabe3-be1c-4090-af52-1a85ca207f54", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264231, "uuid": "10d37f11-b8e1-4074-bb81-8d1faa3b6c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264231, "uuid": "a066f47c-cf40-4355-af2d-f9cbd71a2cc9", "value": "Halkbank_Ekstre_20230201.pdf.exe.exe.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a2b39-a22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1675256102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256102, "uuid": "ca7e216d-caee-4037-adbc-fbfc6674d823", "comment": "Malware payload (RaccoonStealer)", "value": "6aa08ecdc7cd59c8648450c3556141aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256102, "uuid": "fcf7eade-3aed-47ec-8c65-a748a6270753", "comment": "Malware payload (RaccoonStealer)", "value": "fa870c075ddfcb7dae0700dcccae2d5e3aeb89ac52837ca4ec82cafdaa157e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256102, "uuid": "bc6c5c7e-1352-45dc-8392-8b6f41de3535", "comment": "Malware payload (RaccoonStealer)", "value": "0dd55820631f09f4216d53c5bbf2ced5f5a57d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675256102, "uuid": "149dbf76-6e24-440c-9c20-09bc560f1733", "comment": "Malware payload (RaccoonStealer)", "value": "f5b44d4a47aad91dfe76568e0647f4c49222f6c910c01e37c64c2bf60678f3c8a5b6adb384ea33ea8765ff7cdbc3a686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256102, "uuid": "8e33beab-051a-49b8-8f69-2ebfd2b42c11", "value": "T11634DF323590C033C5BB15705C60EAA57BBEB4317978895B77A81ABE5F702E0673A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256102, "uuid": "005d4a48-b259-4cff-82ca-1c3459aa55d4", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256102, "uuid": "99eb2f40-020f-43e6-af38-02fa75f1bb11", "value": "6144:xWBo7TuFLrRwBRvPreD3L7bxNgfZOAeY4H:xWUaFXRwvHreD7xCwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675256102, "uuid": "9c889f1f-ae37-40e2-a086-f32764ccc35d", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675256102, "uuid": "ab67d65e-2396-41e4-bc8d-fbde1f0e699e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675256102, "uuid": "27aa43cc-1dce-4253-ae30-a10a3dd82a1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4a7d94-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675268138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268138, "uuid": "7fc5592a-001c-4f7e-a2fb-bf3d3cfa88ae", "comment": "Malware payload (PureCrypter)", "value": "206115e1488682cfc64176f95462e76b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268138, "uuid": "84be7ed4-7644-4d61-b420-fd007026b25f", "comment": "Malware payload (PureCrypter)", "value": "fab7bef714427ef5922e986e9c723bf1e45bce7cb647a42c58e23bd4b3216421", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268138, "uuid": "2287ea83-3953-4062-8622-747173708cc8", "comment": "Malware payload (PureCrypter)", "value": "a237be7d066a71bd063956c11f2f0d5f476e823a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675268138, "uuid": "0be83271-d356-45ee-9115-1d3f2fc63c61", "comment": "Malware payload (PureCrypter)", "value": "35f41ed540d651ea5833c3ed35bec420b542ba2fa2980552c2dd6b9cafc69960db5a6e396bc2651531e18f0424bfabb1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268138, "uuid": "f2896268-360f-458c-b9f9-b1c04ad1d452", "value": "T1A7D1B40167ED0236DEB78B3998BB63C00339E2125807DBAFB9E4210A5C016C94B72AA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268138, "uuid": "653a6fd1-9fea-4ad7-843b-18db249a21d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268138, "uuid": "ab8ce9f0-5665-45c7-b909-e833e26f9707", "value": "96:WAwa5N9p+ZNLDApFY1jAdhkxgqEQGnQUzNt:WAwa5grL+OEyxgfFn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675268138, "uuid": "63922cc6-93f9-430c-867d-df1e14149925", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675268138, "uuid": "e1d8a2db-fe8d-4070-b34e-420ad584bbd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675268138, "uuid": "4bf5fdb6-a5b2-4d1c-9617-a573c4cee6b7", "value": "Nuevo pedido 7887979-800898.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d9b8d9-a288-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675294439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294439, "uuid": "bb5a3420-ff32-4fe0-955f-78a695666fd8", "comment": "Malware payload", "value": "d83b5aaa8cdbbf34e814a7903de186a7", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294439, "uuid": "8d746b02-4abf-4838-85e3-312defe37cf1", "comment": "Malware payload", "value": "fb2737102af14478694c8d84cebf5288e248af7aa9abe88b801eb65e4a80a979", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294439, "uuid": "c3406846-e0c5-4bbe-88c6-b407bcde3f18", "comment": "Malware payload", "value": "20e8084324d4ff9e6de5ec583b1319f1b2462baf", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675294439, "uuid": "72abf636-55e2-4882-bdf8-4f8219aa9a50", "comment": "Malware payload", "value": "af26043350f8d7e76cd4159090bc4e28d86a00d3bd74c0974ec5a482fb3defeedd589edfd70850dfadd339996ef52b77", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294439, "uuid": "b0a0764b-6ff9-4d2f-b69b-3c96c3a9e0db", "value": "T1C604541EAD5CFEECA2015817AA3BD5086FC16CC9FA31ACA4C1DDCC62F03571D6D9198A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294439, "uuid": "e823c666-3951-47d9-8b9d-6c61343c8951", "value": "3072:mBFbVb+AOsWu2fNYWxBlogvFZT0cp1veAcXrVKp9lye6gXqRT4JDhOPTNgD8H5Jw:mBF5b+AOsWu2fNYWxBlogvFZT0cp1veG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675294439, "uuid": "8bad41d9-ba2a-4c17-bd7f-f34cbd11b316", "value": 173162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675294439, "uuid": "db19487a-a0ec-4bc6-8fa0-e43fff8e7cbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675294439, "uuid": "7ccd99ff-10cd-4041-a2fc-a062c7c9a265", "value": "out.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a2f1d-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675263373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263373, "uuid": "4904cb39-53f1-4a6f-b684-a9f046806ead", "comment": "Malware payload (GCleaner)", "value": "a708327e4d55ffb7ba8095480d7e8a25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263373, "uuid": "738c2e5c-c3d8-42a2-8049-f0a3ff01c7d2", "comment": "Malware payload (GCleaner)", "value": "fb861a782af83e33211b8f76e715076528e753326056257e15c33463073b5a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263373, "uuid": "1dca0ba6-29d4-4c54-b18d-9b755c7b299b", "comment": "Malware payload (GCleaner)", "value": "f70a4dba48818a62eea256fe492c77b8816e9966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263373, "uuid": "b578841e-6a05-4945-9eea-0b62a2227bde", "comment": "Malware payload (GCleaner)", "value": "e56d27c0d6a72b5cdedc1739005c991dd9ede81d9b70cbd0e102d9a41e1a73ae4ff9551aebd583ff02dba71ab22858b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263373, "uuid": "63532dbb-44ed-4da6-a32e-bcdcada1808b", "value": "T1D444F165B840D033D05590782934E1916D7EB9325EFA9A83BF9527FECF612C22E3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263373, "uuid": "6a1f205e-343a-4527-b621-b89bbc983d18", "value": "f8fcc5813e8e6da25a98928cf56e1d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263373, "uuid": "3e27f677-c050-4e11-90c7-b45a7dae1d5d", "value": "6144:QLiKzxf/ScLKJ81F3fojybiBq3IkOulqlaafGWX:QuKN281lKybiB0Ik5UaYbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263373, "uuid": "36b17bfb-37bc-4e4b-afbe-7b2d5ed24725", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263373, "uuid": "df7e8024-5063-4600-84ee-d63cb8f31b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263373, "uuid": "cc8a97da-2394-4b4a-919b-15258e1fa95d", "value": "a708327e4d55ffb7ba8095480d7e8a25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89d2528-a26c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675282308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282308, "uuid": "90e602ea-993c-4689-902e-4b5a84aba871", "comment": "Malware payload", "value": "7222254955550462f1aca419a892aa95", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282308, "uuid": "cf9b6dbc-1a4f-4a16-9cd7-5b2db35ecbcf", "comment": "Malware payload", "value": "fbdabd9fb1259c2fd91280f26ea2d629558f2613ab62849d43b32b9afff2b9b9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282308, "uuid": "f1e30ba6-3c6a-47b6-9063-22137370125a", "comment": "Malware payload", "value": "2636ca09138561273b61e62ecc239ef4306d87b5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675282308, "uuid": "a01f92f4-325c-490a-9e2f-201b981320bf", "comment": "Malware payload", "value": "4316b0317b5b1444ddc165eda38aa1df5955f6e8ebc7931d9da093b470734611493a9ce004bf87f4281ca4d098a1ffe3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282308, "uuid": "936f3c22-8056-4234-b32a-c23dcff73cca", "value": "T1C154AFE136C04F71D201A2368BCA9A65867AFDE005F0235B5FE676FA2E381D1D2217DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282308, "uuid": "366fb7bf-4604-4ac4-be9f-f3edc614eec6", "value": "8c33fdfbf62cef2f6ac221c4dae63267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282308, "uuid": "0eb6586b-4886-4031-a581-ff64e05664be", "value": "6144:/uj33iwZkzXwPPQLj83KlGOuE7vntTXE6eAi5:/uaXwPVnMt2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675282308, "uuid": "94bbd77e-053f-45d8-a655-18a743fa3db9", "value": 289801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675282308, "uuid": "e46c61f1-d81e-4b33-b2df-60c47c85754e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675282308, "uuid": "1fb351ca-2ee7-415f-be93-f80fd7ce8309", "value": "utility.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bda0ca1-a1fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1675234156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234156, "uuid": "d5419477-d4bc-4b97-af14-b7fc44ef4c9f", "comment": "Malware payload (LummaStealer)", "value": "2f3e344cf75f1e7de675daa76cb26d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234156, "uuid": "b5ad7fa6-fb61-4411-9d70-96d8d7a3f951", "comment": "Malware payload (LummaStealer)", "value": "fc36b43f7f4b785a464fce247090692b3bcad4f3405d599e36fd0184d32637c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234156, "uuid": "4586e051-8e11-4954-91fe-e1a7b78f9aba", "comment": "Malware payload (LummaStealer)", "value": "0092e08bf4cfd31b39bae38acb34088fbbc0da37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675234156, "uuid": "3f61abd9-38b4-4c87-a069-c6987a73dd2d", "comment": "Malware payload (LummaStealer)", "value": "93a8c008c266c483b9110b9e64553cda803180ca1d794eae90c4b27b8f878f56082120d8f4202b5c5de2ac0e68d69dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234156, "uuid": "0067cad0-b811-436f-8bc6-df8f7724a2fa", "value": "T106F6469C7A9072DFC857D472DAA82D68FB5074BB831F4203942715AD9B4E98BCF580F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234156, "uuid": "5b9b5953-67ab-4b37-931d-ff8995557855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234156, "uuid": "88d92e2a-e157-4c11-a478-be662bef3579", "value": "98304:yfvj0c99XePv0bCo88ePugdxMuhL400IkaDBZw1NVGQ6K4ll4b0E/fBY:yfL00Z9bi8edvMuhLVJ9BZeIKql4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675234156, "uuid": "5300a8d6-10cf-495a-ae8f-c4ceca20079e", "value": 16258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675234156, "uuid": "006fa8f5-d9ec-41f2-b53a-6002059f19a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675234156, "uuid": "2ece79a5-aa5a-4ba8-a62d-313c5bc7325b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac7ff7d-a24b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675267924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267924, "uuid": "a6e6083e-a033-4e49-bc6a-d1d93820c246", "comment": "Malware payload", "value": "641bfcab99bf0a840326c806b81f1d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267924, "uuid": "a066fd07-9aea-4076-83f9-3b73d42d8780", "comment": "Malware payload", "value": "fcadf223c5e94b385092722b5352d2098318c2bbfac10c00cee53f5ff186168e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267924, "uuid": "761b2906-5ad8-4ff9-98f8-8c1c5294cddd", "comment": "Malware payload", "value": "9c66ca695e399d11bdbb6d38c53ad280b577355b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267924, "uuid": "aee84792-d58b-49eb-be8a-e5e6baede4d7", "comment": "Malware payload", "value": "a229a6c1c6a56bdfd9a70a40d1c1c6ca5fe413e2af05a1e6c73351b8c6bf3718c267f156ee2a72c0222a4c9ab448769b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267924, "uuid": "16aa342a-531c-47be-83b8-3a67362906cf", "value": "T1B676331130E2CA76E14709F78465A9D8E0E9936429B400B73367EFF6973CD47C94AF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267924, "uuid": "12fb3cfb-cc2a-4d54-a57f-9b2e0315cf76", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267924, "uuid": "f8d0401e-95d2-49b4-b499-c62203b1a4fe", "value": "196608:91OCEURu8b4rX2Sw887QD04AAlg3b/WjCRdhmmjC:3OIt+2SqAlgrK2SQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267924, "uuid": "3dfb4fa5-1ec1-4f22-8543-32d3051a653e", "value": 7593494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267924, "uuid": "36ea7358-9ff5-4024-b580-d57c9d1f3a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267924, "uuid": "5c5c86e9-7a8a-4be5-9ab5-19f078b432d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaf8bcd-a21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675247554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247554, "uuid": "6cb98d4f-244c-40c8-a270-4539fa831c56", "comment": "Malware payload (RedLineStealer)", "value": "938cc2ea0f0469598051eec0942de19f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247554, "uuid": "09f53ed7-d152-4a2a-9d11-a027677b69a5", "comment": "Malware payload (RedLineStealer)", "value": "fce6fca0152d67e557b790f4f54628366a14e7a0758e218ef0afe0f56fc479c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247554, "uuid": "8d7b3d30-00de-40a8-893d-2cff08f73770", "comment": "Malware payload (RedLineStealer)", "value": "56069892d08353fae02f3d4afa48a3220b72355a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675247554, "uuid": "efd903d1-2d30-4746-af0c-243665e90bce", "comment": "Malware payload (RedLineStealer)", "value": "f2e30ae72f53a188c7bd9f9d3541544d2e64120588622a68a53353c94184e8ba7a557d215629da48931421449dd9cae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247554, "uuid": "9bc585e1-1577-4061-a8e5-de3bd9f90889", "value": "T16B74F1323594C331C9F71470682CF394BBAEF432547A695B7BE856AD8F602D4623A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247554, "uuid": "16cc5b8f-6efe-419c-8a4a-8ab82b54c078", "value": "66bfc39816e8f6ee52bb21c72f57e3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247554, "uuid": "75c3345a-7b6e-4964-85e8-d624a9a0fe1a", "value": "6144:GW8eqBALe/kShmaTBQpa56U82TYegjO/aP49YB3zagf07l:GW5EAS/k+FYYjEnaqZB3zaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675247554, "uuid": "0103f76c-7624-452e-861a-2a476af313f1", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675247554, "uuid": "30e53daf-b7bf-4387-928b-683537a477bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675247554, "uuid": "81f90818-0d20-4600-9c14-98034da497a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b268fc5-a1c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675211419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211419, "uuid": "cf047aba-385c-4254-a97d-aa890670fdf4", "comment": "Malware payload (GCleaner)", "value": "0c4242d7082bc7790f69c72468c1f59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211419, "uuid": "40d720b6-f8e9-4790-9f48-bd746951c086", "comment": "Malware payload (GCleaner)", "value": "fd955ff6f04f5399ba58359a0dba7e898d6d1c803a44c24f3c683bf4eecdc2f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211419, "uuid": "48a23224-9f1c-4ef8-a143-a31604ebf30a", "comment": "Malware payload (GCleaner)", "value": "c81cdc1c891858dbe1db4b098e76fa820f09b1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675211419, "uuid": "ab92ed00-7e62-4dc7-9fc1-53ed2e8ddcfc", "comment": "Malware payload (GCleaner)", "value": "68a8fad01fc0b727f352da6fa63b08e28ed113033692dc6f7e8decd51eb9e3afab3d434f6eb785b0f85232f14f615f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211419, "uuid": "fd9e826d-d55c-4b27-95bf-bdf1c44b4773", "value": "T11AA53342B286993AE0635D718A34DBD8FC77BD3358747612363EA25F1E33282E189753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211419, "uuid": "a97545d2-d70a-4f37-bde8-3ca449c21006", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211419, "uuid": "1dc51e63-d37a-4c4c-a095-b548b914f2cc", "value": "49152:C2EkGM9X23F7YvSWT/uIK11OjP+v5ykdDanq+hOdVjLCgv2MR:dEkG40EveR1pv5ykUnHhOPnv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675211419, "uuid": "61005eb5-bf7d-4163-9b1e-5082a61916d1", "value": 2166608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675211419, "uuid": "cbbbcd60-3ce1-4d98-954d-060c255d056b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675211419, "uuid": "aebf3cf6-bde4-49f9-9529-330bec7b86cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d68db5-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675264347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264347, "uuid": "1b8bc15b-13e9-49b8-9f9d-f0b4e1475862", "comment": "Malware payload (GuLoader)", "value": "90b20f23d77c3dfd4ebad8538a5c4284", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264347, "uuid": "95ed0031-e3e4-4a60-a026-a947a6e7dfa6", "comment": "Malware payload (GuLoader)", "value": "fd981dec6198cda93c6d0cecc8891612efbcab4731461d7b6b9b42fdc3831a54", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264347, "uuid": "7764146c-0bcf-46b1-8bd2-1583e9e205be", "comment": "Malware payload (GuLoader)", "value": "c6f9c9c3261e0ae23fd9310fc717fd2854c65c41", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264347, "uuid": "ee626596-f7a1-4e52-aebd-5dda1347c591", "comment": "Malware payload (GuLoader)", "value": "b13370ddb3fcf00cddcf7d2b640c8d057c4302a155f50f81a0990c44e48ed9226120427610d32ec81334f452301dcc24", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264347, "uuid": "6b9fd540-930e-403e-b85a-f90d46dbb36c", "value": "T1447469019B191597FEA8587E21400D9987F4499B1C30AC6BD78FB7C62D3BF0C20DAE9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264347, "uuid": "a63d1aa9-9b77-4ce7-9865-c8fa137428a8", "value": "6144:hvFUdh1+32YLjSuRCMF7x9N6t3CeLVVZw6POOonCfONYUzrW66do+wY:hvFIh03dLjfRCMZg3CeZDbP3FsC6ytwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264347, "uuid": "c80be424-c618-44dc-9789-25cbfb2e9f55", "value": 340819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264347, "uuid": "26736b4a-cd71-49af-bbd8-201dc429f7d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264347, "uuid": "406cdcfa-07b7-49a3-90f2-0684fe6dde06", "value": "ConfirmingPagadas.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac751f7-a231-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675257025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257025, "uuid": "91060b20-47b8-4805-a18d-2541e8177bd4", "comment": "Malware payload (DCRat)", "value": "4f85fd9da0e6d825b520f09905b16301", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257025, "uuid": "b145c919-90ca-46ff-a38e-5e66e381a6c7", "comment": "Malware payload (DCRat)", "value": "fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257025, "uuid": "1e453f18-ca9c-4e47-9583-ccc88b06a1f8", "comment": "Malware payload (DCRat)", "value": "11b96ca925a09cd96569c4be2930b9b2bad9dd07", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675257025, "uuid": "efd8f843-8b10-4e03-983e-0265a673fd4a", "comment": "Malware payload (DCRat)", "value": "86ada60ee03263cb309d7fc104a7ed763c726c46d7d071615f87c2a06d9b46c84954184e3f520da21c5e60c3b8b76556", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257025, "uuid": "a6c554f8-7ca1-40c3-b125-e619e858bc78", "value": "T1813507123E46DD03C0691A37C9EF856547A8BD817B66DB2A7E9F335A60123A70D0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257025, "uuid": "4e2d52c5-ba9d-462e-b183-5b31b265aeaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257025, "uuid": "6ad93b93-72ce-4580-b835-be730c98e6d9", "value": "24576:TGyavpdrgnar7l2odPdcsZHpa+AGO05d2GqXW+lWR++4:wlr7tcsZHpaVwulm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675257025, "uuid": "18a46269-4c96-4cd7-a427-370dddb3f82f", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675257025, "uuid": "6144b023-6c0f-4a3a-8193-d0a27e705d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675257025, "uuid": "8d98f4c5-eed6-4a00-acb5-ba3c8c91e7d0", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-fd9e479531a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d61b133-a249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675267123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267123, "uuid": "8bd39df2-bec6-421b-82a6-e5d8b20d2e4b", "comment": "Malware payload (Formbook)", "value": "26c7d12b0821025da0bd213a5b694b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267123, "uuid": "ffd413bf-2fa1-4a12-ae6c-ef7654387b3c", "comment": "Malware payload (Formbook)", "value": "fdf0c7d08d92b27b19cd74779d71066a5605f3389421a4b9f3e50276ed7223ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267123, "uuid": "a4ecd367-bec8-4bf9-879b-e80ee69266e4", "comment": "Malware payload (Formbook)", "value": "c2dd79def4ed6f053f92f3d6a061484d43fb3ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675267123, "uuid": "dbcbc52b-43e8-4660-b3f5-5078f951dec9", "comment": "Malware payload (Formbook)", "value": "b6aea6eff8da9cf5129e045d7ab76bc15d536f28ef90a6e5815d56ce5f90f5978088ba603bfcfbbc26fb590a36c91661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267123, "uuid": "60d4c208-f833-47e4-8cfb-cb8ca7df2bb5", "value": "T1F5C4232235F867BCC03CCBBD95B4D8744331BA72E942F6110E9990D9195FB681BA36B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267123, "uuid": "07c5b646-4cdf-4253-ba26-dd71c57354d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267123, "uuid": "cef55fb1-1162-4c3c-ae91-755fb1f43918", "value": "12288:NOscLw5jo54uMoXdLGAPr8z9i7+pv1CWtO:NPXq4VoXsor8zw6R0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675267123, "uuid": "254a9357-9231-470f-81c5-f46acf33d4cc", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675267123, "uuid": "9bb52179-93ee-45cc-83f2-ba6595286294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675267123, "uuid": "4252848e-ffc5-4402-9fa6-c86652b0518d", "value": "26c7d12b0821025da0bd213a5b694b9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dc12a7-a242-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675264161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264161, "uuid": "48d75a3d-9d45-45b0-892f-8d4f1a3fbd5f", "comment": "Malware payload", "value": "0381298bb37de8df6b6e65d33b182a31", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264161, "uuid": "f62ae91a-ead5-4834-935a-77b72419e8ee", "comment": "Malware payload", "value": "fe1c866912aa45407548c1321068b8e65b78536349db5794543611c8e385a276", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264161, "uuid": "7a7df7c8-b6a4-4211-b2dd-a9ddd3a8b98f", "comment": "Malware payload", "value": "d84c0f74b1d52e4832ee4dab227cbc91acad563d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675264161, "uuid": "4a4c8e26-51f6-41ed-945e-dcbd8a79ef61", "comment": "Malware payload", "value": "ca2ec637b447508c44222fb0a0677e2d8d25a0aac0a13a7369495d617393b3215f984a104e0a6750486817a839b59289", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264161, "uuid": "d540eeef-6a3d-4134-a647-333f6ba79541", "value": "T1E964BFE077909DE2EEDE9B97955A1D9C1626217BEECA24CC0046FFC939773408A0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264161, "uuid": "1c6bb355-94e1-48c0-b127-5511d12b3924", "value": "3072:y8KHUISg+ezZZg/V1mvzRBropYphBseoCCvKjRjl7xAIyQbLD1jeL1RQ:yN0RsZg//m7nrOChBsVCqgNNx+QL1eJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675264161, "uuid": "387dc651-9a17-44ae-bf7c-18a52519e09f", "value": 314429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675264161, "uuid": "8a703bff-9a5e-47ef-919c-f606406d203b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675264161, "uuid": "1585e498-2a35-4b62-b2ec-46102b1220bc", "value": "RFQ 13842.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d53cad3-a27e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675289779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289779, "uuid": "a320ca75-3103-4c51-927b-28a4a2140cef", "comment": "Malware payload (AgentTesla)", "value": "5503862a375471cf0bdab140e86c8a20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289779, "uuid": "f1e247d3-0598-4bca-a8c0-f86aba3f1e4a", "comment": "Malware payload (AgentTesla)", "value": "fe7b739d390e7d8622edcfdd707d43b1f27b26514659c8158f5ea310c618f306", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289779, "uuid": "72fd2712-e231-4987-9d4a-6940ef1a325f", "comment": "Malware payload (AgentTesla)", "value": "cf6f09b262dfdee3c52b5deeb593dc3081ffb734", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675289779, "uuid": "f2211bdc-dc78-4812-9b63-8de806610ab8", "comment": "Malware payload (AgentTesla)", "value": "74d77943c7be9f7bb705b74f4cd982f1d252c642ff7c9e1d9939cd0918e0fa018b9119e78fb467eb61bdf9386352bf23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289779, "uuid": "d768f8e9-f4c2-42e3-8c30-9541309a73c4", "value": "T1FC641208A996C9AFE5F918705E6A3E3F4FD4DC251038F60F231107AA3F15AC6961D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289779, "uuid": "396b7fab-231c-49d0-8d4a-e8e23da24665", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289779, "uuid": "68ca794d-411f-488c-8304-80863cc2adca", "value": "6144:vYa6njnnlgY86XdS4QyzRd35+MMkuhcGujR+GKlm2n1K:vYljnlBdHQyzn5vMkuh6Ytm2n1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675289779, "uuid": "cb3faf40-cca1-479f-b7b2-d6d8eff22d5e", "value": 313134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675289779, "uuid": "3d7b27b6-0db6-4832-830b-973a16561641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675289779, "uuid": "5481be94-a8d4-405f-afae-3d16b7fc170b", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c83fd87-a240-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675263310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263310, "uuid": "872a3fd0-2f28-4214-b17a-d29768c7c9cb", "comment": "Malware payload (Vidar)", "value": "cacd37281c5470cfc13e6db90942d371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263310, "uuid": "f7518e3f-dbf8-4fee-85a8-26e0c96f0ae3", "comment": "Malware payload (Vidar)", "value": "fe8dd23da7d898858d6a280cd58d4ca332f958a4f9562bf8f364dc4340f9c34c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263310, "uuid": "85465699-e1d7-4d83-8657-34fa0e0dd11c", "comment": "Malware payload (Vidar)", "value": "af9e1477a51858376bd113f8247b4f6ff1b94445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675263310, "uuid": "52c30416-e273-4020-bc0a-05b28d791ab6", "comment": "Malware payload (Vidar)", "value": "f98d043ab21fd8149bbcf1f5e75343f5075a354126573da994c454304f83428b22562741ef9c74abeb490dedb9d15fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263310, "uuid": "fef4ff2c-dc12-4a47-851f-44dc3f650f35", "value": "T1EB540124B940D072E84212756A20D641BB5EFD369C7AC527BF412FAE5FF12E0632A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263310, "uuid": "69b81ec7-226c-4cba-be87-5d97956bc794", "value": "f8fcc5813e8e6da25a98928cf56e1d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263310, "uuid": "73f65808-b100-412b-9dab-6f8d0c72b025", "value": "6144:okJLJcABUxIoJs9UdWBqm67GeYql4BNMeGNPpJ81rIg5O:oWOABUxIoJs6wzHeYql4wecPI1sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675263310, "uuid": "e4a35230-fb94-4305-9708-bc2192bb01ac", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675263310, "uuid": "1575b678-ebaa-4b23-b32e-4d82ef7ef60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675263310, "uuid": "e72a2e9a-060c-4171-8154-cba3c0961622", "value": "cacd37281c5470cfc13e6db90942d371.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b543d420-a1f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675232508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232508, "uuid": "ead5010b-398b-49e7-85ca-42b8f0b2a927", "comment": "Malware payload (GuLoader)", "value": "3b49d86ad344fc3aabdef0ac04195e83", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232508, "uuid": "f9180023-f1aa-4f84-8b2b-9cc3ae2f4021", "comment": "Malware payload (GuLoader)", "value": "fe9dcf1de0b47950294a318a23cd37374483e6f6ac5eb6cfb941957a1fe04685", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232508, "uuid": "6d35f42c-a4dc-4f83-98c9-2a4d319ab953", "comment": "Malware payload (GuLoader)", "value": "b3b4d0470260da2bcfe5fa9feaeb98c3b79a39fa", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675232508, "uuid": "dd23c655-f2fd-4ace-98e0-e71121e2919e", "comment": "Malware payload (GuLoader)", "value": "ea73ec837660c8d0822d4bce61b9bba3a144925eda54ac35247d09be50add945ffcd859662329d2b8b307cf3b4bd43fe", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232508, "uuid": "605a8e07-abda-4c99-9c3b-8ac1f7f58018", "value": "T1ED536B10AB5416174C0B0F566C813BCE487A4F2733267CAAA19B72BA35F2F78F77A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232508, "uuid": "72a7196b-8756-40b2-ad86-dca0373ad239", "value": "1536:1hRQJFsWO0ZhVy02qDqPKviVvYeIcKxpC:14JGWO0hyLqDqPKKV1Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675232508, "uuid": "b525e3d3-ed49-44d1-b024-3b66981013e5", "value": 62901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675232508, "uuid": "4400aaef-cf97-4661-a73b-d0c01128a9f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675232508, "uuid": "bbf6cf60-80b2-4995-938a-d9e480c8e12a", "value": "lol.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9dc130-a23e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675262454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262454, "uuid": "317a740f-adff-4d96-a240-ab6f28cfef48", "comment": "Malware payload (GuLoader)", "value": "20064489fa3ac2a630c91349eff51a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262454, "uuid": "e564896b-9071-47f4-bf16-4fbe265a42d9", "comment": "Malware payload (GuLoader)", "value": "ff4d020f863640a8293f18199ed4f2726f47634791acb710242b26338eb03bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262454, "uuid": "03f981f3-b3a1-4413-8e83-6329c07e935d", "comment": "Malware payload (GuLoader)", "value": "7e92db01f3a9efda3b3c40aacc3fb94a925795e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675262454, "uuid": "b0a38002-1677-4da3-92b4-c5468cec4ce7", "comment": "Malware payload (GuLoader)", "value": "64fb3ef91563e0602c9e07e9fab6d67d6116882b57220d194c44e901f8022e22d01c2fad9095361b838997f57cbdd896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262454, "uuid": "bd04f02e-a653-4174-9b1b-013a17756bdb", "value": "T1FB44235312F2D9E7D4D37370688B9A7AFF32AD1434504B675F408FA52E3AAD1461818B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262454, "uuid": "511ea8ed-ce3d-44d1-a01e-122f4f924599", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262454, "uuid": "7baa64e6-bf38-4294-b6c7-b786cec13de4", "value": "6144:mi2E/9V8UPdqIZlGZ4LThsnRdgpVHjEPvMq4ME6+aP6gIWLuKBx:5H8UPdqAqHIpZj1qtFJ8Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675262454, "uuid": "9a8c8876-af7d-400d-bd71-77f52a123024", "value": 272364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675262454, "uuid": "862ccda9-c105-4395-a9c5-0893b0b6225b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675262454, "uuid": "68aabd52-4f1b-481c-9a70-97a5fee0b223", "value": "SC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4d29cb-a219-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675246775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246775, "uuid": "a6992b50-0b7b-43b1-aa4a-8f8ac968ae3c", "comment": "Malware payload (Smoke Loader)", "value": "b430d4a597b2db5219ae41bff356bd23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246775, "uuid": "7b4e78f3-eda9-4e77-845f-1e06b63a796e", "comment": "Malware payload (Smoke Loader)", "value": "ff77be205998e66b1c09963a16ef58b4a95637347c0b71c73d4b05fae2052f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246775, "uuid": "041dbf66-19f8-4523-80aa-7081386150ef", "comment": "Malware payload (Smoke Loader)", "value": "282145d13c473993656a83d28d500d65b0a4a38a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675246775, "uuid": "0ddb94ac-4d26-4fed-8e21-f7ef64a3b270", "comment": "Malware payload (Smoke Loader)", "value": "f9fc833d8beb7ea64f2b4475b4687e42c5a5a6e4ff05234b1e180665ec654e32a5c86e96228bdf67af495fed41b7fccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246775, "uuid": "76f5655c-5665-4b49-9dcc-9755f1f38dc2", "value": "T18C34D0323580C032C2BB11716C20E7AD7BBEB9305578985B7B6817AD5F706E0AB3934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246775, "uuid": "73744009-f849-476f-a334-dd0a35c8dbef", "value": "1bd819fed1b7e1f177cee8ab49452c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246775, "uuid": "37c3b293-6bf9-495e-b660-c5c2a14dcada", "value": "3072:gWBGZPc6VltuRs8LrRW1w5i4dIFpbFryS0x7T2AvrrOE:gWBuxTuFLrRwgdCbhCx7KaOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675246775, "uuid": "bf4f6d10-8c3e-4254-bd0d-9c3b1e26aec2", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675246775, "uuid": "5e082a47-904e-48a8-b224-d79d88718b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675246775, "uuid": "588d79f7-3497-41f8-a605-5be9fe6cf148", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }